Log inSubmit a tool
> templates

Paperwork, already half done

Pick a template and the tools on your shortlist. Everything we know from their trust cards is filled in; you only answer what’s left. Free.

> template
> tools
> for_msps

Hand it to clients as your own supplier review. Free for MSPs.

> trusthunt/ prepared 14 Oct 2026

DPIA starter: Nightfall

from trust card 2 answers · you answer 7 left

  1. What personal data does the tool process, and where?
    you answer
  2. Where does processing happen?
    from trust card · maker says United States: every sub-processor it lists is in the US.
  3. Who else receives the data (sub-processors)?
    from trust card · maker says AWS (cloud hosting, US), Google Cloud (cloud services, US), Snowflake (data warehouse, US), NetApp Instaclustr (Cassandra database hosting in AWS, US).
  4. How long is it kept?
    you answer
  5. The supplier’s role under UK GDPR
    you answer
  6. Why do you need this processing?
    you answer
  7. Who are the data subjects?
    you answer
  8. Main risks, and what reduces them
    you answer
  9. Residual risk after controls
    you answer

Answers marked “from trust card” come from TrustHunt; “✓ checked” means TrustHunt verified them. Trust cards change: check the live card before you rely on this copy.

Print or save as PDF Download for Word It stays linked to the live cards: watch the tools to hear when an answer changes.