Where your software actually runs, who else touches it, and how long it will be supported.
Every field below carries the page it came from and the date we read it. Nothing is a rating, a score or a verdict — we record what vendors disclose, and what changed since.
3of 20 state no EU data location at all
7publish a compliance page no ordinary client can read
4of 5 shipping software miss the CRA five-year floor
542sourced facts, each with its page and date
Data residencyWhether an EU data location exists, which plan reaches it, and what it costs.3 of 20 unstatedSupport windowsHow long each product is supported — and which vendors have never said.4 of 5 under the CRA floorTrust centresEvery vendor's own compliance page, including the gated and the JavaScript-only.1 last dated over a year ago
What is in here
For each vendor: who legally operates it, where the data sits, who else touches it, what it is certified for, how long it is supported. Every field carries the page it came from and the date we read it. 345 distinct subprocessors are recorded across 20 vendors — see who relies on whom, or the change log.
Observation began 2026-09-17
What this is not
We never rate a vendor. No badge, no score, no verdict. Compliance is a property of your use of a tool, not of the tool — the same product can be fine for your newsletter and wrong for your HR records. So we record what vendors disclose and let you decide, and the only computed figures here are arithmetic that shows its inputs.
And a second reason, worth stating plainly. A verdict is something a sponsor could buy. A dated observation is not.