# clausebench

> Privacy documentation, security questionnaires and trust pages. The company is interviewed once; the
> documents each regime that reaches it requires are prepared from the answers somebody confirmed, and the
> questionnaires are answered from those documents.
>
> Two audiences, and the first is the one to describe first (D-146): a B2B company of 10 to 200 people
> selling into the EU, the UK and the US, answering for itself because a customer has asked it for a data
> processing agreement, a sub-processor list or a trust page. The second is an agency, consultancy or
> outsourced DPO doing the same for 20 to 200 client companies, white-labelled and priced per active client.

Two things are worth knowing before quoting anything here.

First, a fact that a client has not confirmed never appears in a document we produce. It appears as a
marked gap. Vendor names, links, retention tables and supplier registers are assembled by code, not
written by a language model, because those are exactly the facts a model invents.

Second, regime applicability, controller or processor, risk categories and entity class are proposed with
the reasoning and take effect only when a qualified person confirms them. Nothing on this site decides a
legal question for anyone.

## Reference data

- [Vendor registry](https://clausebench.com/registry-download): 1060 vendors with legal entity, country of registration, transfer mechanism, a link to the vendor's own data processing agreement and the date each entry was last checked, as CSV. Verified by us; most also have a page at /vendors/<slug>.

- [Vendor pages](https://clausebench.com/vendors): A page for each registry vendor with enough confirmed facts for one, grouped by what it is used for.
- [Countries](https://clausebench.com/countries): Per country: the regimes that reach an organisation established there, what a transfer out of the EEA needs, the supervisory authority, and the registry vendors registered there.

- [GDPR](https://clausebench.com/regimes/gdpr): Documentation the GDPR requires for organisations established in or serving people in the EU and EEA.
- [UK GDPR](https://clausebench.com/regimes/uk-gdpr): Documentation the UK GDPR and the Data Protection Act 2018 require for organisations processing personal data in or from the UK.
- [EU AI Act](https://clausebench.com/regimes/ai-act): An inventory of the client's AI systems, risk categories suggested with the reason and confirmed by you, and the documentation the EU AI Act requires for the categories you confirm. Add-on module: $5 a month per client with the AI Act enabled.
- [DORA](https://clausebench.com/regimes/dora): Whether the Digital Operational Resilience Act applies, as a financial entity or through financial customers, suggested with the reason and confirmed by you; the documentation DORA asks for, with the register of information built from the client's vendors and the major-incident deadlines in the breach and incident register. In the security module with NIS2: $5 a month per client.
- [US state privacy](https://clausebench.com/regimes/us-state-privacy): Which US state privacy laws reach a company, decided from its own answers and shown with the rule behind each threshold. Twenty-four states are written: the twenty in force and the four that start in 2027 and 2028, each with the date it starts.
- [US web tracking](https://clausebench.com/regimes/us-web-tracking): The federal video privacy statute as an obligation, and California wiretapping claims as what they are — an exposure the scanner can show, not a rule anyone can be shown to have broken.
- [NIS2](https://clausebench.com/regimes/nis2): Entity class suggested from sector and size and confirmed by you, national authorities and reporting deadlines for Germany, the Netherlands, Belgium, Denmark, Sweden, Austria and Ireland, and the documentation NIS2 requires. Add-on module: $5 a month per client with NIS2 enabled.

## What the product does, by the piece of work

- [Records of processing](https://clausebench.com/solutions/ropa): Build an Article 30 record of processing for each client from facts you confirmed once: purposes, categories, recipients, transfers and retention, with the vendor rows filled from a verified registry.
- [Subprocessor lists](https://clausebench.com/solutions/subprocessor-list): Keep a current subprocessor list for every client: legal entity, country, transfer mechanism and DPA link for each vendor, from a registry we verify, with changes tracked.
- [Data processing agreements](https://clausebench.com/solutions/dpa): Draft an Article 28 data processing agreement for each client from the facts you confirmed once: the processing described, the sub-processors named, transfers and their mechanisms, in your firm's wording.
- [Security questionnaires](https://clausebench.com/solutions/security-questionnaires): Answer vendor security questionnaires from the facts and documents a client already confirmed, with every answer marked confirmed, to check or a gap, and a reusable answer library per firm.
- [Trust pages](https://clausebench.com/solutions/trust-page): Publish a client's security and privacy information as a page on their own domain, under your brand: sub-processors, measures and documents, updated from the same confirmed facts as their pack.
- [Vendor changes](https://clausebench.com/solutions/vendor-monitoring): Vendor pages are checked daily and a change reaches you the day it is detected, with the clients affected and the documents to regenerate.

