disclosedby, the subprocessor record

com.disclosedbyPublished by disclosedby.comOfficial publisherv2Updated Oct 24, 2026

Dated quotes of GDPR art. 28 subprocessor lists: who lists whom, fourth parties, what changed, when.

VerifiedStreamable HTTPWeb executableKnowledge & MemoryBusiness & Commerce

Overview

AI-generated overview

A remote MCP server that lets an assistant look up companies' published GDPR subprocessor lists, who names whom, and dated changes to those lists.

What you can do
Read one company's published subprocessor list as dated, quoted rows with purpose, location and source page, or see which companies name a given subprocessor and under what printed name. Trace dated changes to one company's list or across several companies at once, and see what a list said as of a given date. Resolve a name on a list to a company through a hand-checked identity table, and trace every path from the companies a reader buys from to one subprocessor, including fourth parties.
When to use it
Useful for privacy, compliance and procurement questions: checking a vendor's subprocessors, finding who relies on a given processor, seeing what changed between readings, or mapping subprocessor chains.
Requirements
Remote endpoint at disclosedby.com over streamable HTTP; no local install. The open tools need no key. The account tools (as_of, changes_across) need an Authorization header with a Bearer key and an account whose watch is running.
Before you install
The Authorization Bearer key is a secret for account tools only. Results are dated quotes of companies' own pages, not statements about when relationships began or ended. Some tools require a paid or active watch account.

Installation

In SourceWeft

  1. Open disclosedby, the subprocessor record in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/com.disclosedby%2Frecord/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config.

{
  "mcpServers": {
    "disclosedby-the-subprocessor-record": {
      "type": "http",
      "url": "https://disclosedby.com/api/mcp"
    }
  }
}

Tools

7

list

A company's subprocessor list

What one company's published subprocessor list says, as this record holds it: every row quoted as the company wrote it, with the purpose and location it printed, when the row was first and last seen here, the source page and the date it was read. Says so when no list for that company has been read. Free to read, cite and link. Every row is a dated quote of a company's own published page: cite the page and the read date. The compilation is protected: extraction or re-use of a substantial part is not permitted, and it may never be compiled into a lead list, a prospecting feed or a sales tool. A key is one reader's own use.

Parameterscompanyrequired

named_by

Who names a subprocessor

Which companies name one subprocessor on their published lists, with the name each company prints for it, when it was first seen on that list and when the list was read. One subprocessor per call. Free to read, cite and link. Every row is a dated quote of a company's own published page: cite the page and the read date. The compilation is protected: extraction or re-use of a substantial part is not permitted, and it may never be compiled into a lead list, a prospecting feed or a sales tool. A key is one reader's own use.

Parameterssubprocessorrequired

changes

What changed on a company's list

The dated changes to one company's list, each derived from two readings of that list and carrying both. A change is what the page said on one date against what it said on another; it is never a claim about when a company began or ended a relationship. `printed_differently` marks an entry the list printed in other words with the same companies in the same countries (a name, a location's wording, the list's date line). Free to read, cite and link. Every row is a dated quote of a company's own published page: cite the page and the read date. The compilation is protected: extraction or re-use of a substantial part is not permitted, and it may never be compiled into a lead list, a prospecting feed or a sales tool. A key is one reader's own use.

Parameterssincecompanyrequired

resolve

Resolve a name

What company a name on a list refers to, through this record's hand-checked identity table. Exact match only, never a guess: an unknown name comes back unresolved, which is an answer. Free to read, cite and link. Every row is a dated quote of a company's own published page: cite the page and the read date. The compilation is protected: extraction or re-use of a substantial part is not permitted, and it may never be compiled into a lead list, a prospecting feed or a sales tool. A key is one reader's own use.

Parametersnamerequired

as_of

What a list said on a date

What one company's list said on a given date, from the reading this record holds nearest before it, with that reading's own date, its web-archive capture where there is one, its source and its digest. Says so when the date is earlier than the first reading held. Needs a key on an account whose watch is running: this is part of the watch on disclosedby.com. Free to read, cite and link. Every row is a dated quote of a company's own published page: cite the page and the read date. The compilation is protected: extraction or re-use of a substantial part is not permitted, and it may never be compiled into a lead list, a prospecting feed or a sales tool. A key is one reader's own use.

Parametersdaterequiredcompanyrequired

in_chain

Is a company in your chain

Given the companies a reader buys from, every path from that list to one subprocessor: named directly, or named by a company whose own list names it (a fourth party, or sub-subprocessor). A second hop is a different relationship, quoted from a different page. Names that matched nothing, companies with no list read and rows that did not resolve come back beside the paths. It says who to ask, never who is harmed. Needs a key on an account whose watch is running: this is part of the watch on disclosedby.com. Free to read, cite and link. Every row is a dated quote of a company's own published page: cite the page and the read date. The compilation is protected: extraction or re-use of a substantial part is not permitted, and it may never be compiled into a lead list, a prospecting feed or a sales tool. A key is one reader's own use.

Parameterstargetrequiredcompaniesrequired

changes_across

Changes across a reader's own list

The dated changes to the lists of several companies at once, each carrying the two readings it came from. The same facts as `changes`, gathered for one reader's own list of companies. Needs a key on an account whose watch is running: this is part of the watch on disclosedby.com. Free to read, cite and link. Every row is a dated quote of a company's own published page: cite the page and the read date. The compilation is protected: extraction or re-use of a substantial part is not permitted, and it may never be compiled into a lead list, a prospecting feed or a sales tool. A key is one reader's own use.

Parameterssincecompaniesrequired

Version history

2
  1. v2LatestOct 8, 2026
  2. v1Sep 25, 2026

Score

83% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 daysRequired25 pts
  • Auth declaredRequired10 pts
  • Tools listedRequired15 pts
  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts

    Declare a GitHub repository with a README, or serve resource_documentation in the OAuth protected-resource metadata.

  • LicenseNot applicable

    A hosted service is used under its provider's terms, so no license is expected here. This check is left out of the percentage.