次级处理者链稽核代理

概览

价值

功能说明

• 把你供应商下面那一层画出来

  你的处理者自己的处理者。那是一组他们可以不告诉你就改动的网页。

• 找出没有协议的数据处理

  通常是某个团队直接采用、而不是走采购的工具。最常见的缺口，也是最容易被证实的。

• 抓住已经长出协议之外的范围

  协议真实存在、也签了字，而它描述的那项服务此后已经扩张出去了。

• 标出意料之外的所在地

  个人数据经由一个你从未选择过的次级处理者，抵达了一个协议从未设想过的国家。

• 把登记册对照现实来检验

  大多数处理活动记录只被写过一次，此后一直在描述一家虚构的公司。

• 不提供任何法律意见

  它报告缺口。某个缺口是否构成违规，是一项关于具体法域的判断，留给律师。

这会改变什么

运行方式

该智能体通过 PROMIVO 运行时在服务器端运行。每次运行都会逐步记录，每次工具调用在执行前都会进行权限检查。

1. 1输入按智能体的输入结构进行校验
2. 2模型claude-opus-5，并自动回退
3. 3工具search_knowledge, extract_structured_data
4. 4权限自动执行 READ 级操作；更高的等待你批准
5. 5输出符合输出结构的结构化结果
6. 6日志记录 token、耗时和每一个步骤

演示

演示数据Illustrative sample output, abridged.

{
  "asAtDate": "2026-09-02",
  "processors": [],
  "reviewWindowMonths": 12
}

{
  "chain": [
    {
      "vendor": "Support ticketing platform",
      "usedFor": "Customer support correspondence",
      "agreement": "scope-outgrown",
      "locations": [
        "US",
        "IN",
        "EU"
      ],
      "subprocessors": [
        "A cloud host (US)",
        "An email delivery provider (US)",
        "A translation provider (IN)"
      ],
      "dataCategories": [
        "Name",
        "Email",
        "Free-text customer messages"
      ],
      "listCapturedOn": "2025-04-11"
    }
  ],
  "escalate": true,
  "disclaimer": "A map built from the records supplied. Not legal advice, no compliance determination, no assessment of whether any transfer mechanism is valid, and no vendor has been contacted. The chain is reported to the depth your records allow and continues beyond it.",
  "staleLists": [
    "Two subprocessor lists were captured over 16 months ago and describe a chain that has almost certainly changed."
  ],
  "noAgreement": [
    "A transcription tool has been processing recorded customer calls for 14 months with no agreement on record. Adopted by a team, never procured."
  ],
  "depthReached": "Two layers: your processors and their published subprocessors. Below that the chain continues and is not visible from any record you hold.",
  "scopeOutgrown": [
    "The ticketing agreement was signed for support correspondence only. The platform is now also used for onboarding forms, which collect data the agreement does not mention."
  ],
  "escalationReason": "Recorded customer calls are processed by a vendor with no agreement on record, and personal data reaches a location the ticketing agreement does not contemplate.",
  "registerMismatches": {
    "happeningNotInRegister": [
      "Call transcription. Not mentioned anywhere in the register."
    ],
    "inRegisterNotHappening": [
      "A marketing automation activity that was discontinued in 2024 is still listed."
    ]
  },
  "questionsForVendors": [
    "Confirm the current subprocessor list as at today's date, and confirm the notification mechanism for changes.",
    "Confirm whether the translation provider processes ticket content, and under which transfer mechanism."
  ],
  "unexpectedLocations": [
    "A translation subprocessor in India appears in the ticketing chain. The agreement contemplates the US and EU only."
  ],
  "canChangeWithoutNotice": [
    "Three vendors may add subprocessors by publishing the change rather than notifying you. That is a standing gap, not a one-off finding."
  ]
}

使用条件

使用场景

价格

常见问题

评价

客户运行过该智能体后，评价功能将开放。