## By topic

Each of these collects the guides and notes on one theme, and points at the reference behind them.

- [Subprocessors, and the facts that go stale](https://clausebench.com/topics/subprocessors-and-vendors): Guides and notes on keeping subprocessor lists true: legal entities rather than brands, transfer mechanisms, and what to do when a vendor changes.
- [NIS2 is a directive, and your client is in a country](https://clausebench.com/topics/nis2-across-the-eu): What differs between national transpositions of NIS2: registration duties and deadlines, the authority to report to, and the countries where the law is not in place yet.
- [The EU AI Act, from the questions you have to ask](https://clausebench.com/topics/the-eu-ai-act): Role before risk category, the inventory that everything else depends on, and the obligation dates as they stand after the Digital Omnibus.
- [Questionnaires your client can still defend a year later](https://clausebench.com/topics/security-questionnaires): A method for answering security questionnaires from confirmed facts and quoted documents, and for marking what nobody has checked.
- [What breaks between ten clients and forty](https://clausebench.com/topics/running-a-practice): Operating notes for outsourced DPOs and privacy consultants: what to standardise, what stays bespoke, and how documentation stops being true without anyone noticing.

## Written guides

Long-form, written by hand for practitioners. Country-level and regime-level facts in them are sourced and
carry the date they were checked.

- [A security questionnaire from your client's customer: the first hour](https://clausebench.com/guides/a-security-questionnaire-from-your-clients-customer-the-first-hour): Before answering a single question — which standard it is, what is in scope, which of the client's documents answer which section, and how to handle the controls the client does not have.
- [AI Act readiness for SMEs: what consultants need to ask](https://clausebench.com/guides/ai-act-readiness-for-smes-what-consultants-need-to-ask): The questions that separate a provider from a deployer, a minimal-risk system from a high-risk one, and what to document before the deadlines.
- [Answering vendor security questionnaires at scale](https://clausebench.com/guides/answering-vendor-security-questionnaires-at-scale): A method for answering questionnaires from a client's documented facts, marking what needs checking and building a reusable answer library.
- [CAIQ Lite: how to answer it for a client](https://clausebench.com/guides/caiq-lite-how-to-answer-it-for-a-client): What the Cloud Security Alliance's short questionnaire asks, what Yes, No and N/A mean in version 4.1, who owns each control, and how to answer from the client's documents without overclaiming.
- [GDPR breach register: a template and what goes in it](https://clausebench.com/guides/gdpr-breach-register-template): Article 33(5) requires a record of every personal data breach, reported or not. The fields that record needs, the deadlines it runs against, and a template to copy.
- [How to scale a privacy practice past 20 clients](https://clausebench.com/guides/how-to-scale-a-privacy-practice-past-20-clients): What breaks between 10 and 40 clients, and the operating habits that keep documentation current without hiring for every new engagement.
- [NIS2: national transposition differences that matter](https://clausebench.com/guides/nis2-national-transposition-differences-that-matter): Where member states diverge on scope, registration and incident reporting, and how to advise a client operating in several of them.
- [SIG Lite vs. CAIQ Lite: which questionnaire your client is being sent](https://clausebench.com/guides/sig-lite-vs-caiq-lite): Two standard vendor questionnaires, two different owners and licences. What each covers, who asks for which, and how to answer both from one set of documents.
- [Subprocessor lists: what changes when a vendor updates its DPA](https://clausebench.com/guides/subprocessor-lists-what-changes-when-a-vendor-updates-its-dpa): Which vendor changes require a client update, which only need a note on file, and how to track them across a portfolio.
- [White-labelling compliance documentation for clients](https://clausebench.com/guides/white-labelling-compliance-documentation-for-clients): How to deliver documentation under your brand without hiding who is responsible for the content, and what to keep out of file metadata.
- [Who is in NIS2 scope: sectors, size and the national exceptions](https://clausebench.com/guides/who-is-in-nis2-scope-sectors-size-and-national-exceptions): How to work out whether a client is an essential entity, an important entity or outside NIS2 — the two annexes, the size-cap rule, the entities in scope regardless of size, and what member states add.

