Reference
Answering “list every AI sub-processor” in a security questionnaire
The question arrives in a spreadsheet from your customer’s security team, usually with a deadline attached to a renewal. It is asking for three things, and the third is the one that takes the time.
What the question is actually asking
- Which AI vendors touch customer data. Every model API, every transcription or embedding service, every tool your product calls with customer content in the request.
- Who those vendors, in turn, rely on. Your model provider has its own sub-processors: hosting, storage, support tooling. Those are in your chain.
- How you will know when either list changes. This is the part a static spreadsheet cannot answer, and the part a reviewer is increasingly asking about.
Where each vendor publishes its own list
There is no convention for these URLs, so most of the work in answering question two is finding them. We hold a readable sub-processor page for 109 vendors. The full list of URLs is published, with the date each was last read.
1 of them refuse automated readers. Their pages open normally in a browser.
What to write where a vendor publishes nothing you can find
Leaving the cell blank reads as an answer, and it reads as the wrong one. Write what is true: you looked, on a date, and found no published list, and you have asked the vendor.
A reviewer who sees a dated gap and an open question learns something about your process. A reviewer who sees an empty cell learns nothing, and asks again.
Answering the third part
“How will you know when this changes” is answered by whatever you actually do. Most agreements put a period on it: 36 of the vendors in this record state an objection window in their own DPA, and the shortest is 5 business days. Those windows are listed, quoted from each agreement.
An answer that names the pages you monitor and how often you re-read them is checkable. An answer that says you review annually invites the next question.
Keeping the answer for next time
The same question arrives again at the next renewal, from a different customer. What makes the second answer cheap is a dated copy of each page and a record of what changed between copies.
Xither keeps that record and exports it. How it works · What it costs