Subprocessors
Every third party a system talks to holds part of what customers hand over; the list is short by design and written down.
Every third party a system talks to holds some part of what customers hand over, and a business that cannot name them cannot answer a question its own customers are increasingly obliged to ask. The list is kept short by design — and it is written down, because a short list nobody has enumerated is indistinguishable from a long one.
Each entry records the party, what it does, what data reaches it, and where that data is held. Four fields, which is few enough to be maintained and specific enough to answer the question somebody is actually asking.
The list includes the parties nobody thinks of as vendors. A hosting platform, a domain registrar, a mail sender, an error tracker and an analytics provider all receive data, and error trackers in particular receive whatever happened to be in scope when something went wrong — which is not a category anybody chose.
Adding one is a decision, not an installation. A script pasted into a page because somebody wanted a metric is a new party receiving visitor data, and it arrives with no review precisely because pasting it took a minute.
Analytics and tag managers get the most scrutiny, because a tag manager is permission for arbitrary future code to run with full access to the page. Whatever it loads today, it is an open door to whatever it loads next, and audits of what a manager actually loads are rare.
Payment processing is arranged so the sensitive values never reach systems built here. Card details go directly to the processor, which removes an entire compliance regime from scope instead of attempting to satisfy it.
Fonts, icons and libraries are self-hosted, not requested from a third-party network. A font CDN receives a request from every visitor, carrying an address and a page reference, which makes a typographic decision into a privacy one.
The list is revisited when things are removed as well as added. A service disconnected six months ago that still holds an export is still a party holding data, and it will not appear in a review that only looks at what is currently wired up.
It is published rather than kept internally. A business asked who processes its data should be able to point at a page, and a list that exists only in a spreadsheet is one nobody can check.
What this does not cover.
- Third-party tag managers loading scripts that cannot be audited.
- Card details passing through systems built here rather than directly to the processor.
- Fonts, icons, or libraries requested from third-party networks at page load.
Security & Compliance
Claims and their disclosures
A claim and its required condition are one object, so a claim whose disclosure is missing cannot be rendered at all.
Data handling
The design question comes before the security question: a field that was never collected cannot leak, be retained too long, or turn up in a log.
Security posture
A description of practices, not a certification, published so it can be inspected and argued with.
Secrets and configuration
A credential committed alongside the code has been distributed to everyone who has ever taken a copy, and deleting the file does not retrieve it.
Input and trust boundaries
Anything arriving from a browser was composed by whoever is sitting there, not by the form that was designed.
Sources and verification
A requirement drafted from general knowledge reads exactly like one drafted from the statute, so the source and the date are stored as fields.