disclosedby
Dated quotes of GDPR art. 28 subprocessor lists: who lists whom, what changed, and when.
Hosted MCP Server
npx add-mcp 'https://disclosedby.com/api/mcp'Installs into Claude Code, Codex, Cursor and more
Documentation
Do your vendors lead to OpenAI, or to the US? And since when?
Paste your vendors and see whose subprocessor lists name it, directly or through a company they name. 480 lists, checked up to 2026-11-12.
Follow your vendors, $99 a month Try it free
Try it with your vendors
Check
Or see an example: Notion, Figma, Zendesk, HubSpot and Slack, looking for Anthropic.
What you paste is sent to disclosedby to answer and is not kept. What is sent where.
The first step is free. Following your vendors past it, and back to any date, is the paid plan. Follow your vendors, $99 a month
Or browse the 480 companies whose lists are checked here, and the subprocessors they name most.
Why keep every version
Under GDPR art. 28 a software company must publish who it hands its customers' data to, and tell them before that changes. That page is the only supply-chain statement a company signs its name to, and the company overwrites it. disclosedby keeps each version as read, with its date, so you can see what changed and cite what the page said on a day. Who is behind your vendor, the lists drawn as one graph with the fourth parties behind them · How it is read.