Introducing VendorStacks: the subprocessor disclosure data API

Today we're launching VendorStacks: a data API over the world's public subprocessor and DPA disclosures. Give it a domain and it answers three questions — does this entity publish a disclosure, where does it live, and which vendors are on it — returned as a structured vendor stack across 13 categories, with the quoted disclosure row attached to every match. Ask in the other direction and it lists the entities that disclose a given vendor or category.

$ curl "https://vendorradar-production.up.railway.app
/v1/check?url=acme.com" \
    -H "Authorization: Bearer $VR_KEY"

{
  "domain": "acme.com",
  "found": true,
  "vendor_stack": {
    "sms_messaging": [{
      "vendor": "twilio",
      "evidence": {
        "source": "https://acme.com/legal/subprocessors",
        "quote": "Twilio Inc. — SMS delivery"
      }
    }]
  },
  "credits_used": 1
}

Deterministic on purpose

There is no LLM in the extraction path. The engine finds disclosure pages, parses them, and matches rows against a curated taxonomy of canonical vendors across 13 categories — SMS/messaging, email, payments, cloud infrastructure, analytics, CRM, support, auth, observability, productivity, AI/ML, privacy/compliance, and HR/payroll. String matching against a maintained vendor list is less glamorous than a model, but it has properties that matter for data you'll route revenue decisions through: the same page always produces the same output, every match carries the verbatim sentence it came from, and the system cannot hallucinate a vendor that isn't on the page. When extraction isn't sure, it says so — matches carry a confidence tier, and found: false means "no disclosure located", never "no vendors".

Flat pricing, index-accelerated

Scanning a company's legal pages is expensive; reading an already-scanned result is nearly free. Pricing follows that shape:

• Every lookup — 1 credit, flat. If the entity is already in the index you get the answer in under a second; the corpus already covers most entities you'll ask about.
• Unindexed? Same price. Domains we haven't seen live-scan automatically (15–90s) at the same 1 credit — and if a scan fails to locate a disclosure, it charges nothing.
• Reverse lookup — 1 credit per page of 10 entities. Segment the index by vendor or category.

Credit packs run $10 for 1,100 credits, $50 for 6,000, and $250 for 35,000 — under a tenth of a cent per lookup at the top end. Every new key starts with 25 free credits, no card required.

Built for agents as much as humans

Key issuance is a single POST — an agent can self-provision mid-task. The paywall is a machine-readable 402 with the exact price and a topup_url, so an agent that runs out of credits can hand a human one link instead of failing silently. The API serves its own OpenAPI spec, an llms.txt, and an installable SKILL.md that teaches an agent the endpoints and the cost-discipline rules in one fetch.

What's in the corpus

At launch the index covers 3,800+ entities with located, parsed disclosures — weighted toward B2B SaaS, where disclosure practice is strongest — and it grows two ways: our own crawl schedule, and every live scan a customer's lookup triggers, which lands in the shared index and makes the next person's lookup instant. Flat pricing, index-accelerated — that flywheel is the point.

Where to start

Get a key (25 free credits, instant), check a domain you know, and read the evidence quotes that come back. Then try the reverse lookup on your favorite vendor and see who else discloses it. The full API reference covers every endpoint; the use-case walkthroughs show complete GTM and agent workflows end to end.

The disclosures were already public. Now they're queryable.