Subprocessor Monitoring

What is subprocessor monitoring?

Subprocessor monitoring means keeping track of the outside companies your vendors use to handle your data, and noticing when that list changes. Those outside companies are subprocessors: for example, the cloud host, email service or AI model provider behind a product you use.

Many vendors publish them on a subprocessor list. Under GDPR Article 28(2), a vendor working under a general authorization must tell you about intended additions or replacements, so you can object. Monitoring is how you make sure you actually hear about them in time.

Three ways to learn about a new subprocessor

1. Vendor subscriptions. Many vendors offer an email signup for subprocessor changes. Stripe says customers "may subscribe to receive email notifications" of updates (Stripe Sub-processors). Atlassian offers a signup form too. This is the most direct channel, and it is free. The limits: you must find and join each vendor's form, the email goes to whoever signed up, and the notice is only as complete as the vendor makes it. Notice can also differ by product. Atlassian's page notes that for beta services it "may use an alternative notification mechanism" (Atlassian Sub-processors).

2. Manual checks. You open each vendor's list on a schedule and compare it with a saved copy. This catches changes even when no email arrives. It takes time, lists can be long tables spread across several pages, and you may only notice a change after its notice period has ended.

3. Automated monitoring. A tool checks each list on a schedule, compares it with the last version and tells you which companies were added or removed. Generic page-change tools can do the comparison; tools built for legal pages can also explain the change in plain words. Automation still depends on the list being public and current. It cannot see a subprocessor the vendor has not disclosed.

For a short list of vendors, subscriptions plus a quarterly manual check can be enough. As your vendor count grows, gaps get harder to see. The guide on how to monitor AI subprocessors in your vendor stack walks through a practical setup.

What it looks like in a vendor's terms

A typical clause reads like this:

Our current Subprocessors are listed on our website. Customers who subscribe will receive email notice at least 30 days before we add a new Subprocessor. Customer may object on reasonable grounds within that period.

• Listed on our website means the list, not the DPA, is where names live. It can change without the DPA changing.
• Customers who subscribe means notice depends on you signing up. If you do not, you may not get an email.
• 30 days is your window. After it ends, the new company can start processing.
• Object is your right to object. It only helps if you hear in time.

Stripe's DPA follows this pattern, promising email notice "at least 30 days before the changes take effect" to subscribed customers (Stripe DPA, section 3.2).

A real change we caught

Venpo flagged that RingCentral adds AI subprocessors almost every month, including xAI and Fireworks AI. At that pace, a quarterly manual check could miss notice windows. A related case: Twilio's subprocessor list no longer covers its beta services, so a reader of the list alone would not see every company behind every feature.

Why it matters to you

Each new subprocessor is a new company that may see your data, and your customers' data. Who that company is, where it operates and whether it trains AI all affect your risk. This is fourth-party risk: risk from your vendor's vendors.

It also affects your own obligations. If you are a vendor to your customers, their data may flow through your vendors' subprocessors. You may owe your customers notice of that change. See how to notify customers of a new subprocessor.

Timing is the key point. Your right to object often lasts only for the notice period. After that, the change is in place.

What to check

• For each vendor that handles personal data, find its subprocessor list and save a dated copy.
• Join every vendor's subprocessor signup with a shared inbox, not one person's email.
• Read the vendor's DPA for the notice period, the notice channel and how to object.
• Check whether the list covers beta features, AI features and affiliates, or only the core product.
• When a new name appears, look at what it does, where it is based and whether it is an AI subprocessor.

How Venpo helps

Venpo monitors your vendors' subprocessor lists and DPAs and emails you a plain-English alert when a company is added or removed, with what it does and why it matters. Each vendor gets a change history, so you can see how its list has moved over time.