You Can See the Product. You Cannot See Who Is Behind It.
Every supplier carries a second balance sheet: the other companies, the countries and the AI systems sitting behind the thing you actually bought.
You buy one product from one company. Behind it sit other companies you never signed anything with: the ones they hired, the AI providers, the countries the data travels to, the people who can open it, the rules about how long it is kept, and everything you agreed to without reading.
That is what decides what can happen to your data once it is in there.
BlackSnow draws that picture. Who sits behind your supplier, where the data can spread to, which borders it crosses, what can be worked out about your customers from it, and where the published record simply stops.
Processors
Who touches the data
Sub-Processors
Who sits behind them
AI Providers
Where inferences are made
Transfers
Where data crosses borders
Access Paths
Who can reach it, and why
Retention
How long it is kept
Contracts
What you agreed to
Obligations
What you must demonstrate
You Buy One Product. Your Data Can Enter an Entire Supply Chain.
On paper it is one supplier. In practice it is often a dozen companies, several countries and at least one AI provider.
Your data may pass through hosting companies, AI model providers, analytics tools, support desks, logging systems, security services and further companies behind those.
Different parts of that can happen in different countries. Buying the same product a different way can give a different answer. And AI can make something new out of what you sent — a profile, a guess, a score — that you never handed over.
And the documents that describe all of this are spread across privacy policies, data protection agreements, sub‑processor lists, trust centres, product pages, security documents and contract terms.
So the customer is left to piece the chain together alone.
Even the best-run technology companies rarely publish enough for a customer to work out who really handles the data — or to prove it to a buyer, an auditor or a regulator who asks.
Your Data Does Not Just Move. It Gets Turned Into Something Else.
Where it went is only half the question. The other half is what it became on the way, and who could reach it there:
- A customer record can become a profile.
- A usage trail can become a behavioural inference.
- An interaction can become a score.
- A data point can propagate into logs, support systems, analytics layers and AI workflows.
Your data moves, changes into something new, and then spreads. All three matter.
So we read three things together:
What Was Made From It
The record, the profile, the guess about a person, the output a model produced.
Where That Sat, And Who Opened It
The countries and systems it passed through on the way.
The Terms It Was Held Under
What the contract, the technical setup and the law each allowed at that point.
That is where the real exposure sits.
Questions, Answered.
The published record. Privacy policies, data processing agreements, sub-processor lists, AI disclosures, trust-centre material, terms of service and regulatory records — what a supplier has actually stated in public about how data is handled. Nothing comes from private access, and nothing is authored on a supplier's behalf. If a supplier has not published something, that absence is recorded as exactly that.
No. BlackSnow does not compress a supplier into a single number. Every examined field is placed in one of five bands — ▲ Adverse, ◐ Partial, ● Strong, ◆ Neutral or ○ Not Measured — and the counts are shown exactly as they fall. You see what was found, field by field, not a composite that hides the detail.
The share of measured fields that read Adverse. Fields that could not be measured are never counted against a supplier — Not Measured is a gap in the record, not a verdict.
Your suppliers — and the parties they name. Your business appears only as the start of the chain: the point the data leaves. Everything examined from there is the supplier's own published record and the sub-processors, AI providers and support arrangements it discloses.
Structured research built from published material: — companies assessed, — jurisdictional reviews and 16 method standards, each finding tied to its source. As At August 2026.
By correspondence while the platform is in its pilot phase. Request access and we will come back to you about Compare, Insight Cards and pilot participation.