Vendor and Sub-processor Reviews
Which vendors see customer data, credentials or model outputs, what their terms permit, and what your DPA and sub-processor list must disclose.
Vendor and Sub-processor Reviews
Insights
Your Sub-Processor List Is Probably Wrong: What a Privacy Attorney Checks First
Ask most startups for a sub-processor list, get a vendor list instead—that gap is where GDPR exposure quietly sits.
Federated Learning: Great Idea and Expensive Reality
Move the model, not the data. Great for privacy, expensive for infrastructure.
A GDPR-Compliant Vendor Doesn't Automatically Mean Your Data Transfer Is Legal
Your vendor says they're GDPR compliant. That doesn't mean your data transfer to the US is legal—those are two separate questions.
Need help with Vendor and Sub-processor Reviews?
Send us what you have, or tell us what you need. We quote a flat fee before the work starts and a senior attorney owns the outcome.