Fourth-Party Risk

What is fourth-party risk?

Fourth-party risk is the risk that comes from your vendors' vendors. You (first party) buy from a vendor (third party). That vendor uses its own providers to run the service, such as a cloud host, an email sender or an AI model. Those providers are your fourth parties.

For software vendors, most fourth parties have a more familiar name: subprocessors. A subprocessor is a company your vendor hires that handles your data on its behalf. Vendors that process personal data list them on a subprocessor list.

You have no contract with a fourth party. You cannot audit it or tell it what to do. Your protection runs through your vendor's contract with it. Under GDPR Article 28(4), a processor that hires another processor must pass down the same data protection duties, and the "initial processor shall remain fully liable" if that provider fails. The 2023 US bank guidance makes a similar point: banks should look at the third party's "own processes for overseeing subcontractors".

In plain terms: you cannot vet every fourth party yourself, so you check how your vendor picks and watches them, and you watch who is on the list.

What it looks like in a vendor's terms

Fourth parties show up in the subprocessor section of a DPA. A typical clause reads like this:

Customer gives general authorization for Provider to use the Subprocessors on its published list. Provider will give notice of any new Subprocessor at least 30 days in advance through its subscription mechanism. Customer may object on reasonable data protection grounds. If the parties cannot resolve the objection, Customer may terminate the affected service.

• "General authorization" means you agree in advance to the vendor adding providers, as long as it tells you.
• "Subscription mechanism" means notice reaches you only if someone signed up.
• "May object" gives you a right to object, but often the only real remedy is leaving.

Stripe's DPA, for example, promises email notice "at least 30 days before the changes take effect" to users who subscribe.

A real change we caught

AI providers are a clear example of fourth parties that change often. Venpo found that at least 30 vendors added Anthropic as a subprocessor since September, and that RingCentral adds AI subprocessors almost every month. If you use any of those vendors, a new company was added to the list of those that may handle your data, and the only sign was an update to that list.

Why it matters to you

Data location and use. A new fourth party can mean your data goes to a new country or into an AI model. That can conflict with what you promised your own customers in your DPA.

Outages. If many of your vendors run on the same cloud host, one outage at that host can hit several of your tools at once. This is concentration risk.

Your own subprocessor list. If you sell to businesses, your customers see your vendors as their fourth parties. When your vendor adds a provider that touches their data, you may owe them notice too.

Audit gaps. A vendor's SOC 2 report often "carves out" its key providers. Under the carve-out method, as the AICPA explains, the auditor tests none of that provider's controls. You need the provider's own report for that.

What to check

• Find each top-tier vendor's subprocessor list and save the current version.
• Subscribe to change notices with a shared inbox, not one person's email.
• Note which subprocessors handle AI, hosting and support, and in which countries.
• Read the objection clause: how many days you have and what happens if you object.
• In the vendor's SOC 2 report, look for carved-out subservice organizations.
• Check whether a change in a vendor's list requires you to update your own subprocessor list.

Nth-Party Risk

Nth-party risk is the same idea carried further down the chain. Your fourth party has its own providers (fifth parties), and they have theirs. "Nth" just means any level.

A data path can look like this:

1. You put customer data into a support tool (third party).
2. The support tool sends tickets to an AI provider for summaries (fourth party).
3. The AI provider runs its models on a cloud host (fifth party).
4. The cloud host uses a data center operator (sixth party).

You cannot track every level, and no small company should try. What you can do is ask your vendor how it oversees its own providers and whether its DPA passes the same duties down the chain, as GDPR Article 28(4) requires for processors. Watching the subprocessor lists of your top vendors catches most changes at the level you can act on. For AI providers in particular, see how to monitor AI subprocessors in your vendor stack.

How Venpo helps

Venpo watches your vendors' subprocessor lists and DPAs. When a vendor adds, removes or replaces a subprocessor, you get a plain-English email that names the company and explains what it means for your data, and every change is kept in that vendor's history.