In this guide
- DORA is an EU regulation on digital operational resilience for financial entities. It has applied since 17 January 2025.
- It covers ICT risk management, incident reporting, testing and third-party risk. Hosting and analytics vendors count as ICT third parties.
- If you work with financial clients, prepare answers about your vendors: location, security, subcontractors, incidents and exit.
Most marketing teams have never heard of DORA, until a bank, an insurer or a fintech client sends a questionnaire. The Digital Operational Resilience Act (Regulation (EU) 2022/2554) sets rules for how financial entities manage the risks of the technology they use, including the technology provided by outside companies. A tracking vendor that hosts a server container, or an analytics product that processes customer events, can fall under that. This page explains the parts that matter to marketing and what to ask your vendors. It is general information, not legal advice.
What DORA covers
| Area | What it asks of a financial entity |
|---|---|
| ICT risk management | A framework to identify, protect against and recover from technology risks |
| Incident management and reporting | Classify, handle and, for major incidents, report them to authorities |
| Resilience testing | Regular testing of systems and, for some firms, advanced testing |
| ICT third-party risk | Know your suppliers, keep a register, include required clauses in contracts, plan for exit |
| Information sharing | Voluntary sharing of cyber threat information |
Orders from your store, back to the ad that earned them
Your store sends the order once. Open Tracked passes it on to each ad platform, cleaned and deduplicated.
Why a tracking vendor is in scope
DORA treats any outside provider of digital services as an ICT third-party service provider. A server-side tagging host receives events from the financial entity's website, which may include customer data. A first-party analytics tool stores it. A CRM may hold more. The financial entity must understand these dependencies, assess the risks and have contract terms and an exit plan for the important ones.
Questions a financial client may ask
Where is data processed and stored?
Regions, sub-processors, and whether data leaves the EU.
How is it secured?
Encryption in transit and at rest, access controls, logging, penetration testing.
How are incidents handled?
Detection, notification times and contacts.
What happens if you fail?
Redundancy, backups, recovery times.
How do we leave?
Data export, container export, notice periods.
Ask Ari instead of digging through reports
Ari reads your tracking and ad data and answers in plain words.
How a managed tagging host helps
A host that gives you standard containers, a clear data processing agreement and a published list of sub-processors makes these answers easier. Open Tracked's tagging server runs your standard Google Tag Manager container, so you can export it and move it. You choose what data to send, can hash or remove fields, and can set short retention for the Data Store. Logs are kept for 3 days on Pro and 10 days on Business, with export from Business+. Ask us about regions and contract terms if your client needs a specific answer.
A due-diligence checklist for tracking vendors
What marketers should do
- Ask your compliance team whether DORA applies to the client.
- Keep an inventory of tracking vendors and what data each receives.
- Minimise data: send only what each vendor needs.
- Keep an exit plan: a recent export of your containers and a note on how to restore.
3 things to remember
Scroll and the points stack up.
DORA is an EU regulation on digital operational resilience for financial entities. It has applied since 17 January 2025.
It covers ICT risk management, incident reporting, testing and third-party risk. Hosting and analytics vendors count as ICT third
If you work with financial clients, prepare answers about your vendors: location, security, subcontractors, incidents and exit.
Frequently asked questions
What is DORA?
The Digital Operational Resilience Act, an EU regulation on technology risk for financial entities, applying since 17 January 2025.
Does DORA apply to my tracking vendor?
It applies to the financial entity, which must manage the risks of ICT third parties. A hosting or analytics vendor can be one.
What should I ask a tracking vendor?
Where data is stored, how it is secured, how incidents are handled, how failure is handled and how to leave.
Does server-side tracking help?
It gives control over what data leaves, which supports minimisation. The vendor still needs to meet the contract and security expectations.
Is this legal advice?
No. Ask your compliance or legal team.
Do I need spreadsheets to read my results?
No. Once tracking is live, the Open Tracked analytics shows spend, revenue, ROAS and profit, and you can ask Ari, the built-in AI assistant, questions about your own numbers in plain words. Ari's allowance depends on your analytics plan.
Is Open Tracked different from Open Track or Open Space Track?
No. Open Tracked is the official name of our server-side tracking platform, and the website is opentracked.io. Many people search for it as Open Track, OpenTrack or Open Space Track. All of them lead to the same product: server-side Google Tag Manager hosting, first-party analytics and a CRM pipeline.
Fix your tracking at the source
Open Tracked hosts your server-side Tag Manager, keeps first-party cookies alive and shows what each ad is really worth.
The Open Tracked team
We build Open Tracked: server-side tracking hosting, analytics and the tools around them, for stores that spend on ads. Questions about this guide, or an idea for the next one?
Comments
Loading comments...
Guides · 6 min read
