Third Party Index

Your vendors' subcontracting chains, shaped for the DORA register

For every vendor with a published subprocessor list, we publish the chain it declares as a CSV: the vendor, then each subprocessor it names, in the column order of EBA template B_05.02. Each row cites the document it came from.

Become a design partnerPreparing your 2027 register? Tell us which vendors you need.

Sample: Datadog

8 of 29 rows · 6 of 19 columns Vendor page · Full CSV
RankB_05.02.0050ProviderB_05.01.0050Passed down byCountry declaredLast verifiedEvidence
1Datadog 549300F6JNO0KRPO1K63Stored copy
2Anthropic, PBC 984500B6DEB8CEBC4Z70DatadogUnited StatesStored copy
2DDog Singapore PTE. LTD. DatadogSingaporeStored copy
2Google LLC DatadogGermany; United StatesStored copy
2Hyperdoc Inc. DatadogUnited StatesStored copy
2Mailgun Technologies, Inc. 254900Y0R9EV77A5AI55DatadogUnited StatesStored copy
2Microsoft Corporation (Azure) INR2EJN1ERAN0W5ZP974DatadogUnited StatesStored copy
2OpenAI, LLC DatadogUnited StatesStored copy

Every row is declared by Datadog's own published subprocessor list. Rank 1 is Datadog; rank 2 is each subprocessor on its list. The CSV has 19 columns; the rest hold the contract fields you fill in.

What this is not

  • Declared, not contracted. Each row is what the vendor's public list says. It is not a contract and does not say which services pass down the chain.
  • LEIs: filled for vendors we've verified. Identification codes (B_05.01, B_05.02) hold a curated LEI where we've verified one, and are blank otherwise.
  • Yours to fill in. Service type, contract reference and criticality: we can't know them.
  • Two ranks. Ranks 1 and 2 only. A subprocessor's own list is on its vendor page when we track it. Country is where the list says the entry operates, not its headquarters.

A draft to start from. Check each row against the vendor's list before it goes in a register.

Using this for your 2027 register?Become a design partner

API and data downloads