Third-party vendors on startup sites: the October 2026 numbers

The October 2026 refresh brings the same vendor-inventory question back into focus: can a business explain which outside services its website loads and what those services receive? This is a re-measurement of the same population, but the supplied aggregate contains no earlier figures. It supports a current snapshot, not a claim that vendor documentation improved or deteriorated.

In the US B2B SaaS 5-50 population, with sample size N = 1128, 34.9% were flagged for undocumented third-party services (n=394). The mean number of third parties per reachable site was 5.4. Those findings point to a practical review task: reconcile the services visible on the website with the vendor records the business maintains.

What the October snapshot tells us

The aggregate was generated on 2026-10-21 for monthly refresh 20261021. Our methodology is passive, public-data-only and k-anonymised, with no company named. The sample covers the US B2B SaaS 5-50 population, N = 1128. Public website observations describe externally visible dependencies and documentation gaps; they do not reveal private contracts, internal inventories or everything a vendor does behind the scenes.

The undocumented flag is a reason to investigate a mismatch. It is not proof that a business has no vendor register, has broken a contractual obligation or has suffered a compromise. A public record may be incomplete while an internal record is current. The reverse also deserves attention: a polished public list can remain online after the website's actual dependencies have changed.

The mean of 5.4 third parties per reachable site describes website dependencies, not an average count of confirmed sub-processors. Whether a provider belongs on a contractual sub-processor list depends on its role and the data processing involved. Analytics, chat, tag managers and fonts are useful starting points for that review, rather than automatic answers to the legal classification.

The questionnaire arrives after the website changes

A website can accumulate dependencies through ordinary business decisions. Marketing adds analytics. A support team introduces chat. A designer selects a hosted font. A tag manager becomes the place where further services are added. Each decision may have an owner, while nobody owns the combined inventory.

That becomes a problem when a customer asks which providers receive information, why they receive it and how they are reviewed. A list assembled from invoices can miss free services. A list copied from a privacy notice can miss recent changes. A review of the application backend can miss services loaded by the public website.

Consider a hypothetical business whose website loads a chat widget and analytics through a tag manager. Its vendor register names the tag manager, but the reviewer still needs to identify the services it loads, inspect their configuration and establish what information they receive. Naming the container does not explain every dependency inside it.

For an established business handling privileged client information, the useful question is concrete: could a website interaction send information somewhere the business has not reviewed? Public observations can identify where to look. Answering that question requires configuration checks and input from the people responsible for the service.

What to actually do about it

• Build an inventory from the live website. Compare observed services with your vendor register, privacy disclosures and any applicable sub-processor list. Include dependencies introduced through tag managers and embedded tools. Record uncertainty instead of assuming an unfamiliar domain is harmless or malicious.
• Give each service a business owner. Ask who requested it, what purpose it serves and whether it is still needed. An owner should be able to explain its configuration and arrange a review when that configuration changes.
• Check data flows before assigning a label. Establish what the provider receives, where it appears and which contractual role applies. Pay particular attention to forms and pages where visitors could enter client information. Resolve classification questions with the appropriate privacy or legal reviewer.
• Make website changes update the record. Adding or removing a service should trigger an inventory update. Keep enough evidence for the next questionnaire reviewer to understand the decision without reconstructing it from browser requests.

The free public checker offers a starting point for reviewing externally visible posture. The separate External Security Posture Assessment provides a paid, passive, external-only review; it does not replace internal confirmation of vendor contracts and data flows.

Start with the services your website loads today. For each one, identify its owner, purpose and information access, then reconcile that finding with the record your next customer will ask to see.