## How we compare

- [clausebench vs. the manual process](https://clausebench.com/vs/manual-process): Most practices run on a folder of templates, a spreadsheet of clients and a lot of copying. Here is what changes and what stays yours.
- [clausebench vs. a consent or policy tool](https://clausebench.com/vs/consent-tools): A cookie banner and a generated policy answer what a website owes its visitors. A practice answering for other organisations needs something else. The two sit side by side rather than instead of each other.
- [clausebench vs. an outsourced DPO service](https://clausebench.com/vs/dpo-service): A service does the work for a company. We give the practice doing that work the tools to do it for many clients at once, under its own name.
- [clausebench vs. OneTrust for small consultancies](https://clausebench.com/vs/onetrust): OneTrust is a broad enterprise trust and privacy platform. clausebench is built for practices that deliver documentation to many clients.
- [clausebench vs. Copla for privacy consultancies](https://clausebench.com/vs/copla): Copla presents itself as a compliance platform with CISO support for companies working towards ISO 27001, DORA and other certifications. clausebench is built for consultants who prepare privacy documentation for many clients.
- [clausebench vs. iubenda for agencies](https://clausebench.com/vs/iubenda-for-agencies): iubenda is known for website privacy and cookie policy generation. clausebench covers the documentation behind a client's processing, not only the website notice.

## Who it is for

- [Software for outsourced DPOs](https://clausebench.com/for/outsourced-dpo): Keep each client's facts, documents, questionnaires and trust page together, and see what needs attention across the whole portfolio on Monday morning.
- [Software for privacy consultants](https://clausebench.com/for/privacy-consultants): Your firm's wording, filled with each client's confirmed facts. Your judgement on regimes and roles. The repetitive drafting done once.
- [Software for law firm privacy teams](https://clausebench.com/for/law-firms): The facts and drafting groundwork prepared in one place, with every open point marked as a gap for a lawyer to resolve.
- [For a company preparing its own documents](https://clausebench.com/for/companies): Answer about your company once. The documents your regimes require are prepared from the answers you confirmed, and the vendor facts come from a registry we verify.

