Subprocessor List

What is a subprocessor list?

A subprocessor list is a public page where a vendor names the other companies that handle your data for it. Those companies are called subprocessors. They include the vendor's cloud host, email delivery service, support desk tool and, more and more, AI model providers.

The list exists because of the GDPR. Article 28(2) says a vendor that handles personal data for you needs your written permission to bring in another processor. Many vendors ask for general permission in their data processing agreement. In return, they publish the list and tell you about planned additions or replacements so you can object.

The list is usually public, so you can read it before you buy. That makes it one of the few places where you can see a vendor's supply chain without asking for a security review.

So the list is the vendor's map of where your data goes. The DPA sets the rules, and the list shows the companies those rules cover. This page explains how to read the document itself. The vendor's duties when the list changes are covered in subprocessor change notification and right to object to a subprocessor.

What it looks like in a vendor's terms

Many lists are a table with one row per company. A typical entry reads like this:

Name: Example Cloud, Inc. Purpose: Cloud hosting and data storage. Products: All products. Data: Customer Data, including any personal data you upload. Location: United States, Ireland.

• Name: the legal entity that handles the data. It may differ from the brand name you know, which makes rows hard to recognize.
• Purpose: what the company does for the vendor, such as hosting, email delivery, support or AI features.
• Products: which of the vendor's products use this company. A row may apply only to a product you do not use.
• Data: what kind of data it touches. "Customer Data" usually means everything you upload; "account data" may mean only contact and billing details.
• Location: the country where the company is based or where it processes data. These can be different.

Real lists vary in detail. Stripe's list has four columns: name, data, purpose of processing and entity country. Rows for some products sit under their own headers. Atlassian's list goes further, with columns for applicable products, nature and purpose of processing, categories of personal data, location of processing and security measures. It also groups companies by type, including "AI and Analytics Service Providers." Grafana Labs' list is shorter: entity and address, country and purpose. One row names Anthropic with the purpose "Optional: AI feature."

The parts of the page around the table

The table is not the whole document. Look for these parts too:

• A date: a "last updated" or "effective" date. Atlassian shows an effective date and Stripe shows a "last updated" date at the top. Grafana's list showed no date when we checked.
• A sign-up link: a form or setting to get email updates when the list changes. Stripe, Atlassian and Grafana all offer sign-up links on the page.
• Affiliates: the vendor's own group companies that may access data, often in a separate table.
• Scope notes: lines about which products are covered. Atlassian, for example, notes that beta services may use a different notice process.
• A link to the DPA: the contract that gives the list legal force.

A real change we caught

Venpo flagged that Persona added ClickHouse as a required subprocessor. "Required" matters. An optional subprocessor handles data only if you turn on a feature. A required one is part of the core service, so you cannot avoid it by changing settings.

Another change shows how scope can shrink: Twilio's subprocessor list no longer covers its beta services. Twilio now names the subprocessors for features that are not generally available only in each feature's product documentation, so the main list no longer tells the whole story if you use beta features.

How often subprocessor lists change

There is no fixed schedule. A vendor updates the list whenever it adds, swaps or drops a provider. For some vendors that is rare. For others it is frequent, especially with AI.

• RingCentral adds AI subprocessors almost every month.
• At least 30 vendors added Anthropic as a subprocessor since September.
• Airtable added Anthropic and dropped an AI-agent vendor.
• Stripe added Microsoft Azure and Snowflake as cloud subprocessors.

Dates on the page are not always a guide. In one case, SurveyMonkey changed its AI providers on a page still dated November 2025. Compare the rows themselves, not just the date at the top.

How to read a change

When a list changes, work through it in this order:

1. Find what moved. Compare the old and new versions row by row: added, removed or edited.
2. Identify the company. Look up the legal name and find the brand behind it.
3. Check the purpose. Is it hosting, support, analytics or AI? An AI subprocessor raises extra questions about training and retention.
4. Check the product column. Does the change touch a product you actually use?
5. Check the data column. Does it touch all your uploaded data, or only account details?
6. Check the location. A new country may mean a new data transfer, which can bring in standard contractual clauses or other transfer rules.
7. Check required or optional. If it is tied to a feature, can you leave the feature off?
8. Note the date. Your objection window, if your DPA gives you one, usually runs from the notice, not from when you happen to notice the change.

Legal names and brands

Lists name legal entities, not brands. A row may say "Cantab Research Ltd" when the product you know is Speechmatics; Atlassian's list shows both names for that row. Other lists show only the legal name, so you may need to search it to find out who the company is.

The same brand can also appear several times, once per legal entity or region. Two rows with similar names are not always a duplicate. One may be a new entity in a new country.

A removed row deserves a look too. It can mean the vendor dropped a provider, or that a product moved to another list. Also watch the text above the table: in the Twilio case, no row changed, but one sentence narrowed what the list covers.

Why it matters to you

• Your data goes further than your vendor. Each row is another company holding your data. This is often called fourth-party risk.
• Your own customers may ask. A customer's security review can ask for your full chain of processors, including your vendors' subprocessors.
• Your own list may need updating. If you publish a subprocessor list for your customers, a vendor change can change your chain too.
• Deadlines are short. Objection windows are often 30 days. Stripe's DPA, for example, allows objections within 30 days after notice. If you miss it, the new company is usually treated as accepted.
• AI providers change fast. A new AI subprocessor can mean your data reaches a model provider you never reviewed.

Here is the chain a single record can travel when you use a SaaS tool:

1. Your customer gives you their data.
2. You store it in your vendor's product.
3. Your vendor sends it to a subprocessor, such as a cloud host or AI provider.
4. That subprocessor may use its own providers in turn.

What to check

• Completeness: does the list cover every product you use, including beta and AI features?
• Data detail: does each row say what kind of data it touches, or only a vague purpose?
• Locations: are processing locations listed, not just the company's home country?
• Update sign-up: is there a way to get email notice? Sign up with a shared inbox, not one person's email.
• Dates and archive: does the page show a date, and does the vendor keep earlier versions?
• Link to the DPA: is the list tied to a DPA that gives you notice and a right to object?

How Venpo helps

Venpo watches the subprocessor lists of the vendors you use and emails you a plain-English alert when a company is added, removed or changed, with what it means for your data. Each vendor has a change history, so you can see when a subprocessor first appeared even if the page date never moved.