You vetted the vendor. What about the vendors behind the vendor?

A typical vendor assessment looks hard at the company you are about to sign: their certifications, their breach history, their contract terms. What it rarely captures is who that vendor depends on to deliver the service — which cloud hosts the data, which AI provider processes it, which communications platform carries it, and in which countries all of that happens.

Vendors do disclose this — mostly. GDPR pushed data processors to publish subprocessor lists, and most credible SaaS companies now maintain one somewhere under /legal. But those pages sit outside your vendor register. Nobody copies them in, nobody reviews them at renewal, and nobody notices when they change. The information exists; it just is not part of your programme.

Fourth-party visibility has moved from good practice to explicit expectation across the frameworks that matter to regulated and audit-facing companies.

DORA and the ICT subcontracting chain

DORA is the bluntest about it: financial entities must understand and record the chain of ICT subcontractors behind critical services, and the Register of Information expects subcontracting relationships to be identifiable — not just the direct provider. "We only track our direct vendors" is no longer a defensible position for anyone in scope.

GDPR and subprocessors

Article 28 makes subprocessing a controlled activity: processors need your general or specific authorisation, must flow equivalent obligations down the chain, and must give you the chance to object to changes. Those rights are only real if you actually know who the subprocessors are — which is why the published subprocessor list exists in the first place.

ISO 27001 and SOC 2

ISO 27001:2022 added A.5.21 — managing information security in the ICT supply chain — precisely to push assessment beyond the direct supplier, and SOC 2’s vendor management criteria increasingly draw auditor questions about how you evaluate the providers your vendors rely on. NIS2 points the same direction: supply chain security, explicitly including suppliers’ own supply chains.

You do not need to assess every subprocessor to the depth of a direct vendor — nobody can, and no framework asks you to. What good fourth-party management requires is a reliable register and a review rhythm:

• Every material vendor carries its list of subprocessors — name, what they do, and where they process
• Each entry is traceable to evidence: the vendor’s own published disclosure, not a questionnaire answer from memory
• Non-disclosure is recorded as a finding in itself, and chased through the DPA — silence is information
• The picture is reviewed at onboarding and at renewal, not captured once and left to rot
• Someone periodically looks across vendors, not just down each one — shared dependencies are the whole point
• Contractual flow-downs (equivalent obligations, change notification, objection rights) are checked against the real list

• The questionnaire approach.A “list your subprocessors” question gets answered by an account manager, from memory, once. It is stale before the onboarding closes and nobody is accountable for keeping it true.
• The spreadsheet approach. Someone diligent builds the fourth-party tab by hand from twenty legal pages. It is accurate for exactly as long as they keep maintaining it, and it dies with their next role change.
• Name-only lists.“AWS, Google, OpenAI” without purpose or processing location answers no question a regulator actually asks. The value is in what each subprocessor does and where — that is what changes your residency and criticality analysis.
• No source, no date. A list with no link to where it came from cannot be defended in an audit and cannot be re-verified when the vendor updates their disclosure. Evidence is the difference between a register and a rumour.
• Only ever looking downwards.Each vendor's list is reviewed in isolation and nobody asks the cross-portfolio question — so the concentration risk that fourth-party management exists to surface stays invisible.

Vendorapp treats the vendor’s published disclosures as the source of truth and does the collection work for you. On the Expert plan, every vendor screening also reads the vendor’s own website and legal pages — including the /legal/subprocessors-style registers most SaaS companies now publish — and builds the subprocessor picture into the vendor record itself.

1. 1

   Detection at screening time

   When a vendor is screened, Vendorapp locates and reads their subprocessor disclosures and extracts each subprocessor with its purpose and processing location. No questionnaire, no chasing — the register builds itself from primary sources as you add vendors.

2. 2

   Evidence linked to every list

   Each detection records the exact source page it came from, with a timestamp. When an auditor asks where an entry came from — or a vendor updates their disclosure — you are one click from the primary source.

3. 3

   Honest about non-disclosure

   Three states, clearly distinguished: subprocessors identified, the vendor explicitly discloses nothing, or nothing was found on their site. A vendor that publishes no subprocessor register is a finding in its own right — Vendorapp says so instead of showing a comforting blank.

4. 4

   Curated by you, on the record

   Detection gets you 90% of the way from public disclosures; your team can edit and extend each vendor’s subprocessor list where contract-specific knowledge beats the public page. The curated register lives on the vendor record alongside everything else.

5. 5

   In the certificate, in the audit pack

   Each vendor’s subprocessor register appears in their Entity Certificate — so the fourth-party picture travels with the evidence pack you already hand to auditors and customers, vendor by vendor across your register.