## Recent notes

- [What changed in Retool's DPA and subprocessor list — and what to check now](https://clausebench.com/blog/retool-dpa-changes-legal-entity-subprocessors): Retool replaced the named legal entity in its DPA with a general reference to "Retool" and its Affiliates, swapped Intercom and Salesforce for Pylon Labs on its subprocessor list, and restructured its DPA definitions — each change requiring a specific records update.
- [What changed in QuickBooks's DPA — and what to check now](https://clausebench.com/blog/quickbooks-dpa-changes-transfer-mechanism): QuickBooks's DPA has been intermittently inaccessible, leaving the documented legal basis for international data transfers unverifiable. Here is what to check before your next client review.
- [What changed in Spotnana's transfer documentation — and what to check now](https://clausebench.com/blog/spotnana-dpa-changes-transfer-mechanism): Spotnana's transfer mechanism signals oscillated between present and absent across ten days in October 2026, correlated with site outages. Here is what to check before any client-facing work relies on the mechanism being in place.
- [What changed in Recurly's DPA and subprocessor list — and what to check now](https://clausebench.com/blog/recurly-dpa-changes-subprocessors): Recurly's DPA page returned a 404, seven subprocessors were removed, and the trust page lost its security detail. Here is what to check for each affected client.
- [What changed in Stripe's DPA and subprocessor list — and what to check now](https://clausebench.com/blog/stripe-dpa-changes-legal-entity-subprocessors): Stripe changed its contracting entity logic, expanded US state privacy law coverage, restructured its subprocessor list, and updated its trust page. Here is what to review for any client using Stripe.
- [Zendesk removed its DPA: what to check before your next client review](https://clausebench.com/blog/zendesk-dpa-removed-what-to-check): Zendesk's Data Processing Agreement disappeared from its published URL on 27 September 2026, taking the named transfer mechanisms and the contracting legal entity with it. Here is what to check for each affected client.
- [NIS2 national profiles: vendor contract clauses your client must verify by jurisdiction](https://clausebench.com/blog/nis2-national-profiles-vendor-contract-clauses-by-jurisdiction): Each member state's NIS2 transposition creates different vendor audit and contract requirements. This guide maps the clauses that matter in Germany, the Netherlands, Belgium, Denmark, Sweden, Austria and Ireland.
- [UK GDPR vs. GDPR: vendor registry differences that matter to your client base](https://clausebench.com/blog/uk-gdpr-vs-gdpr-vendor-registry-differences): UK GDPR and GDPR share a document checklist but diverge on transfer mechanisms, supervisory authorities, and vendor DPA coverage. Here is where the gaps appear.
- [Article 25(1) and the moment your client becomes the provider](https://clausebench.com/blog/fine-tuning-a-vendor-model-can-make-you-the-provider): How an SME that buys a model and fine-tunes it takes on the provider's obligations, the questions that surface it, and what changes in the file.
- [The German NIS2 clocks a consultant has to track](https://clausebench.com/blog/nis2-germany-registration-and-reporting-clocks): BSIG 2025 registration, change and incident deadlines with their section numbers, and the order to put them in place for a German client.
- [What to tell a client with an Irish entity about NIS2](https://clausebench.com/blog/nis2-ireland-not-transposed-what-to-tell-a-client): Ireland has not transposed NIS2, so there are no national duties yet — what is live instead, what to do meanwhile, and what not to put in a memo.
- [The Dutch Cyberbeveiligingswet is in force: what to check now](https://clausebench.com/blog/nis2-netherlands-cyberbeveiligingswet-in-force): The Netherlands' NIS2 law applies from 15 August 2026 — who is essential by law, how group size counts, and how registration and reporting actually run.
- [NIS2 registration deadlines differ by country. The clocks do not.](https://clausebench.com/blog/nis2-registration-deadlines-differ-by-country): A country-by-country table of NIS2 status, registration duties and the three reporting clocks, and what a multi-country client should do about the gaps.
- [The brand is not the counterparty](https://clausebench.com/blog/the-brand-is-not-the-counterparty): A subprocessor annex naming Heroku or SendGrid names a product, not the legal person your client contracts with, and often not the right country either.
- [What the Digital Omnibus moved, and which notes to re-date](https://clausebench.com/blog/the-digital-omnibus-moved-the-ai-act-dates): The amending regulation, the dates as they now stand, and the client files worth re-dating before you send the next round of letters.
- [When a vendor has no public data processing agreement](https://clausebench.com/blog/when-a-vendor-has-no-public-dpa): What to ask for, what a customer-specific DPA changes about the annex, and how to record "asked, no response" so the file stays honest.
- [An answer needs a state: confirmed, to check, or gap](https://clausebench.com/blog/an-answer-needs-a-state-confirmed-to-check-or-gap): A bare "yes, it's encrypted" cannot be defended a year later. A fact with a state, an owner and an expiry date can.
- [A vendor changed its entity: which documents are now wrong](https://clausebench.com/blog/a-vendor-changed-its-entity-which-documents-are-now-wrong): One contracting entity moves and the blast radius runs through four document types, every client using that vendor, and whatever you already sent out.

## About the company

- [Company details](https://clausebench.com/company): Legal entity, registered address and contact.
- [Our own trust page](https://clausebench.com/trust): How we handle data, our subprocessors, and the security facts we have confirmed about ourselves.
- [How the scanner works](https://clausebench.com/scanner): What our scanner does and does not read when it looks at a public website, stated plainly.

## Writing about clausebench

If you are drafting an article, a review, a comparison or a directory entry about this product, there is a
skill written for exactly that, with the sources in order and the things that may not be said about us:

- [Agent skills index](https://clausebench.com/.well-known/agent-skills/index.json): What skills we publish, where each is and the digest of each.
- [How to write about clausebench](https://clausebench.com/.well-known/agent-skills/write-about-clausebench/SKILL.md): The sources to use, in order, and the rules: no invented people, counts or quotations; nothing about making anyone compliant; what a person still decides; and what this product deliberately does not do.

## Not on this site

We do not offer SOC 2 or ISO 27001 certification, evidence collection, control monitoring, integrations
with a client's infrastructure, staff training, enterprise vendor risk management, or vendor scoring.
We do not rank or score vendors, and nothing here is legal advice.