Know every tool your customers' data touches.
DPAregister derives every contract × sub-processor verdict from your live stack, nightly. Not from a spreadsheet someone remembers to update.
This is the page your customer opens from the notice mail. They see the list, acknowledge the change, or object and name the clause it conflicts with.
One register answers the whole question
Which customer's data can this vendor see, under which paper, from which country. The chain is the model. Every link is a real record, not a tag.
Computed, never typed
No control in the product lets a human set a colour. A verdict comes from the facts on record: where the service runs, whether the transfer mechanism holds, what the contract allows. It changes when the facts change.
Facts arrive from CI manifests, egress and CSP observation, and your accounting ledger. The register notices a vendor nobody registered. A person still rules on it.
eu-central-1ie1us-default USA human presses send
No autonomous email. Every notice is one person, one press, and a line in the audit trail naming them.
Silence concludes nothing
An unanswered notice reads as unanswered. When a window closes we say the window closed, not that anyone agreed.
Nothing is a claim we cannot show
Approvals expire. DPF checks are dated evidence, with the date on screen. The word ''compliant'' appears nowhere in the product.
See it against your own stack
Bring one product and one contract. The first verdicts take an afternoon.