> Document Version: 1.0 Document Owner: Acme Inc Next Review Date: 2027-03-19

Last updated: 2026-03-19

Project: nextjs-saas-example

Organization: Acme Inc

Compliance contact: legal@acme.com

DPO: Jane Mueller (dpo@acme-saas.com)

## Overview

This document tracks the compliance status of all 7 third-party vendors detected in the nextjs-saas-example codebase. It provides a centralized view of DPA status, review schedules, risk tiers, and vendor contacts for ongoing vendor compliance management.

### Vendor Distribution by Risk Tier

Risk Tier | Count | Review Frequency
--- | --- | ---
Critical | 2 | Quarterly (every 3 months)
High | 2 | Semi-annually (every 6 months)
Medium | 1 | Annually (every 12 months)
Low | 2 | Biannually (every 24 months)

## Vendor Compliance Status

Vendor | DPA Signed | Last Review | Next Review | Risk Tier | Contact
--- | --- | --- | --- | --- | ---
Stripe | [ ] Pending | [Not yet reviewed] | 2026-06-19 | Critical | privacy@stripe.com
stripe-ios | [ ] Pending | [Not yet reviewed] | 2026-06-19 | Critical | [Contact vendor]
Supabase | [ ] Pending | [Not yet reviewed] | 2026-09-19 | High | privacy@supabase.io
OpenAI | [ ] Pending | [Not yet reviewed] | 2026-09-19 | High | privacy@openai.com
Resend | [ ] Pending | [Not yet reviewed] | 2027-03-19 | Medium | privacy@resend.com
Sentry | [ ] Pending | [Not yet reviewed] | 2028-03-19 | Low | dpa@sentry.io
PostHog | [ ] Pending | [Not yet reviewed] | 2028-03-19 | Low | privacy@posthog.com

## DPA Status Details

### Critical Risk Vendors

#### Stripe

Field | Status
--- | ---
Category | payment
Risk Tier | Critical
DPA Signed | [ ] Pending
DPA Location | DPA Link
Last Review | [Not yet reviewed]
Next Review | 2026-06-19
Privacy Contact | privacy@stripe.com

Action items:

- Obtain and sign DPA
- Conduct initial compliance review
- Verify data processing purposes align with DPA terms
- Confirm sub-processor notifications are enabled
- Document data flows to/from this vendor

#### stripe-ios

Field | Status
--- | ---
Category | payment
Risk Tier | Critical
DPA Signed | [ ] Pending
DPA Location | [Request from vendor]
Last Review | [Not yet reviewed]
Next Review | 2026-06-19
Privacy Contact | [Contact vendor]

Action items:

- Obtain and sign DPA
- Conduct initial compliance review
- Verify data processing purposes align with DPA terms
- Confirm sub-processor notifications are enabled
- Document data flows to/from this vendor

### High Risk Vendors

#### Supabase

Field | Status
--- | ---
Category | auth
Risk Tier | High
DPA Signed | [ ] Pending
DPA Location | DPA Link
Last Review | [Not yet reviewed]
Next Review | 2026-09-19
Privacy Contact | privacy@supabase.io

Action items:

- Obtain and sign DPA
- Conduct initial compliance review
- Verify data processing purposes align with DPA terms
- Confirm sub-processor notifications are enabled
- Document data flows to/from this vendor

#### OpenAI

Field | Status
--- | ---
Category | ai
Risk Tier | High
DPA Signed | [ ] Pending
DPA Location | DPA Link
Last Review | [Not yet reviewed]
Next Review | 2026-09-19
Privacy Contact | privacy@openai.com

Action items:

- Obtain and sign DPA
- Conduct initial compliance review
- Verify data processing purposes align with DPA terms
- Confirm sub-processor notifications are enabled
- Document data flows to/from this vendor

### Medium Risk Vendors

#### Resend

Field | Status
--- | ---
Category | email
Risk Tier | Medium
DPA Signed | [ ] Pending
DPA Location | DPA Link
Last Review | [Not yet reviewed]
Next Review | 2027-03-19
Privacy Contact | privacy@resend.com

Action items:

- Obtain and sign DPA
- Conduct initial compliance review
- Verify data processing purposes align with DPA terms
- Confirm sub-processor notifications are enabled
- Document data flows to/from this vendor

### Low Risk Vendors

#### Sentry

Field | Status
--- | ---
Category | monitoring
Risk Tier | Low
DPA Signed | [ ] Pending
DPA Location | DPA Link
Last Review | [Not yet reviewed]
Next Review | 2028-03-19
Privacy Contact | dpa@sentry.io

Action items:

- Obtain and sign DPA
- Conduct initial compliance review
- Verify data processing purposes align with DPA terms
- Confirm sub-processor notifications are enabled
- Document data flows to/from this vendor

#### PostHog

Field | Status
--- | ---
Category | analytics
Risk Tier | Low
DPA Signed | [ ] Pending
DPA Location | DPA Link
Last Review | [Not yet reviewed]
Next Review | 2028-03-19
Privacy Contact | privacy@posthog.com

Action items:

- Obtain and sign DPA
- Conduct initial compliance review
- Verify data processing purposes align with DPA terms
- Confirm sub-processor notifications are enabled
- Document data flows to/from this vendor

## Upcoming Review Calendar

Month | Vendors Due for Review
--- | ---
2026-06 | Stripe, stripe-ios
2026-09 | Supabase, OpenAI
2027-03 | Resend
2028-03 | Sentry, PostHog

## Vendor Compliance Review Checklist

Use this checklist during each scheduled vendor review:

### Pre-Review

- Retrieve current DPA and verify it is signed and dated
- Check vendor's latest security certifications (SOC 2, ISO 27001)
- Review vendor's recent security incident disclosures
- Pull vendor's current sub-processor list

### During Review

- Verify data processing activities match agreed purposes
- Confirm data retention periods are within policy limits
- Test DSAR fulfillment process (access, deletion, portability)
- Review vendor's privacy policy for material changes
- Assess vendor's incident notification procedures
- Verify encryption at rest and in transit

### Post-Review

- Update this tracker with review date and findings
- Document any compliance gaps or concerns
- Set follow-up actions with deadlines
- Schedule next review based on risk tier
- Notify stakeholders of any material changes

## Escalation Procedures

Situation | Action | Timeline
--- | --- | ---
DPA not signed within 30 days | Escalate to legal team | Immediate
Vendor breach notification | Activate incident response plan | Within 24 hours
Failed compliance review | Document gaps and remediation plan | Within 5 business days
Vendor sub-processor change | Review new sub-processor and update records | Within 14 days
DPA renewal due | Initiate renewal process | 60 days before expiry

## Maintaining This Document

- Review frequency: Monthly review of overall tracker; per-vendor reviews per risk tier schedule
- Ownership: Data Protection Officer / Privacy Team
- Update process: Re-run Codepliant to detect new vendors, then manually update DPA status and review dates
- Integration: This tracker should be maintained alongside the Vendor Contacts Directory and Vendor Risk Tier Assessment

This vendor compliance tracker was generated by Codepliant based on automated code analysis. DPA status and review dates should be manually updated as compliance activities are completed. This document does not constitute legal advice.