Subprocessor Chain Auditor
Maps where personal data actually ends up
- 8hard rules
- Things it must never do, enforced in every run
- 5handover rules
- Conditions where it stops and gives the work to a person
- 12output fields
- A structured result, not a paragraph you have to re-read
- ≤8steps per run
- Bounded work: at most 6 tool calls, enforced by the runtime
Read-only by design. This agent has no path to sending, spending, publishing or committing anything. Where that limit is the product, removing it would remove the reason to trust the output.
Overview
Data protection obligations follow personal data wherever it goes, including to every subprocessor your own processors engage. Almost nobody can produce that map. They can list their vendors — that is a procurement record — but the layer below is a set of web pages each vendor maintains separately and can change without asking.
The gaps are consistent. A processor used with no data processing agreement at all, usually because a team adopted the tool rather than procuring it. An agreement that predates the current scope, covering a service that has since expanded. Personal data reaching a country the agreement never contemplated. A vendor's subprocessor list changed while nobody watched, because the contract only required them to publish the change rather than notify anyone.
And the record of processing itself — the register most regimes require you to maintain — was written once during a compliance project and has described a fictional company ever since.
This agent builds the chain from your own records, compares the register against what is actually in use, and names every gap. It gives no legal advice and makes no compliance determination: it reports what the documents say and what is missing, and whether that amounts to a failure is a lawyer's judgement about a specific regime.
Benefits
You can answer the question
"Where does our customer data go?" — asked by every enterprise buyer.
Gaps found before an audit
Or before a customer's diligence finds them for you.
A register that is true
Which is the point of having one.
What it does
Maps the layer below your vendors
Your processors' own processors. A set of web pages they can change without telling you.
Finds processing with no agreement
Usually a tool a team adopted rather than procured. The most common gap and the easiest to prove.
Catches scope that outgrew the agreement
The agreement is real and signed, and describes a service that has since expanded past it.
Flags unexpected locations
Personal data reaching a country the agreement never contemplated, via a subprocessor you never chose.
Tests the register against reality
Most records of processing were written once and have described a fictional company ever since.
Gives no legal advice
It reports the gaps. Whether one is a breach is a judgement about a specific regime, for a lawyer.
What this changes
What this changes about your week
- It takes over
- Mapping where personal data actually ends up, past your own vendors.
- Done today by
- Written once during a compliance project and never revisited.
- How often
- Annually on paper.
- Typical manual effort
- Every agreement read against every vendor's own subprocessor list.
Why Legal in particular. You know your vendors; the layer below is web pages each vendor can change without telling you. And the register most regimes require has described a fictional company since the day it was written.
Runs unattended
Started by you or by an event, and it finishes on its own. Nothing waits for someone to be at a desk.
The same standard every time
The two-hundredth item is held to the bar the first one was. Consistency is the part people cannot sustain.
It cannot act on its own
Subprocessor Chain Auditor has no path to sending, spending or committing. That limit is why its output is safe to act on.
How it runs
This agent runs server-side through the PROMIVO runtime. Each run is logged step by step and every tool call is permission-checked before it executes.
- 1InputValidated against the agent input schema
- 2Modelclaude-opus-5 with automatic fallback
- 3Toolssearch_knowledge, extract_structured_data
- 4PermissionsRuns READ actions automatically; anything higher waits for approval
- 5OutputStructured result matching the output schema
- 6LoggingTokens, duration and every step recorded
Demo
Demo dataIllustrative sample output, abridged.
Input
{
"asAtDate": "2026-09-02",
"processors": [],
"reviewWindowMonths": 12
}Output
{
"chain": [
{
"vendor": "Support ticketing platform",
"usedFor": "Customer support correspondence",
"agreement": "scope-outgrown",
"locations": [
"US",
"IN",
"EU"
],
"subprocessors": [
"A cloud host (US)",
"An email delivery provider (US)",
"A translation provider (IN)"
],
"dataCategories": [
"Name",
"Email",
"Free-text customer messages"
],
"listCapturedOn": "2025-04-11"
}
],
"escalate": true,
"disclaimer": "A map built from the records supplied. Not legal advice, no compliance determination, no assessment of whether any transfer mechanism is valid, and no vendor has been contacted. The chain is reported to the depth your records allow and continues beyond it.",
"staleLists": [
"Two subprocessor lists were captured over 16 months ago and describe a chain that has almost certainly changed."
],
"noAgreement": [
"A transcription tool has been processing recorded customer calls for 14 months with no agreement on record. Adopted by a team, never procured."
],
"depthReached": "Two layers: your processors and their published subprocessors. Below that the chain continues and is not visible from any record you hold.",
"scopeOutgrown": [
"The ticketing agreement was signed for support correspondence only. The platform is now also used for onboarding forms, which collect data the agreement does not mention."
],
"escalationReason": "Recorded customer calls are processed by a vendor with no agreement on record, and personal data reaches a location the ticketing agreement does not contemplate.",
"registerMismatches": {
"happeningNotInRegister": [
"Call transcription. Not mentioned anywhere in the register."
],
"inRegisterNotHappening": [
"A marketing automation activity that was discontinued in 2024 is still listed."
]
},
"questionsForVendors": [
"Confirm the current subprocessor list as at today's date, and confirm the notification mechanism for changes.",
"Confirm whether the translation provider processes ticket content, and under which transfer mechanism."
],
"unexpectedLocations": [
"A translation subprocessor in India appears in the ticketing chain. The agreement contemplates the US and EU only."
],
"canChangeWithoutNotice": [
"Three vendors may add subprocessors by publishing the change rather than notifying you. That is a standing gap, not a one-off finding."
]
}Requirements
Integrations
No integrations required.
Before you start
- Your processors and what each is used for
- Data processing agreements, in a knowledge base
- Vendor subprocessor lists, with the date you captured them
- Your record of processing activities
- Requires the All-Access plan or higher
Use cases
Annual register review
What is actually processing data, against what the register says.
Enterprise diligence
The chain, ready before a buyer asks for it.
Before adopting a vendor
What their own chain adds to yours.
After an incident at a vendor
Which of your data was in reach, through which link.
Pricing
All-Access
Billed monthly through your PROMIVO subscription. Cancel at any time.
Runs consume your plan allowance for agent executions and tokens. See plan limits
FAQ
Is this legal advice?
No, and it gives none. It reports what your documents say and what is missing. Whether a gap is a breach of a specific regime is a question for your own counsel.
Does it check vendor websites for changes?
It works from what you supply. Vendor subprocessor pages change without notice, so it reports the date of the list you gave it and flags anything older than the review window you set.
Does it contact vendors?
No. It produces the questions to send; sending them is yours.
Reviews
Reviews open once customers have run this agent.
Need this agent to work differently?
Tell us what to change and our team will scope a customised version for your business.
Customize this agent