# Third Party Index

> Mapping how the SaaS industry connects, one vendor at a time. A continuously monitored, versioned public record of SaaS vendors' security and privacy posture: subprocessor lists, data processing agreements, privacy policies, trust centers and certifications, security.txt, status-page incidents and public security feeds. It tracks 8,394 vendors and 42,984 subprocessor listings, keeps every version of every document as evidence, and records each change. Data is CC BY 4.0: reuse it, crediting "Third Party Index" with a link.

- Each vendor has a page at https://thirdpartyindex.com/vendors/{slug}; the same page as Markdown at https://thirdpartyindex.com/vendors/{slug}.md (or send Accept: text/markdown). Slugs are in the vendor list below.
- A vendor's subprocessors are as its own published list states them (purposes, locations, transfer mechanisms), each linked to the snapshot it was read from (https://thirdpartyindex.com/evidence/{id}).
- "Subprocessor of" shows which tracked vendors name a company in their lists: who relies on it.
- The transparency rating (0-100) measures how much a vendor publishes, not how secure it is.
- Status-page incidents are what vendors report themselves, not measured downtime. Security records come from CISA's Known Exploited Vulnerabilities catalog and Have I Been Pwned (CC BY 4.0).

## Data

- Each section of a vendor page as CSV, and its dated items as an Atom feed: https://thirdpartyindex.com/vendors/{slug}/{section}.csv and .atom, for subprocessors (CSV; feed: changes.atom), website, subprocessor-of, compliance, security, status, upstream (incidents, Have I Been Pwned breaches and Form 8-K Item 1.05 filings of vendors it names as subprocessors), federal and changes (CSV; feed: changes.atom), plus dora.csv, the subprocessor list as a draft of the EU DORA register of information (rank 1 the vendor, rank 2 each subprocessor it declares; identification codes are LEIs, from GLEIF (CC0), where one is curated for a tracked vendor; CSV only). A section the page doesn't show answers 404.
- [Example vendor page as Markdown](https://thirdpartyindex.com/vendors/stripe.md)
- [Our technology rules](https://thirdpartyindex.com/data/wappalyzer.json) in Wappalyzer's format: services the upstream ruleset misses, each citing the owner's document that names its domains. [Extensions](https://thirdpartyindex.com/data/wappalyzer-extensions.json): hosts we add to upstream technologies, to merge into their entries rather than replace them.

## API

- [API documentation](https://thirdpartyindex.com/api): read-only JSON, free key
- [OpenAPI description](https://thirdpartyindex.com/api/openapi.json)

## Pages

- [All vendors](https://thirdpartyindex.com/vendors): sortable by transparency, subprocessors and how many vendors use each
- [Recent changes](https://thirdpartyindex.com/changes): subprocessors added and removed across tracked vendors ([Atom feed](https://thirdpartyindex.com/changes.atom))
- [Incidents](https://thirdpartyindex.com/incidents): incidents vendors' status pages report now and lately
- [Federal contracts](https://thirdpartyindex.com/government): which U.S. government organizations fund or award contracts to tracked vendors, from USAspending
- [DORA register of information draft](https://thirdpartyindex.com/labs/dora): what dora.csv is, a sample, and its limits
- [PHP2Shell report](https://thirdpartyindex.com/reports/php2shell): what 73 tracked vendors reported on their status pages about the PHP2Shell flaws, 21 to 23 October 2026
- [AI providers](https://thirdpartyindex.com/ai): which AI model services tracked vendors list as subprocessors
- [Labs](https://thirdpartyindex.com/labs): pages being tried out (a domain's vendors and hosts; incidents at vendors and who lists them; your own list of vendors and the subprocessors they name in common)

## Optional

- [Sitemap](https://thirdpartyindex.com/sitemap.xml)