Security questionnaires
How do you answer “list every AI sub-processor”?
It comes in a spreadsheet from your customer’s security team, usually with a renewal deadline attached. It asks three things, and the third one takes the time.
This page is about that one question. Answers to the other AI questions are in the resources.
What the question is really asking.
Which AI vendors touch customer data.
Every model API, every transcription or embedding service, every tool your product calls with customer content in the request.
Who those vendors rely on.
Your model provider has its own sub-processors, the companies it hands your data to: hosting, storage, support tooling. Those are in your chain too.
How you'll know when either list changes.
A static spreadsheet can't answer this one, and reviewers ask about it more and more.
Part two
Where each vendor publishes its own list.
There’s no standard address for these pages, so most of the work in part two is finding them. We’ve published every address we have, with the date each was last read.
118
sub-processor lists we can read, for the 186 vendors we watch.
1
vendors turned our reader away. Open their pages in a browser.
What to write when you can’t find a vendor’s list.
A blank cell reads as an answer, and as the wrong one. Write what is true instead.
Leave it blank
The reviewer learns nothing, and asks again.
Write what’s true
We looked on [date] and found no published list. We have asked [vendor] for one.
A dated gap and an open question tell the reviewer something about how you work.
Part three
“How will you know when this changes?”
Answer with whatever you actually do. Many vendor agreements put a time limit on it, so the reviewer will check.
81
vendors state one in their data processing agreement (DPA) or on their sub-processor page.
5
days to object: the shortest. See every window, quoted from each agreement.
An answer a reviewer can check
Name the pages you monitor and how often you re-read them.
An answer that gets a follow-up
“We review annually.” Expect the next question.
The same question comes back next renewal.
Usually from a different customer. A dated copy of each page, and a record of what changed between copies, makes the second answer quick.
Xither keeps that record and exports it. How it works.
Have the answer ready before the spreadsheet arrives.
Name the AI vendors in your product. We read their pages on a schedule, tell you when one changes a fact, and keep every copy for your export.
Try it free for 14 daysNo card. Nothing to cancel.