RedHub AI
How the roll-up gate works
How the Vendor Data-Flow Register gate works
This tool grades every vendor, AI tool, and sub-processor that touches your data. It reads 6 vendor flows and rolls them into one verdict — the worst, never the average — then a gate that can only make it worse.
The 6 vendor flows
A personal-or-regulated-sensitivity flow with no DPA at all is UNVETTED regardless of what else is documented - and one UNVETTED flow at or above the personal-sensitivity floor holds the whole register at NOT DEFENSIBLE, whatever share of vendors are otherwise documented.
Why: Four of six vendor flows are fully documented and one - HubSpot - is only missing its sub-processor disclosure. But the OpenAI API flow is cross-border and regulated-sensitivity with no DPA in place at all, so it's UNVETTED. Register status is the worst flow, never the average, so it reads NOT DEFENSIBLE at 67% documented.
No single vendor flow is the crisis — the clustering is. The roll-up takes the worst, the gate escalates when trouble compounds, and it names the one thing to fix first. Grades the flow attributes you record against a required-controls checklist; it is not a legal assessment. Confirm data-processing obligations with your privacy or compliance counsel.