Free resource · Sub-processor changes
How much of your sub-processor register will vendors fill in?
Security reviewers ask for a sub-processor register: every company your vendors hand your data to, what it does, where, and since when.
Here are the ten columns they expect, and how often AI vendors publish each one, so you know which ones you’ll keep yourself.
Download the template64
of 18,568 published rows carry the date the vendor added the entry. 2 of 128 vendors publish it.
The column reviewers care about most is the one almost nobody publishes.
It’s the date that says whether you were told in time. Where the vendor stamps no date, the only date that exists is the day somebody read the page.
The ten columns, and who fills each.
Counted across 18,568 sub-processor entries published by 128 AI vendors.
| Column | Who fills it | Why reviewers ask | How often vendors publish it |
|---|---|---|---|
| 01Sub-processor | The vendor publishes it | The legal entity, as the vendor names it. A trading name in your register and a legal name in theirs is how one company becomes two entries. | 18,568 of 18,568 rows (100%), 128 of 128 vendors |
| 02What it does for the vendor | The vendor publishes it | A reviewer is checking that a hosting provider is not quietly also an analytics provider. | 16,089 of 18,568 rows (87%), 127 of 128 vendors |
| 03Where it processes | The vendor publishes it | The column your own transfer commitments are tested against. | 16,424 of 18,568 rows (88%), 119 of 128 vendors |
| 04Date the vendor added it | The vendor publishes it | Whether an entry is new. A list without dates cannot be diffed by reading it. | 64 of 18,568 rows (0%), 2 of 128 vendors |
| 05Your window to object | The vendor publishes it | Stated in the agreement rather than on the list, so this column comes from a second document. | 68 of 128 vendors, in the agreement |
| 06Date you first saw it | Recorded when you read the page | Where the vendor stamps no date, this is the only date there is — and it is the one your own notice period runs against in practice. | Recorded when the page is read |
| 07Source URL, read date and hash | Recorded when you read the page | What turns a register into evidence. A reviewer can check the entry against the page you read it from, as it stood that day. | Recorded when the page is read |
| 08Your systems it can reach | Yours to keep | Nobody outside your company can fill this, and it is the column that decides whether a change matters to you at all. | Nothing published can fill it |
| 09Categories of personal data | Yours to keep | Your processing, not the vendor's description of its own service. | Nothing published can fill it |
| 10Customers you owe notice | Yours to keep | From your own agreements. This is the column that turns a vendor's edit into a deadline. | Nothing published can fill it |
3 of the ten columns only you can fill. That’s why you keep a register instead of a bookmark to the vendor’s page.
What a complete row looks like.
Of the 128 vendors here, Outreach fills the largest share of the published columns: a purpose, a location and the date it added each entry.
| Added by the vendor | Sub-processor | Where | What it does |
|---|---|---|---|
| 2019-02-05 | Amazon Web Services | United States & Ireland | Infrastructure and primary hosting provider for Outreach Engage and data warehouse for all Outreach products. |
| 2019-02-05 | Amazon Web Services | United States & Ireland | Infrastructure and primary hosting provider for Outreach Engage and data warehouse for all Outreach products. |
| 2019-02-05 | Twilio, Inc. | United States | Voice provider and other communication services, including call recording storage for Outreach Voice product |
| 2019-02-05 | Twilio, Inc. | United States | Voice provider and other communication services, including call recording storage for Outreach Voice product |
| 2019-03-15 | Databricks Inc. | United States | Infrastructure and primary hosting provider for Outreach ML/AI models. |
| 2019-03-15 | Databricks Inc. | United States | Infrastructure and primary hosting provider for Outreach ML/AI models. |
| 2019-03-15 | Snowflake, Inc. | United States | Data warehouse and business analytics |
| 2019-03-15 | Snowflake, Inc. | United States | Data warehouse and business analytics |
outreach.io/sub-processors · read Aug 31, 2026 · the first 8 entries by the date the vendor added them
How to keep it.
- 01
Record the source on every row.
Not once at the top of the sheet. A register citing one page for forty entries proves nothing about the entry a reviewer asks about.
- 02
Re-read on a schedule.
A sub-processor list is a web page, so an addition shows up as an edit to it.
- 03
Keep a dated copy, not a note.
“We checked in March” is an assertion. The page as it stood in March is evidence.
- 04
Fill in the customers you owe notice first.
Your window to object runs from the vendor’s notice, not from when you notice. 68 of the 128 vendors that publish a list also publish an agreement stating a period.
Start your register from this one.
The columns, how often vendors fill each, and a blank register sheet, as a Word document. The counts are current on the day you download it.
Common questions.
What is a sub-processor register?
A table of every company your vendors use to process your data: what each does, where, and when it appeared. A reviewer asks for it to check that you know your vendors' vendors, not only your own.
What columns should a sub-processor register have?
Ten: the sub-processor, what it does, where, the date the vendor added it, your window to object, the date you first saw it, the source with read date and fingerprint, your systems it reaches, the personal data involved, and customers you owe notice.
Do vendors publish everything the register needs?
No. Across 18,568 published entries from 128 AI vendors, the name is on every row and what the company does is on 87% of them. The date the vendor added the entry is on 64 rows, published by 2 vendors.
How often should I re-read a sub-processor list?
On a schedule, not when you remember. A sub-processor list is a web page, so an addition shows up as an edit to it. Where a vendor stamps no dates on its entries, re-reading is the only way to see one.
Is a link to the vendor's page enough?
Not for evidence. The page you link to is the page as it stands today, and a reviewer asks what it said in March. A register carries the source URL, the date you read it and a fingerprint (SHA-256 hash) of the copy you read.
Track sub-processors
More for this job.
- ExplainerWhat is a sub-processor?The company your vendor brings in, its published list, and your window to object.Open it ›
- ToolScan your sub-processor pagePaste your sub-processor page to see which vendors we watch, and each vendor's window.Open it ›
- ToolCheck your code against your sub-processor pagePaste your package.json to see which companies your code may send data to.Open it ›
- DatasetSub-processor list changes, Q3 2026Every company AI vendors' lists added or removed, dated. With a CSV.Open it ›
- GuideMeet an objection deadlineThe three things a deadline needs, and which one gets missed.Open it ›
- DatasetWhat changed in AI vendor disclosuresSub-processor lists and DPAs that differ from the copy we held before.Open it ›
- DatasetWho your AI vendors depend onThe companies that sit under many of your AI vendors at once.Open it ›
We wrote the columns. How often vendors fill each is counted from published sub-processor lists. We read a sub-processor page for 153 vendors, and 25 of those pages gave us no entry we could read as rows.
That is a limit of our reading, not a finding that those vendors publish nothing. How we keep the record.
This is not legal advice, and the columns are a starting point no one has approved for your situation. Your negotiated contract governs. The record is free to read, and corrections are free to request.