Catch a new subprocessor before your auditor does.

Every vendor you rely on can add a subprocessor, change a data-retention term, or edit their privacy policy on their own schedule, and almost none of them email you when they do. Security and ops teams usually find out during the next audit, or worse, during an incident review, when someone asks "since when does this vendor share data with a company we've never heard of."

modsignal watches the specific pages that carry this information: a subprocessor list, a DPA, a privacy policy. Describe what matters — tell me if any vendor adds a subprocessor outside the EU, alert me when a DPA's retention period changes — and we check the page on your schedule and compare it against what we saw last time.

The alert names the exact change, quotes the new language, and tells you when it appeared, so you can drop it straight into a vendor review or an audit trail without re-reading the whole document yourself. This is the case the semantic tier was built for: the wording of a legal page rarely stays byte-identical between checks, so an exact-diff would page you constantly over formatting. modsignal understands that a subprocessor list grew by one entry and tells you which one.

Every alert keeps a timestamp and the excerpt it was generated from, so a vendor-monitoring setup doubles as a running log you can hand to an auditor directly, rather than one you have to reconstruct from memory during review season.