At least 30 vendors added Anthropic as a subprocessor since September

The change

A subprocessor is a company that one of your vendors uses to process your data. Most vendors publish the list, and most data processing agreements let them change it. Between September 1 and October 8, 2026, Venpo recorded AI companies being added to these lists week after week. Anthropic was added to the subprocessor pages of 31 vendors. OpenAI was added to at least 10. SpaceXAI, ElevenLabs, Google Gemini, and the coding tool Cursor appeared on others.

We counted a vendor only when the earlier version of its page did not name the provider and the new version does. Vendors that already listed the provider and only changed the wording are not counted, and neither are pages whose earlier version was too incomplete to compare. This article looks at what the new entries say: which provider, for what stated purpose, and from what date. Our guide on how to monitor AI subprocessors explains why these lists move faster than the rest of a vendor's documents.

What changed

• Anthropic on 31 pages. The vendors are airSlate, Appetize, Artlogic, Auditoria, Backblaze, BigID, BillingPlatform, Challenger, Cobrowse, Digital Matter, DocHub, Fluency, Forest Admin, Friday Pulse, Frontegg, Geckoboard, GeoComply, GitGuardian, Great Question, Harvest, Hivebrite, ID123, Juvare, Maxio, Mimic, Missive, Pantheon, PerfectQuote, Scoro, SurveyMonkey, and Zoho (on the list published for Site24x7).

• OpenAI on at least 10. They include Cloudbeds, Cobrowse, Appetize, Nango, InEvent, ID123, and Digital Matter.

• Box. Box's subprocessor list now includes "SpaceXAI LLC" for "Artificial Intelligence, machine learning" in the United States of America, with the note "Effective October 5, 2026."

• HubSpot. HubSpot's sub-processors page adds Baseten Labs as an "AI Service Provider" and Exa Labs and Bright Data for "Web Search Results," all for HubSpot AI and all marked "Effective October 16, 2026."

• Adobe. Adobe's sub-processor list adds Humain, with the location Saudi Arabia: "Humain's image generation models are available for users within Adobe Firefly."

• Mixpanel. Anthropic was already on Mixpanel's US list. The page now also has it on the "EU Subprocessor List" and the "India Subprocessor List," with the location USA.

• Cursor. Higher Logic lists "Anysphere, Inc (Cursor)" for "AI-assisted software development and engineering productivity." Arrows lists Cursor with "Read-only access to production logs and database for engineering support."

• ElevenLabs. The voice AI company was added by Popl, by Arrows for "Speech-to-text for voice input," and by Reevo for "Speech AI models."

The AI provider is often in the vendor's back office

The usual picture of an AI subprocessor is a model behind a product feature: you click a button, and your data goes to the model. Many of the new entries describe something else. The AI tool is used by the vendor's own staff, on data the vendor already holds about you.

• Cloudbeds added OpenAI to the subprocessor schedule of its data processing addendum for "Customer Support Operations." Anthropic was already listed for the same purpose.

• Backblaze added Anthropic to its table of processors for customer account data: "A service used by Backblaze for AI Modeling via Claude Enterprise."

• BillingPlatform's entry for Anthropic reads: "AI assistant used by BillingPlatform personnel for operational, support and analysis work (Claude Enterprise, including connected access to internal systems)."

• Forest Admin lists Anthropic for "AI services" under the heading "Internal Operations."

• Digital Matter lists both Anthropic and "Open AI - ChatGPT" as an "Internal research tool."

• Missive lists Anthropic for "Customer support."

• Higher Logic's Cursor entry, described above, covers software development and engineering work and applies to both of its platforms.

This matters for a practical reason. Turning off the AI features in a product does not affect entries like these, because the AI is not in the product. Support tickets, account records, and production logs can hold personal data, and they can now pass through one more company. Compare that with July, when Airtable added Anthropic as an AI model provider for its in-product AI.

Entries that start on a future date

Several vendors listed the AI provider before it starts processing data. Box's SpaceXAI entry is on a page dated September 4 and carries an effective date of October 5, which Box says may differ under a customer's own agreement. HubSpot's three entries are on a page dated September 16 and take effect on October 16. Yubico's list shows "Fin AI (Effective November 23, 2026)" for "Customer support." ID123's new section for AI-assisted support, with Anthropic and OpenAI, is marked "Effective: November 1, 2026." Zip lists SpaceXAI and Fireworks.ai under "Upcoming Subprocessors" without a date.

That gap is the notice period. It is the time a customer has to ask questions or object before the new provider is in use, and it only helps if someone sees the entry while the clock is running. At the time of publication, the HubSpot, Yubico, and ID123 entries had not yet taken effect. We saw the same pattern when Stripe added Microsoft Azure and Snowflake with a 30-day window to object.

