Vendor inventory
Every processor and sub-processor, with the data categories each one touches.
Section 8(2)·Governance·8/12
Vendor Risk
Your processors are your liability
Under the Act you stay accountable for what your processors do. This module tracks every vendor touching personal data, the contract that governs them, and whether their security posture still matches what they promised.
- Expired DPAs
- 0Expired DPAs
- Renewal alerts
- AutoRenewal alerts
- Vendor truth
- 1 placeVendor truth
console / vendor-riskLive
Vendor Risk
Section 8(2) · Governance
- Vendor inventory
- DPA lifecycle
- Security questionnaires
- Continuous monitoring
0Expired DPAs
AutoRenewal alerts
1 placeVendor truth
What Vendor Risk does
Four capabilities that together close this obligation — and feed the same audit log every other module writes to.
Book a walkthroughDPA lifecycle
Contract status, renewal dates and clause gaps surfaced before they expire.
Security questionnaires
Send, chase and score assessments without another spreadsheet round-trip.
Continuous monitoring
Breach news and certificate lapses raise a review on the vendors it affects.
Sub-processor discovery
Surfaces the vendors your vendors use, which is where most unknown exposure sits.
Risk tiering
Vendors are tiered by the data they touch, so review effort goes where it matters.
From zero to live vendor risk
- 120 min
Import your vendor list
Spreadsheet, procurement export or connector — whatever you already have.
- 21 day
Link vendors to data
The data map tells us which vendors touch personal data, and which categories.
- 330 min
Send first assessments
Questionnaires go out with automated chasing, so you stop writing reminder emails.
What changes on day one
Without Vendor Risk
- Vendor list lives in three different spreadsheets
- DPAs expire without anyone noticing
- Sub-processors are entirely unknown
With Vendor Risk
- One vendor register tied to the data map
- Renewal and gap alerts before expiry
- Sub-processor chain visible and tiered
Common questions
Yes. Under the Act you remain accountable for processing carried out on your behalf, which is why processor oversight is not optional.
Other modules
11 moreConsent Management
Capture, version and honour every consent
Cookie Consent
A banner that does not quietly break the law
Data Inventory
Know what personal data you hold, and why
Data Map
See where personal data travels
Rights Portal
Every data principal request in one queue
Compliance Dashboard
One number your board will actually ask for
Risk Register & DPIA
Assess before you launch, not after
Breach Response
The clock starts before you are ready
Data Retention
Delete on schedule, and prove it
Cloud Security Posture
Reasonable safeguards, continuously checked
Compliance AI
Ask your compliance posture a question
Get the DPDP readiness checklist, free
42 questions covering every operative section of the Act. No account needed — tell us where to send it.
30 minutes·one real data flow
Ready to Simplify DPDP Compliance?
Most vendors open a deck. We open the product, map one of your real data flows, and tell you honestly how far you are from compliant.
- No slides
- No obligation
- Data stays in India
What the 30 minutes looks like
- 0–5Your stack, in your wordsWhere data lands today, and who already owns it.
- 5–15One real flow, mapped liveWe connect a sample source and build the map on the call.
- 15–25Where you are exposedThe gaps we can see, ranked — including the ones you already knew.
- 25–30Effort and costWhat closing them takes, and whether we are the right answer.
If we are not the right fit, we will say so on the call rather than three follow-ups later.