To map which vendors hold your customers' data, trace each type of data from where it enters your business to every system and supplier it reaches, then record the vendor, the data, the purpose and the location. Start from data flows, not from the vendor list.
Why start from the data
A vendor list tells you who you pay. A data map tells you who can hurt your customers. They overlap but they are not the same. A tool can receive customer emails through an integration nobody put in the register, and a paid tool can hold nothing sensitive.
Four steps
- List your data types. For example: customer contact details, account credentials, payment data, support conversations, usage logs, source code, employee records.
- Trace entry points. Where does each type first arrive? A web form, an API, a support inbox, a sales call, an app.
- Follow each hop. For every system the data touches, ask what it forwards to. Check integrations, webhooks, exports, analytics scripts and backups.
- Record the supplier at each hop. Note what it receives, why, where it is stored and how long it stays.
A table to fill in
| Data type | Entry point | Vendor | Purpose | Location | Retention |
|---|---|---|---|---|---|
| Customer email | Signup form | Email sending service | Notifications | Per vendor terms | Per contract |
| Support messages | Help widget | Helpdesk platform | Support | Per vendor terms | Per policy |
| Error logs | Application | Logging service | Debugging | Per vendor terms | Short |
Use your own rows. The empty cells are the finding: anything you cannot fill in is a question for the vendor.
Places data hides
| Place | Why it is missed |
|---|---|
| Browser scripts and tags | Added by marketing, never reviewed by security |
| Mobile SDKs | Bundled into the app by developers |
| Backups and exports | Copies live in other tools |
| AI features | Prompts may include customer data and go to a model provider |
| Shared drives and spreadsheets | Staff paste data into whatever is handy |
For mobile and web, see third party SDK and subprocessor inventory for privacy.
Keep it current
Review the map when you add a product feature, sign a vendor or change an integration. Tie it to change management so a new data flow triggers a map update. Add the vendors you find to your register with a tier based on the data they hold, as in vendor risk register fields.
Quick check
Is a data map the same as a data flow diagram?
A data flow diagram is a way to draw it. The map described here is a table that also records purpose, location and retention for each supplier.
Who should build the map?
Engineering and the business owners together. Security can facilitate, but the people who built the integrations know where data goes.
Safeguard's asset discovery and compliance evidence automation can help you find systems and keep the records current, and a free scan is at gold.safeguard.sh/scan.
Last reviewed: 19 October 2026.
