What Dormouse actually does
The whole picture on one page: the job it performs, what it watches, how it thinks, what lands in your hands, and why the record can be trusted.
It performs a control almost nobody performs.
If you hold or are pursuing SOC 2 or ISO 27001, you own a vendor-management control (CC9.2, A.15) that says you monitor your vendors for changes. In practice that means someone is supposed to reread forty subprocessor pages, DPAs, and trust centers on a schedule. Almost nobody does, and once a year an auditor asks how you monitor your vendors, and the answer is a mumble.
Dormouse does the checking, every twelve hours, forever, and keeps evidence that the checking happened. It replaces the mumble with an attachment.
The pages where vendor risk shows up first.
- Subprocessor lists, where a new company quietly starts touching your customers' data and your DPA obligations start ticking.
- DPAs, trust centers, and terms, where certifications, residency commitments, and legal posture change.
- Regulator pages, for regulated verticals that need eyes on FDA, EMA, or EPA surfaces.
Fifteen major SaaS vendors come pre-tuned, and anything with a URL can be added. A page can be watched whole, or by named fields, down to a single table, so a rotating banner never wakes anyone.
Four verbs, in a loop, with judgment between them.
Fetch politely, miss nothing
Conditional requests, retries, per-host pacing. A failed check never becomes the baseline, so an outage cannot swallow a change. Volume 01
Decide what matters, deterministically
Ignore masks, minimum-change thresholds, anti-flap, cooldowns. Meaningful is a verdict from inspectable rules, never a model's mood. Volume 03
Interrupt rarely, record always
Meaningful changes alert by email, text, or Slack with a severity. Everything meaningful lands in the digest, the quiet morning record. Volume 05
Chain every check, invite the audit
Every check, including failures and silence, is hash-chained, keyed, and anchored. Anyone holding the record can verify it. Volume 04
An added subprocessor is reported by name: "Added: Stripe Inc. Removed: Amazon Web Services." Not "page changed," but what changed, judged against noise rules tuned per page.
Three artifacts, three tempos.
- The alert, within hours of a meaningful change, classified by severity, with a one-sentence summary of who should care.
- The digest, one summary of everything meaningful since the last one, built for a morning cron and a calm cup of coffee.
- The monthly report, one self-contained file: every check performed, every change caught, every source verified, integrity proof included. This is the one that goes in the audit folder, and the reason the auditor's question takes one attachment to answer. See a live sample.
Because you can attack it and watch it catch you.
Screenshots and spreadsheets can be edited after the fact, which is why they prove so little. Dormouse's record is different in kind: snapshots are stored under the fingerprint of their own bytes, every check is chained to the one before it with a secret key, and verification is anchored so history cannot even be quietly shortened.
The demonstrations, and the plain-language walkthrough for the person who has to trust the report, live at How the proof works.
Honest edges, stated plainly.
- Not a GRC platform. If you run Vanta or Drata, keep them. They track this control's paperwork; Dormouse performs the control and produces the evidence their locker is missing. The report drops straight in.
- Not a scanner or a security product for your own code. It watches the outside world you depend on, not your repositories.
- Not legal advice. It tells you a subprocessor changed and proves you knew; deciding to object is your call, made early instead of late.
- Not a promise of compliance. It proves the checking happened and the record is intact. No honest tool can claim more, which is exactly why auditors can accept what it does claim.