Resource · Sub-processor changes
Sub-processor register template
Ten columns, in the shape a reviewer asks for them, with the share of each one your vendors will fill in for you.
The ten columns, and who fills each
Anyone can type this table. What no one can type is the answer to the question it raises on its second day: which of these columns does the vendor publish, and which are yours to keep? The last column counts it, across 3,433 sub-processor entries published by 95 AI vendors.
| Column | Who fills it | Why it is asked for | In the record |
|---|---|---|---|
| Sub-processor | The vendor publishes it | The legal entity, as the vendor names it. A trading name in your register and a legal name in theirs is how one company becomes two entries. | 3,433 of 3,433 rows (100%), 95 of 95 vendors |
| What it does for the vendor | The vendor publishes it | A reviewer is checking that a hosting provider is not quietly also an analytics provider. | 2,837 of 3,433 rows (83%), 94 of 95 vendors |
| Where it processes | The vendor publishes it | The column your own transfer commitments are tested against. | 2,474 of 3,433 rows (72%), 85 of 95 vendors |
| Date the vendor added it | The vendor publishes it | Whether an entry is new. A list without dates cannot be diffed by reading it. | 61 of 3,433 rows (2%), 3 of 95 vendors |
| Your window to object | The vendor publishes it | Stated in the agreement rather than on the list, so this column comes from a second document. | 27 of 95 vendors, in the agreement |
| Date you first saw it | Recorded when you read the page | Where the vendor stamps no date, this is the only date there is — and it is the one your own notice period runs against in practice. | Recorded when the page is read |
| Source URL, read date and hash | Recorded when you read the page | What turns a register into evidence. A reviewer can check the entry against the page you read it from, as it stood that day. | Recorded when the page is read |
| Your systems it can reach | Yours to keep | Nobody outside your company can fill this, and it is the column that decides whether a change matters to you at all. | Nothing published can fill it |
| Categories of personal data | Yours to keep | Your processing, not the vendor's description of its own service. | Nothing published can fill it |
| Customers you owe notice | Yours to keep | From your own agreements. This is the column that turns a vendor's edit into a deadline. | Nothing published can fill it |
The column almost nobody publishes
The date a vendor added an entry to its own list appears on 61 rows of 3,433, published by 3 vendors of 95. That is the column a reviewer cares most about, because it is the one that says whether you were told in time.
Where the vendor stamps no date, the only date that exists is the date somebody read the page. That is why the register has a column for it, and why a register kept by re-reading beats one kept by remembering.
Four of the ten columns nobody outside your company can fill. That is not a defect in the register — it is the reason a register exists rather than a bookmark to the vendor’s page.
What a complete row looks like
Outreach fills the largest share of the published columns of the 95vendors here — chosen by measuring rather than named by us. Its entries carry a purpose, a location and the date it added each one.
| Added by the vendor | Sub-processor | Where | What it does |
|---|---|---|---|
| 2019-02-05 | Amazon Web Services | United States & Ireland | Infrastructure and primary hosting provider for Outreach Engage and data warehouse for all Outreach products. |
| 2019-02-05 | Amazon Web Services | United States & Ireland | Infrastructure and primary hosting provider for Outreach Engage and data warehouse for all Outreach products. |
| 2019-02-05 | Twilio, Inc. | United States | Voice provider and other communication services, including call recording storage for Outreach Voice product |
| 2019-02-05 | Twilio, Inc. | United States | Voice provider and other communication services, including call recording storage for Outreach Voice product |
| 2019-03-15 | Databricks Inc. | United States | Infrastructure and primary hosting provider for Outreach ML/AI models. |
| 2019-03-15 | Databricks Inc. | United States | Infrastructure and primary hosting provider for Outreach ML/AI models. |
| 2019-03-15 | Snowflake, Inc. | United States | Data warehouse and business analytics |
| 2019-03-15 | Snowflake, Inc. | United States | Data warehouse and business analytics |
Source: https://outreach.io/sub-processors · read Aug 31, 2026. Showing the first 8 entries by the date the vendor added them.
How to keep it
Record the source on every row, not once at the top of the sheet. A register citing one page for forty entries proves nothing about the entry a reviewer asks about.
Re-read on a schedule. A sub-processor list is a page, so an addition arrives as an edit and nothing announces it.
Keep the copy, not the finding. “We checked in March” is an assertion; the page as it stood in March is evidence.
Fill the last column first. Your window to object runs from the vendor’s notice rather than from your discovery, and 27 of the 95 vendors that publish a list also publish an agreement stating a period.
Take it with you
The columns, the coverage and a blank register sheet as a Word document. It is generated when you download it, so the counts are the ones the record holds that day.
How this was assembled
The columns are written. The coverage beside each one is counted from published sub-processor lists — 3,433 entries across 95 vendors. We read a sub-processor page for 115 vendors; 20 of those pages produced no entry we could parse into rows, which is a limit of our reading rather than a finding that the vendor publishes nothing. How the record is kept.
Common questions
- What is a sub-processor register?
- A table of every company your vendors use to process your data, with what each one does, where it does it, and when it appeared. A reviewer asks for it to check that you know your fourth parties rather than only your vendors.
- What columns should a sub-processor register have?
- Ten: the sub-processor, what it does, where it processes, the date the vendor added it, your window to object, the date you first saw it, the source URL with a read date and hash, the systems of yours it can reach, the categories of personal data, and the customers you owe notice.
- Do vendors publish everything the register needs?
- No. Across 3,433 published entries from 95 AI vendors, the name is on every row and what the company does is on 83% of them, but the date the vendor added the entry is on 61 rows, published by three vendors.
- How often should I re-read a sub-processor list?
- On a schedule rather than when you remember to. A sub-processor list is a web page, so an addition arrives as an edit and nothing announces it. Where a vendor stamps no date on its entries, re-reading is the only way an addition becomes visible at all.
- Is a link to the vendor's page enough?
- Not for evidence. The page you link to is the page as it stands today, and the question a reviewer asks is what it said in March. A register carries the source URL, the date you read it and the hash of the copy you read.
Sub-processor changes
Find out when a vendor's list moves, and decide what to do.
- What changed in AI vendor disclosures
Sub-processor lists and DPAs that differ from the copy we held before.
- Who your AI vendors depend on
1,381 companies named across 95 vendors' sub-processor lists — AWS by 63 of them. The dependency none of your contracts is with.
This is not legal advice, and the columns are a starting point rather than a set anyone has approved for your situation. The entries counted here are published pages read on the dates shown; your negotiated contract governs. The record is free to read, and corrections are free to request.