Start free. Pay when the list gets long.
Checking your vendors' sub-processor pages by hand is somebody's recurring afternoon. This does it every day and leaves a record you can hand to an auditor.
Free
$0 / month, permanently
- ✓ Track 3 vendor sub-processor pages
- ✓ Checked daily, same monitoring as the paid plans
- ✓ Dated evidence for every change, right on your dashboard
- ✓ A public trust page your customers can subscribe to
- — No card, no expiry
New accounts get 14 days of Growth first, then settle here.
Starter
$29 / month
or $290/year — 2 months free
Everything in Free, plus:
- ✓ Track up to 10 vendor sub-processor pages
- ✓ Gemini 2.5 Flash tells a real sub-processor change from a footer or menu edit, so cosmetic noise never reaches your queue
- ✓ Approval queue with a side-by-side diff — nothing reaches your trust page without you
- ✓ A drafted Article 28(2) notice for each change, ready to send to your customers
- ✓ Email notification to your subscribers on every published change
No credit card required · Cancel anytime 14-day money-back guarantee
Growth
$89 / month
or $890/year — 2 months free
Everything in Starter, plus:
- ✓ Track up to 30 vendor sub-processor pages
- ✓ Cryptographic Audit Evidence Pack: a downloadable ZIP with a SHA-256 verification anchor, the raw HTML before and after, the diff and your decision trail — new records also carry an independent RFC 3161 timestamp
- ✓ Full CSV export of your whole change history — hashes, timestamps and who approved what
- ✓ Remove the "Powered by TrustPages" badge from your trust page
No credit card required · Cancel anytime · 14-day money-back guarantee
Billing is handled securely by Paddle, our merchant of record. Prices exclude any applicable taxes, which Paddle calculates at checkout.
Why teams pay for this
The objection window is short and it starts without you
Under GDPR Article 28(2), a processor working from a general authorisation has to tell you before it adds or replaces a sub-processor, and you get a window to object — typically 10 to 30 days in a commercial DPA. In practice that notice is a quiet update to a page on their site. If nobody is watching the page, the window closes on its own.
"When did that change?" is a question you have to answer with a date
A screenshot taken the week of the audit proves nothing about what the page said three months ago. Every change here is stored with its diff and its timestamp, from the day you started monitoring.
Your customers ask you the same question you ask your vendors
The trust page turns your answer into something you publish once instead of writing out in every security questionnaire — a public, dated history of your sub-processor changes that customers can subscribe to.
Audit-Ready Proof: the file itself, not a link to our dashboard
Every change can be downloaded as a self-contained ZIP — the vendor's raw HTML before and after, the diff, both content hashes, and your approval and customer-notice trail in one file. Hand it to an auditor or an enterprise customer's security review without asking them to trust that our site still shows the same thing next year.
Questions
Does this help with DORA?
Partly, and it's worth being precise about which part. DORA requires EU financial entities to keep a Register of Information covering their ICT providers and those providers' subcontractors, filed with the regulator each year. TrustPages keeps the subcontractor half of that current and dated. It is not a filing tool and it does not produce the register for you.
How does the AI tell material changes from cosmetic ones?
Every detected diff is classified as material or cosmetic. Cosmetic changes — typos, reformatting, a moved heading — publish automatically. Anything that could affect your customers, such as a new sub-processor or a new processing country, goes to your approval queue first. You always have the final say before it reaches your trust page.
What happens after the 14-day trial?
Nothing is charged, and the account does not stop working: it settles onto the free plan, where your 3 oldest pages keep being checked daily. Anything above that is switched off rather than deleted, so upgrading later turns it back on with its history intact.
What if I need to track more than 30 vendors?
30 covers the vendor list of most teams at this size. If you need more, email us and we'll sort out a limit increase on the Growth plan.
Can I cancel anytime?
Yes, from the billing page in your dashboard. You keep Growth until the end of the period you've already paid for, and then the account continues on the free plan rather than closing — your trust page stays online and your change history stays intact, so cancelling doesn't take down a public page your customers may have bookmarked. See our refund policy for the 14-day money-back guarantee on your first paid period.