Hundreds of vendors monitored
Your entire vendor portfolio. Monitored.
Terms, DPAs, and privacy policies across hundreds of SaaS vendors—global and EU-native. Don’t see yours? Just ask.
DORA, NIS2, and GDPR all require continuous vendor monitoring. You need the evidence. We generate it.
Actual vendor agreement changes from the past 6 months — each one potentially relevant to GDPR, DORA, or EU AI Act obligations. Every one landed without most companies noticing.
Affiliates are companies controlling, controlled by or under common control with us, including, for example, LinkedIn Ireland, LinkedIn Corporation, LinkedIn Singapore and Microsoft Corporation.
Affiliates are companies controlling, controlled by or under common control with us, including, for example, LinkedIn Ireland, LinkedIn Corporation, LinkedIn Singapore and Microsoft Corporation or any of its subsidiaries (e.g., GitHub, Inc.).
LinkedIn now shares your professional data with every Microsoft subsidiary — including GitHub — for AI training. No DPA update, no consent refresh, no sub-processor notification.
Review against GDPR Art. 6 (lawful basis). Request an updated DPA with an explicit sub-processor list and purpose limitation for AI training.
Detailed “Exhibit B — Technical and Organizational Measures” with specific controls for Identity/Authentication, Cloud Security, Data Access Control, Physical Security, Incident Response, and Business Continuity.
“OpenAI will implement and maintain reasonable and appropriate organizational and technical security measures to protect Customer Data, as set forth in the Agreement and the Trust Portal.”
OpenAI deleted two pages of specific security commitments from their DPA and replaced them with a vague reference to an external Trust Portal they can change at will.
Assess against GDPR Art. 32 (security of processing). DORA-regulated firms: verify contractual security commitments meet ICT third-party risk requirements.
Figma received 0 government requests of the type described in the Schrems II CJEU judgment (C-311/18). No court has found Figma eligible to receive process issued under FISA Section 702.
Figma publishes this report on an annual basis to share information with its customers regarding the government information requests, if any, Figma has received.
Figma removed the exact data DPOs need for Transfer Impact Assessments — zero government requests under Schrems II, no FISA 702 eligibility — and replaced it with vague annual report language.
Review against GDPR Art. 44–49 (international transfers) and Schrems II (CJEU C-311/18). Request detailed transparency data for your Transfer Impact Assessment.
Liability for breaches of confidentiality obligations, indemnification obligations, or prohibited uses will not in the aggregate exceed ten times (10x) that amount.
For claims arising from a party’s breach of its confidentiality obligations or security obligations under the DPA, each party’s aggregate liability will not exceed two times (2x) the General Cap.
Vanta — a compliance and security vendor — reduced their own liability cap for security breaches by 5x. If your vendor’s commitment to covering breach damages drops from 10x to 2x annual fees, your risk exposure changed. Potentially relevant to DORA Art. 30 and NIS2 Art. 21 requirements for ICT third-party risk management.
Review against DORA Art. 30 (liability allocation for ICT third-party providers) and NIS2 Art. 21 (security risk management). Assess whether the reduced cap meets your organization’s risk tolerance for a security-critical vendor.
DORA, NIS2, and GDPR all require you to monitor vendor contracts continuously. None of them accept “we didn’t know it changed” as an answer.
ICT vendor oversight
Financial supervisors can request your evidence trail at any time. Proviqa helps generate it—continuously, not once a year.
Banks, insurers, investment firmsSupply chain security
Your vendor weakened their SLA last month. Your risk profile changed. NIS2 says you should have noticed. Proviqa makes sure you do.
Critical infrastructure, digital servicesProcessor compliance
Your vendor changed their DPA—new sub-processors, broader data use. Under GDPR, the controller is responsible. Silence is not oversight.
Any company processing EU personal dataProviqa provides automated change monitoring for informational purposes. It does not constitute legal advice.
Terms, DPAs, and privacy policies across hundreds of SaaS vendors—global and EU-native. Don’t see yours? Just ask.
List the SaaS vendors your team depends on. We start monitoring their terms, DPAs, and privacy policies within hours.
Plain-language summaries. Severity ratings. Each change flagged against GDPR, DORA, and NIS2—so your team knows what matters.
Immediate alerts to DPOs, CISOs, and procurement—with the documented evidence trail auditors expect.
Starting DORA or NIS2 compliance? We’ll audit your vendor agreements from the past 6 months—what changed, what’s relevant, and what your team should review first.
Tell us which vendors to audit. We check terms, DPAs, and privacy policies from the past 6 months.
We scope the work and send a flat-fee quote. No surprises, no hourly billing.
Side-by-side diffs, regulation mapping, severity ratings, and flagged items—ready for your DPO or CISO.
“How do you monitor vendor contract changes?” If the answer is “manually” or “once a year,” that’s not continuous monitoring. Under DORA Art. 28, GDPR Art. 28, and NIS2 Art. 21, continuous monitoring isn’t optional—it’s a documented obligation. An honest answer without evidence is a finding.
A vendor quietly updated their DPA. Sub-processors changed. The 30-day objection window opened and closed. You never got an alert. You never reviewed it. Under GDPR, silence from the controller isn’t neutrality—it’s implicit consent. The risk didn’t announce itself. It just landed.
For DPOs, CISOs, and compliance teams.
Start generating the evidence your regulators expect. Two minutes.
Start monitoringNeed a compliance baseline first? Request a baseline audit