Subprocessor and DPA review
No supplier should appear by implication.
This repository does not select production hosting, email delivery, monitoring, analytics, billing, support, or identity vendors. The final register must match the deployed system.
Review draft — not an approved agreement
No subprocessor list, DPA, international transfer mechanism, hosting region, or change-notice process is approved.
CapabilityCurrent statusApproval evidence needed
Application and database hostingUnselectedEntity, region, security terms, DPA, backup location
Object and backup storageUnselectedDurability, deletion, encryption, region, restore evidence
Production identityUnselectedIssuer, tenant controls, MFA, recovery, DPA
Billing and taxNot connectedApproved provider account, terms, webhooks, money-flow tests
Monitoring and supportUnselectedData fields, retention, access, incident path
Microsoft or GoogleCustomer-authorized providerScopes, consent, tenant authority, applicable provider terms
Before approval
Confirm processor/controller roles, instruction boundaries, confidentiality, security measures, deletion/return, audit rights, incident notice, subprocessor objections, transfer safeguards, and which party owns each provider relationship.