Subprocessor register

The list of third parties that may touch a client’s data in the course of an engagement, with what each does and where it runs. Published as categories in advance and specified per-engagement at onboarding, so the buyer’s privacy review starts before the first call.