Dormouse.
Vendor monitoring your auditor will accept.
Dormouse watches your vendors' subprocessor lists, DPAs, and trust pages, tells you when something meaningful changes, and hands you a tamper-evident monthly report that answers the question with proof instead of a shrug.
Everyone has it. Almost nobody performs it.
SOC 2 CC9.2 and ISO 27001 A.15 expect you to monitor your vendors for changes. In practice that means someone opens forty subprocessor pages once a quarter, or nobody does. Meanwhile your payment processor adds a subprocessor, your data goes somewhere new, and your DPA obligations start ticking. Dormouse does the checking every twelve hours and keeps evidence you can hand over.
Register your vendors
Send us your vendor list. Their subprocessor pages, DPAs, trust centers, and terms go under watch. Fifteen major SaaS vendors are pre-tuned; anything with a URL can be added.
We watch, quietly
Checks every twelve hours with noise suppression, so a rotating banner never pages you. Meaningful changes are classified by severity with a one-sentence summary of who should care, delivered to email, text, or Slack.
Monthly proof
A signed coverage report: every check performed, every change caught, every source verified against a hash-chained audit trail. Drop it in the audit folder and answer the question in one attachment.
Tamper-evident, and you can check.
Every check dormouse runs is chained to the one before it, so history cannot be quietly rewritten, by us or anyone else. Snapshots are content-addressed, so what a page said on a given date is verifiable byte for byte. This is live output from the production watcher.
The same engine has watched FDA, EMA, EPA, and Federal Register feeds continuously as a public burn-in. Silence is a signal too: a watchdog raises the alarm when any source goes dark, because a gap in coverage is itself a finding.
Pre-tuned for the stack you already run.
Subprocessor and trust pages verified and noise-tuned for the vendors most B2B startups depend on. Your own vendors join the watch during onboarding.
Everything handled. Founding pricing while it lasts.
One fully managed service. The first ten teams lock in the founding rate for life. After that, it is the standard rate.
- Annual option: $1,990 a year, two months free
- Up to 40 vendor sources watched every 12 hours
- Severity-classified alerts by email, text, or Slack
- Monthly chain-verified coverage report
- Watchdog alerts when a source goes dark
- Onboarding done for you, nothing to install
- The same fully managed service, nothing to install
- The same tamper-evident monthly proof
- Founding pricing is gone once ten teams are in
Answer the question with proof.
Ten founding slots. When they are gone, the price goes to $499 and stays there.
Become a founding customer