Subprocessor List Diff: What Changed
A vendor sends a notice with a new subprocessor list and no indication of what changed. Paste the old list and the new one and see what was added, removed, renamed or moved, and which new providers (AI, monitoring, workflow) to look at first. Then practise the decision in the subprocessor notice triage lab.
Runs in your browser; nothing is sent anywhere. Name only is enough. Add category and country after a | to catch changes in what a provider does and where.
Paste both lists, or load the example, to see what changed.
TL;DRWhat this tool is
5 points
- A free tool: paste a vendor's previous and current subprocessor lists, one provider per line, and see what changed.
- It shows added and removed providers, details that changed (category, country), near-identical names flagged as possible renames, new categories and countries, and a keyword hint for AI, monitoring, analytics and workflow providers to look at first.
- Everything runs in your browser. Nothing you paste is sent anywhere. Copy the result as Markdown into your vendor register.
- Name only is enough; add a category and country after a | for a richer comparison. The example is fictional.
- It compares what the lists say. It does not tell you whether a change is acceptable: that depends on your data, your contracts and the law that applies to you.
Frequently asked questions
How do I compare two subprocessor lists?
Copy the vendor's previous list and its current list, paste one provider per line into each box and read the result. The tool matches names while ignoring case, punctuation and legal suffixes such as Inc or Ltd, so the same company written two ways is not reported as a change.
Where do I get the old list?
Vendors often publish only the current list. Save a copy each time you review it, keep the dated copy in your vendor register, or ask the vendor for its change history. If you have no old list, paste the previous notice's list or an earlier export.
What counts as a possible rename?
A name that was removed and a name that was added which are very close (for example Paylink and Pay-Link Ltd). It may be one provider spelled differently, or two different ones, so the tool flags it for you to check rather than deciding.
What do the look-first hints mean?
A plain keyword match on the category and name (AI or machine learning, monitoring or observability, analytics, workflow, support and messaging, payments). It is a prompt to look at that provider, not a judgement about it.
Is my data sent anywhere?
No. The comparison runs in your browser and nothing you paste leaves your device.
Does this say whether I should object to a change?
No. It shows what changed. Whether to object depends on the data you send, your contract and the law that applies to you. The subprocessor notice triage lab practises that decision.
More security tools
The tools people use most on PlayCISO.
Catch injected instructions hiding in content your AI agent should only read.
Score your readiness against the first international standard for AI security threats.
Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.
Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.
Self-assess all six Functions, from Govern to Recover, and see your weakest one.
Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.