Be honest about the alternative: for most compliance teams, the real competitor to a vendor monitoring tool isn't another tool — it's a spreadsheet. A tab per vendor, columns for the DPA link, the last-reviewed date, a few notes. It's free, it's flexible, and everyone already knows how to use one.
So this page isn't a hit piece on spreadsheets. It's an honest account of where the spreadsheet works, exactly where it stops working, and how to tell which side of that line you're on.
Where a spreadsheet genuinely works
- You track a handful of vendors. Under ten vendors, a person can plausibly re-check each one every quarter by hand.
- Your audit cadence is annual and light. If nobody asks for evidence between audits, a spreadsheet refreshed the week before fieldwork can pass.
- You want zero cost and total control. A spreadsheet has no subscription, no vendor lock-in, and infinite flexibility in what you record.
If that's you, keep the spreadsheet. Genuinely. Don't buy software to solve a problem you don't have yet.
Where the spreadsheet breaks
The spreadsheet doesn't fail loudly. It fails quietly, in month three, when the manual step behind it stops happening.
- It records decisions, not changes. A spreadsheet holds what you typed. It has no idea that your vendor added a subprocessor last Tuesday. Someone has to notice, and noticing is manual.
- "Last reviewed: March" is a liability, not an asset. When an auditor sees a stale date, it documents that your process lapsed — the opposite of what you wanted the column to prove.
- The work scales linearly with vendors. Thirty vendors × five documents each = 150 documents to re-check by hand every cycle. Nobody sustains that. The spreadsheet becomes a record of good intentions.
- No version history. When a vendor changes their DPA, the old text is gone from their site. Unless you saved a copy, you can't show what changed or when — which is exactly the evidence an auditor wants.
- Alerts don't exist. A material change — a new AI-training clause, a shortened breach-notification window — sits unnoticed until the next manual review, which might be months away.
Side by side
| Vendor spreadsheet | Thorgate | |
|---|---|---|
| Cost | Free | From $49/mo |
| Setup | Minutes | Minutes |
| Detects changes automatically | No | Yes — daily |
| Tells you what changed | No | Yes — AI-summarized diff |
| Severity classification | No | Yes — minor / moderate / major |
| Version history | Only if you save copies | Yes — every version, timestamped |
| Alerts on material change | No | Email, Slack, webhook |
| Audit evidence with timestamps | Manual | CSV / PDF export |
| Effort per quarter | Grows with every vendor | Roughly zero |
The honest tell
Here's the question that decides it: when did someone last actually re-read each vendor's DPA — not the reminder, the document itself?
If the answer is "last week, and we do it reliably," your spreadsheet is working and you should keep it. If the answer is "…I'd have to check," the spreadsheet has already quietly stopped doing its job, and no amount of new columns will fix that. The missing piece isn't structure — it's the continuous monitoring underneath it.
That's the specific gap Thorgate fills. It does the fetch-diff-classify work the spreadsheet always assumed a person would do, and leaves you with the decisions — which are the part that actually needs a human.
A good starting structure (spreadsheet or not)
If you're staying on a spreadsheet, at minimum track these per vendor — it's the same schema Thorgate uses, so migrating later is painless:
- Vendor name and primary URL
- Each tracked document (privacy policy, terms, DPA, subprocessor list, security page) with its direct URL
- Last-reviewed date and who reviewed it
- Current DPA version / date
- Subprocessor count and jurisdictions
- Notes: decisions made, follow-ups, risk acceptance
The moment maintaining those columns by hand becomes the thing you keep postponing is the moment the spreadsheet has outgrown itself.