Keep one register of vendors

How to do it

For each vendor, record what it does, the data map IDs it touches and its region. Add the signed agreement date, transfer basis, security evidence and renewal date. The processor agreements rule explains why each one needs a contract. Map each vendor's SDK package names and API hostnames to its register entry, so a scan can find new ones.

Example

- id: helpdesk-us
  service: Customer support desk
  stores: [support-desk]
  country: us
  region: us-east
  dpa_signed: 2026-02-11
  transfer: { basis: dpf, fallback: scc-2021-914-module-2, checked: 2026-10-01 }
  evidence: { type: soc2-type2, period_end: 2026-06-30 }
  subprocessor: true
  packages: ["@helpdesk/sdk", "helpdesk-client"]
  hosts: [api.helpdesk.example.net]
  renews: 2027-02-11

import { readFileSync } from 'node:fs';
import { parse } from 'yaml';

const vendors = parse(readFileSync('compliance/vendors.yaml', 'utf8'));
const KNOWN_VENDOR_PACKAGES = JSON.parse(readFileSync('compliance/vendor-packages.json', 'utf8'));
const registered = new Set(vendors.filter(vendor => vendor.dpa_signed).flatMap(vendor => vendor.packages));
const { dependencies = {} } = JSON.parse(readFileSync('package.json', 'utf8'));
const unregistered = Object.keys(dependencies).filter(name => KNOWN_VENDOR_PACKAGES.includes(name) && !registered.has(name));
if (unregistered.length) { console.error(`Vendor packages without a signed agreement: ${unregistered.join(', ')}`); process.exit(1); }

import json, sys, tomllib, yaml

vendors = yaml.safe_load(open("compliance/vendors.yaml"))
known_vendor_packages = set(json.load(open("compliance/vendor-packages.json")))
registered = {pkg for v in vendors if v.get("dpa_signed") for pkg in v["packages"]}
deps = tomllib.load(open("pyproject.toml", "rb"))["project"]["dependencies"]
names = {dep.split("[")[0].split("=")[0].split(">")[0].split("<")[0].strip() for dep in deps}
unregistered = sorted(names & known_vendor_packages - registered)
sys.exit(f"Vendor packages without a signed agreement: {', '.join(unregistered)}" if unregistered else None)

How to check

A build script reads the dependency manifests and the outbound hostnames in configuration. It fails on any vendor package or host that has no register entry with a signed agreement date.