heygrc
Real catch

Does that new SDK send personal data to a new processor?

heyGRC spots the pull request that starts sending data somewhere new, and asks where the contract and the record are.

Install on GitHubby ISMS Copilot

The situation

A new analytics SDK, a new model API, a new log shipper. One import and one key. Under GDPR, that can be a new processor that needs a contract and a line in your records of processing.

The real finding

heygrcMedium

The release adds a new AI provider lane behind a flag. The chat path pre-recorded its processor change. This lane's processing record and processor change record, planned in the design, are not in the PR.

From heyGRC's review of one of our own pull requests. Trimmed, not invented.

See the demo review → A demo pull request that reproduces the pattern.

Why code review misses it

The record is not code. It lives in a register, a wiki or a compliance platform, and no code reviewer is asked to open it.

What heyGRC checks

  • Processor contracts and records of processing

    GDPR Art. 28GDPR Art. 30

  • Supplier relationships, and cloud services when the supplier is one

    ISO 27001 A.5.19ISO 27001 A.5.20ISO 27001 A.5.21ISO 27001 A.5.23

  • Vendor and business partner risk

    SOC 2 CC9.2
Install on GitHub← All use cases