Dormouse.
Vendor monitoring your auditor will accept.
Dormouse watches your vendors' subprocessor lists, DPAs, and trust pages, tells you when something meaningful changes, and hands you a tamper-evident monthly report that answers the question with proof instead of a shrug.
Everyone has it. Almost nobody performs it.
SOC 2 CC9.2 and ISO 27001 A.15 expect you to monitor your vendors for changes. In practice that means someone opens forty subprocessor pages once a quarter, or nobody does. Meanwhile your payment processor adds a subprocessor, your data goes somewhere new, and your DPA obligations start ticking. Dormouse does the checking every twelve hours and keeps evidence you can hand over.
Register your vendors
Send us your vendor list. Their subprocessor pages, DPAs, trust centers, and terms go under watch. Fifteen major SaaS vendors are pre-tuned; anything with a URL can be added.
We watch, quietly
Checks every twelve hours with noise suppression, so a rotating banner never pages you. Meaningful changes are classified by severity with a one-sentence summary of who should care, delivered to email, text, or Slack.
Monthly proof
A signed coverage report: every check performed, every change caught, every source verified against a hash-chained audit trail. Drop it in the audit folder and answer the question in one attachment.
Tamper-evident, and you can check.
Every check dormouse runs is chained to the one before it, so history cannot be quietly rewritten, by us or anyone else. Snapshots are content-addressed, so what a page said on a given date is verifiable byte for byte. This is live output from the production watcher.
The same engine has watched FDA, EMA, EPA, and Federal Register feeds continuously as a public burn-in. Silence is a signal too: a watchdog raises the alarm when any source goes dark, because a gap in coverage is itself a finding.
Pre-tuned for the stack you already run.
Subprocessor and trust pages verified and noise-tuned for the vendors most B2B startups depend on. Your own vendors join the watch during onboarding.
One price. Everything handled.
- Up to 40 vendor sources watched every 12 hours
- Severity-classified alerts by email, text, or Slack
- Monthly chain-verified coverage report
- Watchdog alerts when a source goes dark
- Onboarding done for you, nothing to install
- The full dormouse engine, source available
- Business Source License 1.1
- Your infrastructure, your database, your trail
Answer the question with proof.
Ten founding slots. When they are gone, the rate doubles and stays there.
Become a founding customer