All third-party services have Data Processing Agreements; subprocessors documented

GDPR Art. 28 requires a written contract with every processor that handles personal data on your behalf — without a signed DPA, you are legally exposed for your processor's data handling practices. Art. 28(3) specifies the mandatory terms: purpose limitation, security obligations, subprocessor restrictions, and data subject rights. ISO-27001:2022 A.5.19 and A.5.20 require supplier security agreements and monitoring of supplier compliance. Most SaaS controllers are unaware that accepting Stripe, Postmark, or Sentry's standard terms does not automatically constitute a signed DPA — a separate DPA acceptance step is required for most vendors. An audit of your actual processor list against your signed DPAs almost always reveals gaps.

Systematically sign or accept DPAs for every service that accesses personal data. Most major vendors provide a one-click DPA acceptance in their account settings.

DPA checklist — complete for each service before launch:
□ Stripe       — stripe.com/legal/dpa (accept via Dashboard > Settings > Legal)
□ SendGrid     — sendgrid.com/policies/dpa
□ Resend       — resend.com/legal/dpa
□ Postmark     — email support@postmarkapp.com to request DPA
□ Google (GA4) — myaccount.google.com > Data & Privacy > Accept data processing terms
□ Sentry       — sentry.io/legal/dpa
□ Vercel       — vercel.com/legal/dpa
□ Supabase     — supabase.com/privacy (standard GDPR terms; BAA available for HIPAA)
□ Clerk / Auth0 — check vendor legal page

Keep a DPA registry spreadsheet: service, data categories shared, DPA accepted date, SCCs included (Y/N), renewal date if applicable.