Does outside-in mapping match what vendors disclose?
A DORA concentration assessment is only as good as its mapping of who hosts what. We tested ours against the strongest public ground truth there is: what the vendors themselves publish about their hosting.
Hosting agreement (determinable)94%16/17 · 95% CI 73%–99%
Determinable from outside57%17/30 · 95% CI 39%–73%
CDN agreement89%8/9 · 95% CI 56%–98%
Old or partial statements5/8agreement, reported separately, not in the headline
01
Method
Rule map-v1, fixed before the comparison was run.
| Step | What we did |
|---|---|
| Vendor set | ICT vendors common in EU banks, payment and e-money institutions: core banking, payments, identity/KYC, collaboration, CRM, security and operations. |
| Ground truth | Only what the vendor itself publishes (sub-processor list, trust centre, DPA annex, own press release). No third-party tech-stack sites. Statements older than 2024 or covering only part of the service are marked and kept out of the headline. |
| Measurement | One ShadowGraph vendor scan of all domains on 1 Nov 2026. The scanner analyses the vendor's api. or app. host when one exists, otherwise the main domain. |
| Match | The detected hosting provider belongs to a provider family the vendor lists for hosting (AWS, Google, Microsoft, Oracle, OVHcloud …). Vendors listing several clouds match if we detect any of them. |
| Not determinable | The scan finds a CDN in front and no origin provider. Counted separately, never as a match. |
What this does not test: whether the vendor's statement is complete, which region holds your data, or the hosting of services we did not scan. A vendor list naming several clouds makes a match easier; the per-vendor table shows each case.
02
Every vendor
Listed in full, including the mismatches.
| Vendor | Host scanned | Detected hosting | Vendor states | Hosting | CDN | Source |
|---|---|---|---|---|---|---|
| Adyen | adyen.com | Amazon Web Services (medium) | AWS, Google, Microsoft, Oracle | match | — | 2026-07-01 |
| Atlassian Cloud | api.atlassian.com | Amazon Web Services (medium) | AWS; CDN Cloudflare | match | mismatch | 2025-05-30 |
| Cloudflare | api.cloudflare.com | behind Cloudflare | own data centres; CDN Cloudflare | not determinable | match | 2025-10-01 |
| ComplyAdvantage | api.complyadvantage.com | Amazon Web Services | AWS, Google, Microsoft | match | — | 2026-01-07 |
| Datadog | api.datadoghq.com | Amazon Web Services | AWS, Google, Microsoft | match | — | 2026-10-16 |
| Docusign | api.docusign.com | Microsoft Azure | Equinix, Microsoft | match | — | 2026-10-08 |
| Entrust IDV (Onfido) | api.onfido.com | Amazon Web Services (medium) | AWS | match | — | 2026-05-18 |
| Fourthline | api.fourthline.com | behind Cloudflare | AWS | not determinable | — | 2026-07-15 |
| Freshworks | app.freshworks.com | behind Cloudflare | AWS; CDN Cloudflare | not determinable | match | 2026-09-30 |
| GitHub | api.github.com | GitHub (own network) | AWS, Microsoft, Google, Oracle; CDN Cloudflare, Fastly | mismatch | — | 2026-11-01 |
| GoCardless | api.gocardless.com | behind Cloudflare | Google, AWS; CDN Cloudflare | not determinable | match | 2026-06-12 |
| Google Workspace | workspace.google.com | Google Cloud | match | — | 2026-10-19 | |
| HubSpot | api.hubspot.com | behind Cloudflare | AWS, Google; CDN Cloudflare | not determinable | match | 2026-09-16 |
| Intercom | app.intercom.com | Amazon Web Services (medium) | AWS | match | — | 2026-06-25 |
| Microsoft 365 | checkout.office.com | behind Akamai | Microsoft; CDN Akamai | not determinable | match | 2025-02-28 |
| Miro | api.miro.com | Amazon Web Services (medium) | AWS | match | — | 2026-07-08 |
| Okta | api.okta.com | Amazon Web Services | AWS | match | — | 2026-05-01 |
| Pleo | api.pleo.io | behind Cloudflare | AWS, Microsoft, Google | not determinable | — | 2025-05-29 |
| Salesforce | api.salesforce.com | Amazon Web Services | own data centres, AWS | match | — | 2025-12-19 |
| SAP Fioneer | sapfioneer.com | behind Cloudflare | SAP | not determinable | — | 2026-09-28 |
| Signicat | api.signicat.com | Google Cloud | Google, AWS | match | — | 2026-07-01 |
| Stripe | api.stripe.com | Amazon Web Services | AWS, Microsoft | match | — | 2026-09-27 |
| Sumsub | api.sumsub.com | behind Cloudflare | AWS, Google; CDN Cloudflare | not determinable | match | 2026-09-02 |
| Taktile | app.taktile.com | Amazon Web Services (medium) | AWS | match | — | 2026-02-27 |
| Twilio | api.twilio.com | Amazon Web Services (medium) | AWS | match | — | 2026-09-01 |
| Veriff | veriff.com | behind Fastly | AWS, Google | not determinable | — | 2026-11-01 |
| Worldline | worldline.com | behind Fastly | own data centres | not determinable | — | 2026-11-01 |
| Yousign | api.yousign.com | OVHcloud | AWS, Microsoft, OVHcloud | match | — | 2026-07-02 |
| Zendesk | api.zendesk.com | behind Cloudflare | AWS; CDN Cloudflare | not determinable | match | 2026-09-02 |
| Zoom | api.zoom.us | behind Cloudflare | own data centres, AWS, Google, Microsoft, Oracle; CDN Cloudflare | not determinable | match | 2026-10-02 |
| Checkout.com partial: privacy policy, biometric data only | api.checkout.com | Amazon Web Services | AWS | match | — | 2026-06-19 |
| Finastra old: 2018 press release | finastra.com | behind Akamai | Microsoft | not determinable | — | 2018-03-07 |
| IDnow partial: privacy policy may cover the website, not the ident platform | idnow.io | Amazon Web Services (medium) | AWS; CDN AWS | match | match | 2026-07-07 |
| Mambu old: 2022 press release | api.mambu.com | Amazon Web Services (medium) | AWS, Google, Microsoft | match | — | 2022-10-24 |
| Mollie partial: list covers three ancillary services only | api.mollie.com | Google Cloud | match | — | 2026-10-12 | |
| ServiceNow old: 2020 blog post | api.servicenow.com | F5 Networks (medium) | own data centres | mismatch | — | 2020-04-06 |
| Slack old: archived 2023 list | api.slack.com | Amazon Web Services | AWS; CDN AWS | match | — | 2023-04-07 |
| Temenos old: 2021 press release | api.temenos.com | Google Cloud | Microsoft | mismatch | — | 2021-12-15 |
| Unzer partial: annex covers POS Go only | api.unzer.com | Amazon Web Services | mismatch | — | 2025-01-01 |
03
What follows for a DORA assessment
| Finding | Consequence in our reports |
|---|---|
| A detected provider is usually right. | Reported as a technical indicator with its confidence, and as confirmed when the vendor's own statement agrees (with the source). |
| Behind a CDN the origin is often invisible. | Reported as not determinable from outside; the report asks you to obtain the hosting provider from the vendor (contract, sub-processor list). |
| Vendor statements can be old or partial. | Old statements never confirm a finding; partial ones confirm only with a note. |
Validation pilot: to measure the same agreement against a real Register of Information, we offer three institutions the Audit file at half price. Details.