Integrations, scanning and vendor risk

Article 28 of the GDPR requires a written contract with every processor and holds you accountable for their compliance. Article 32 requires you to be able to demonstrate the effectiveness of your security measures, not just assert it, which is what automated scanning evidence is for. And for regulated financial entities, DORA Article 28 requires a full register of ICT third-party arrangements.

Vendor risk failures are a recurring theme in real incidents: a breach at a processor is still your breach to notify, and a critical dependency with no exit strategy is exactly the kind of concentration risk DORA was written to catch.

Identity and evidence are the two halves of the same accountability problem. If your identity provider deactivates a leaver but nothing downstream notices, that stale access is a finding waiting to happen; if your CI pipeline produces test results that never reach your evidence vault, that evidence might as well not exist.

Scan connectors cover a wide range of real infrastructure: git repositories, SQL and NoSQL databases, S3-compatible storage, cloud provider accounts (AWS, GCP, Azure), source-code and container registries, Google Workspace and Microsoft 365, and even MDM platforms for endpoint compliance. Each connector type has its own real configuration fields, an API key or service account credential, and can be scanned on demand or on a recurring schedule.

Webhook integrations are separate from scan connectors: they push notifications, not data, to an external tool like Slack when specific events happen (an incident is created, a breach notification deadline is close, a compliance deadline is coming up).

The provisioning and ingestion tab adds two standards-based inbound gateways. SCIM 2.0 lets Okta, Microsoft Entra ID, Google Workspace or JumpCloud sync your employee roster and offboarding state automatically, locking deactivated users out of every login and session immediately. The evidence ingestion API (POST /api/v1/evidence-ingest) lets any CI/CD script or security tool push structured results into the Evidence Vault (status "passed") or the findings log (status "failed" or "info"), returning a receipt hash you can archive as proof.

The vendor and processor register is where every third party that touches your data gets recorded: what they do, what data they process, where it's transferred, and whether a Data Processing Agreement is signed. Financial entities tracking DORA criticality should note it in the record's description for now; dedicated critical-provider fields aren't yet exposed in the UI.