How to Publish Your Own Subprocessor List

What is your own subprocessor list?

If you sell software that touches your customers' personal data, you are a vendor too. The cloud host, email tool and support desk you use are your subprocessors: outside companies that handle your customers' data on your behalf.

Your own subprocessor list is a public page that names those companies. It tells each customer who else sees their data, why, and where.

Under the GDPR, a processor (a company that handles personal data for a customer) may only bring in another processor with the customer's written authorization. Article 28(2) allows a "general" authorization, but then you must tell the customer about planned additions or replacements so they can object. Many software companies meet that duty with a published list plus a way to sign up for changes.

A list that sits on a page is not the whole job. The European Data Protection Board says a general list that is updated from time to time is not enough on its own; the processor must actively flag each change to the controller (EDPB Guidelines 07/2020, paragraph 128 and footnote 54).

What it looks like in a vendor's terms

A typical clause reads like this:

Customer gives Provider general authorization to use the Subprocessors named on Provider's Subprocessor page. Provider will notify Customer at least 30 days before a new Subprocessor begins processing Customer Personal Data. Customer may object on reasonable data protection grounds during that period. Provider remains responsible for each Subprocessor's work.

• General authorization means the customer agrees in advance to the companies on your list, instead of signing off on each one.
• Notice period is the time between your announcement and the date the new company gets data.
• Objection is the customer's chance to push back. Your DPA should say what happens next.
• Remains responsible reflects Article 28(4): you stay fully liable to your customer if your subprocessor fails.

Stripe's DPA is one real example: it promises notice "at least 30 days before the changes take effect" (Stripe DPA).

A real change we caught

Venpo flagged a case where SurveyMonkey changed its AI providers on a page still dated November 2025. The names on the list moved, but the date did not. A customer who checked the date would think nothing had changed. When you publish your own list, update the date every time you edit it.

Why it matters to you

Larger buyers may ask for your subprocessor list during a security review or a customer DPA request. A clear public page answers that question before it slows a deal.

Your DPA also makes promises about notice. If you add a new tool and forget to announce it, you may break your own contract with every customer who signed that DPA.

Your list also depends on your vendors. If your email provider starts using a new AI company, that company may now touch your customers' data too. This chain is often called fourth-party risk, and you cannot keep your list accurate without knowing what your own vendors change.

What to check

Real lists give a model to copy. Stripe's list shows each company's name, the data it handles, its purpose and its country. Atlassian's list adds the products each one supports and links to security measures. HubSpot's list separates infrastructure providers from feature-specific ones and notes that some apply only if you opt in. Before you publish, check that your page has:

• The legal name of each subprocessor, plus the brand name if it differs.
• What each one does for you, in a few plain words, and which of your products it supports.
• The types of personal data it handles and where it processes them (country or region).
• A last updated date that changes every time the list does, and ideally a short change log.
• A visible way to subscribe to updates, such as an email signup form, as Stripe, Atlassian and HubSpot all offer.
• Notes for anything optional, such as AI features or beta products, so customers know when those companies apply. See AI subprocessors.

Then match the page to your DPA. The notice period, the signup method and the objection process on the page should say the same thing as the contract.

How Venpo helps

Venpo watches the subprocessor lists, DPAs and privacy policies of the vendors you rely on and emails you a plain-English alert when one adds or drops a company. That tells you when your own list may need an update. Each vendor also gets a change history you can point to when a customer asks.