Your AI supply chain, documented
The same model can reach you three different ways — direct, via a reseller, via a gateway — and each route is a different processor, a different DPA, a different residency. The AI Vendor Register makes every route explicit, so your DPO, your auditor and your customers get evidence instead of guesses.
Vendors, models and routes in one governed place
Residency computed across every via-chain
DPA and transfer gaps flagged automatically
From tribal knowledge to an evidence surface
Most organisations can name the AI tools they use. Far fewer can document who actually processes their data when a prompt leaves the building: the model maker, the reseller in between, the region the inference runs in, and whether a data-processing agreement covers each hop.
The AI Vendor Register is where that knowledge lives. Each vendor carries its GDPR role, hosting region and country, transfer mechanism and DPA status. Each model is registered as you actually buy it — 'DeepSeek V4 Flash via TensorX' is a different row than 'DeepSeek V4 direct', because it is a different supply chain.
Link register models to the governed agents that run on them, and the supply chain follows the agent everywhere: on the agent detail page, in the AI Estate, and as an 'AI vendor & data-flow posture' section in the board pack.
Gaps never hide. A vendor without a signed DPA, or a non-EU flow without a documented transfer mechanism, is flagged in the register, on the models it serves and on the agents that use them — so you close them on your schedule, not under review pressure.
Spreadsheet archaeology vs. a living register
Without the register
- The vendor list lives in a spreadsheet nobody trusts, last updated before the model routing changed
- 'Which DPA covers this model?' takes days of email archaeology per security review
- Reseller routes hide the real processor — residency answers are guesses
- Agents run on models nobody formally approved, and nobody can say which
With the register
- One governed register of vendors, models and routes — updated where the work happens
- DPA status, signature date and filing reference on every vendor row
- Weakest-link residency computed across each via-chain automatically
- Every governed agent linked to the models it runs on, end to end
What the register gives your governance team
Customer-owned supply chain
Not our sub-processor list — yours. Document the vendors that process your data on your terms, with your contracts.
The via-chain, explicit
Serving vendor and origin vendor are separate fields, so a model bought through an intermediary is documented as the distinct processing chain it is.
DPA lifecycle tracking
Not signed, requested, signed — with date and filing reference. A vendor-side 'DPA available' is never mistaken for a signature.
Residency and transfer posture
EU, EEA, UK, US, on-prem — per vendor and per model, with SCCs, adequacy or BCR documented where data leaves the EU.
Model approval status
Approved, restricted, banned or under review — the register is where 'which models may we use' becomes an answerable question.
One-click directory adoption
Adopt vendors straight from the curated tool directory with residency and DPA metadata prefilled — conservatively, as notes to verify, never as facts.
How the register comes together
Add your vendors
Manually or one-click from the tool directory: model providers, resellers, gateways — everyone who touches your data.
Register your models
Each model as you actually buy it, with its serving vendor, origin vendor and inference region.
Link your agents
Connect governed agents to the models they run on — the supply chain becomes part of the agent's governance record.
Close the flagged gaps
Missing DPAs and undocumented transfers are flagged everywhere they matter. Work the list down and the board pack reflects it.
“When our DPO asked where member data goes when the agents run, we answered from one screen — vendor, route, region, DPA — instead of opening a week-long investigation.”
Available from Pro
The AI Vendor Register is included in every paid plan.
Document your AI supply chain
Start free, run the readiness assessment, and bring your vendor register up as part of a well-governed AI adoption.