Where the data goes

Mixpanel keeps three subprocessor lists, one each for customers who store data in the US, the EU, and India. Adding Anthropic to the EU and India lists means the lists for those regions now include a provider located in the USA for Mixpanel's AI features. The entry says the data "is not used by Anthropic to train its models, and is never stored by Anthropic," and that "Mixpanel AI features may be disabled based on customer selections." We covered an earlier change to Mixpanel's AI terms when Mixpanel removed its AI data opt-in.

Other entries say less about location. Adobe gives Saudi Arabia for Humain, and its page says that when a user selects a partner model, Adobe shares the prompt and the input files with that partner. SupportLogic added "Google Gemini" as a "Service Provider for AI" and left the country cell empty. Cobrowse lists Anthropic and OpenAI for "AI Services" and gives San Francisco, California in a column headed "Headquarter Location," which says where the company is based, not where the data is processed. Harvest's entry for Anthropic is two words, "AI processor," with no location.

Labels that say little

A subprocessor entry is supposed to tell you what the company does with your data. Popl's new entry describes ElevenLabs as a company that develops "natural-sounding speech synthesis software using deep learning," and gives the purpose as "Data analytics." Voice AI and data analytics are different activities, and a reader cannot tell from the page which one applies. Short labels such as "AI Services" and "AI processor" leave the same question open: which data, for which feature, and whether it can be switched off.

Pages whose date did not move

On five of the pages in this article, the date at the top did not change when the AI provider was added. Backblaze's page still says "Last updated: December 03, 2025." Missive's still says "This document was last updated on July 15, 2025." Mixpanel's still shows April 24, 2026, SupportLogic's still says "Reviewed/Updated July 28, 2026," and SurveyMonkey's still shows November 3, 2025, as it did when SurveyMonkey changed its AI providers. Other pages, such as Harvest's and Cobrowse's, have no date at all.

A person who checks the date to decide whether to read the page again would have skipped every one of these. The only reliable test is comparing the text, which is the case for automated over manual vendor monitoring.

What did not change

• Being listed as a subprocessor does not mean a provider trains on your data. Some entries say the opposite: ID123's says "Inputs are not used for model training" and "AI outputs are reviewed by ID123 staff before use," and its OpenAI entry adds "Configured for zero data retention."

• Publishing the entry is the transparent thing to do. Every vendor named here disclosed the provider on a public page.

• Lists also shrink and swap. Pylon removed Cerebras and added Typesafe AI for "AI Inference." Auditoria removed BaseTen Labs in the same edit that added Anthropic for "ML/AI models."

• The lists do not set the rules. Notice periods and rights to object are in each vendor's data processing agreement.

Why this matters

A vendor review usually records which companies can touch your data on the day you sign. These weeks show how fast that record goes out of date. The additions are small, a row at a time, and they come from well-known vendors and small ones alike. RingCentral added AI subprocessors almost every month earlier this year, and the same pattern now shows across dozens of vendors.

The count also shows where the growth is. A good part of it is not new AI features for customers. It is vendors adopting AI tools for their own support, engineering, and operations teams, and then listing the provider because those teams handle customer data. That kind of change is easy to miss, because nothing in the product looks different. It is one of the vendor legal changes that only shows up in the documents.

Potential impact

If you rely on any of these tools, the additions raise five practical questions:

• Does your record of each vendor's subprocessors include the AI providers it lists today?

• For each new entry, is the AI used in a feature you can switch off, or by the vendor's own staff?

• If you chose EU or another regional data residency, does the new provider process data in that region?

• Is the entry already in effect, or is there still time to ask questions or object?

• Do your own customer contracts or privacy notices name your subprocessors, and do they need updating?

How Venpo detected it

Venpo monitors vendor subprocessor pages as part of continuous vendor risk monitoring and compares each new version with the one before it, so an added row is visible even when the page's own date does not change. For this article, every addition was checked twice against the stored old and new versions of the page, and against the live page where it could be loaded. The redlines are public for Box, Adobe, Mixpanel, Cloudbeds, Higher Logic, Backblaze, Popl, Forest Admin, SupportLogic, Arrows, and Yubico.

Business outcome

Teams that track these vendors saw each new AI provider as a marked change, including on pages where the date stayed the same. For Box and HubSpot that meant seeing the entry weeks before it took effect. For Cloudbeds, Backblaze, and Forest Admin it meant learning that an AI provider now sits in the vendor's support and internal work, which no product setting would have shown. A team that waits for the annual review finds all of it at once, after every notice period has passed.

Key takeaway

In just over five weeks, Anthropic was added to the subprocessor pages of 31 vendors and OpenAI to at least 10, and about a third of the Anthropic entries are for the vendor's own work and not for a product feature. Some entries start on a future date, some say little about purpose or location, and some sit on pages whose date never moved. Keeping up takes vendor contract monitoring that reads the list itself.