How this works

A record of which companies the software industry depends on. Every SaaS product runs on other companies’ products — hosting, payments, email, support, analytics — and VendorDb collects those relationships into one place so you can look at them from either end: everything a company uses, or everyone a vendor serves.

From the companies themselves. A company that processes personal data on a customer’s behalf has to tell that customer which third parties it passes the data to — its subprocessors — and keep that current. Most SaaS companies answer by publishing the list, usually on a legal page or a trust center.

Those pages are the entire source. Nothing here is inferred from job postings, DNS records, or technology-detection scripts. Every company page links to the document its rows came from, so you can check any of it.

Strictly, none requires them to be public. The obligation is GDPR Article 28(2): a processor may not engage another processor without the controller’s prior written authorisation. That authorisation can be general rather than case-by-case — and where it is, the processor must inform the controller of any intended addition or replacement, giving it the opportunity to object.

The duty runs to the customer, not to the world. But a company with ten thousand customers cannot send ten thousand notices, so its data processing agreement points at a page instead: here is the current list, subscribe to be told when it changes. One public webpage discharges a per-customer obligation. The EU standard contractual clauses take the same shape — Clause 9, general written authorisation, list plus notice period — and the UK GDPR mirrors Article 28.

So these pages are a side effect. They exist so a customer can exercise a right to object, and they happen to be readable by anyone. That is what this site reads.

Very nearly whatever the company discloses. If it lists a sales-intelligence tool or a consultancy alongside its cloud provider, both appear — the disclosure is the evidence, not our view of what belongs on it.

Three things are left out. A company’s own subsidiaries, which are not third parties. The tracking scripts named in cookie-consent widgets, which sit on the same pages but are not part of the disclosure. And staffing firms: this is a record of the software companies run on, and a contract-labour supplier is a different kind of relationship. Microsoft discloses 35 of them against 17 actual vendors, which would make its page mostly a list of consultancies.

That last exclusion reads the purpose the company published, never the vendor’s name — a row saying “contract staff” goes, one saying “cloud hosting” stays. The same firms are genuine software vendors on other companies’ lists, and dropping them by name would take those too.

Because we have not found a published list for it. That can mean the company does not publish one, that it is behind a login or an NDA, or that its page blocks automated readers. A zero says something about what is public, not about how many vendors the company uses — and not about whether it follows the law either, since notifying customers privately satisfies Article 28(2) just as well as a public page does.

Because one company bought another. When a vendor is acquired, its customers keep naming it by the old name for years, and counting those separately would split one company into two entries and understate both. The vendor page lists those absorbed brands once beneath the primary name. A company that merely changed its name reads Luciq (fka Instabug) instead — one company, one entry, a new name.

Pages are re-read on a rolling basis, and a company’s row changes when its published list changes. Disclosures move at the speed of legal pages, which is to say slowly — but an acquisition or a switched cloud provider can take months to show up in the source document itself, and we can only be as current as what the company prints.

Likely, in a dataset this size. The most useful thing you can send is the URL of the disclosure you are looking at — a page we read incorrectly and a page we never found are different problems, and the link tells them apart.