SurveyMonkey changed its AI providers on a page still dated November 2025

The change

SurveyMonkey keeps a public subprocessor list: the outside companies that handle customer data on its behalf. On September 19, 2026, Venpo detected a new version of that list. Several entries changed, including the companies behind SurveyMonkey's AI features.

The top of the page did not change. It still reads "UPDATED: November 3, 2025" and "EFFECTIVE DATE: December 27, 2025." The downloadable PDF linked at the bottom of the page is now labeled Q3 2026. The redline is on the public change page.

What changed

• AWS now runs AI features. Amazon Web Services was listed for cloud hosting and data storage. It is now also listed for "generative AI technology for SurveyMonkey's AI features (AWS Bedrock)."

• Azure OpenAI is gone. Microsoft's Azure OpenAI service, previously listed for SurveyMonkey's AI product features, was removed from the list.

• OpenAI covers more products. OpenAI stays on the list for AI product features, and its entry now covers GetFeedback Digital as well as SurveyMonkey.

• Anthropic added. Anthropic is new, listed as an "AI tool used to provide customer-requested professional services."

• Merge added. Merge API is new, used for customers who connect their HR system: it moves data from that HR system into SurveyMonkey.

• Fewer contractors. The Philippines was removed from Upwork's contractor locations, and three India-based analytics contractors were removed.

What moved behind the AI features

SurveyMonkey's AI features can work with the surveys and responses you collect. The subprocessor list is where a customer learns which outside AI services may see that data.

Before this update, the list named Azure OpenAI and OpenAI for AI features. Now it names AWS Bedrock and OpenAI. Bedrock is Amazon's service for running AI models from several companies, so the entry tells you whose infrastructure processes the data, but not which model does the work. AWS was already a subprocessor for hosting, so the company is not new, but its role now includes AI.

The date that did not move

Most teams check a subprocessor list the same way: open the page, look at the date at the top, and compare it with the date they last reviewed. On this page, that check would say nothing has changed since November 2025.

The page does offer a better route. At the bottom, SurveyMonkey invites customers to subscribe to email notifications of updates to the list. That subscription, or a tool that compares the full text, is the reliable signal. The header date is not.

What did not change

Several changes narrow the list rather than widen it: fewer contractors and one fewer contractor country. The new entries are also scoped. Anthropic is listed only for customer-requested professional services, and Merge only for customers who use the HR system integration. The page's commitments on transfer safeguards and encryption are unchanged.

Why this matters

For a SaaS company, SurveyMonkey often holds two sensitive kinds of data: customer feedback, including open-text answers that name people and problems, and employee surveys, which can include engagement, performance, and HR data. Knowing which AI services touch that data is part of every security review and many customer questionnaires.

AI subprocessors are the part of these lists that changes fastest, as we saw when Airtable added Anthropic as an AI subprocessor and RingCentral added xAI and Fireworks AI. Tracking them is the core of monitoring AI subprocessors, and this update shows why that tracking cannot rely on the date at the top of the page.

Potential impact

For a SaaS company using SurveyMonkey, the update raises four practical questions:

• Does your vendor record for SurveyMonkey still list Azure OpenAI for AI features?

• Do you use SurveyMonkey's AI features on employee or customer surveys, and does your own AI policy allow that data to go to the providers now listed?

• Are you using the HR system integration, and do you know that Merge now sits in that data flow?

• Is someone on your team subscribed to SurveyMonkey's subprocessor notifications?

These are the same questions vendor legal changes raise across every tool that handles customer data.

How Venpo detected it

Venpo monitors SurveyMonkey's legal pages as part of continuous vendor risk monitoring. It compares the full text of each page, not its header date, so it caught the new entries on September 19 even though the page still showed its November 2025 date. The full redline is on the SurveyMonkey change page, and every monitored SurveyMonkey document is listed on the SurveyMonkey vendor profile.

Business outcome

Teams that track SurveyMonkey got a plain-English list of which subprocessors were added, removed, or given new roles. That leaves time to update the vendor record, check AI feature settings for sensitive surveys, and answer the next customer questionnaire with the current list instead of last year's. The alternative is telling a customer that SurveyMonkey uses Azure OpenAI after it stopped listing it.

Key takeaway

SurveyMonkey changed the AI services behind its features, added two new subprocessors, and removed others, while the date at the top of the page stayed in November 2025. When the date cannot be trusted, the only reliable check is the text itself, which is why automated monitoring beats checking the header.