A subprocessor is any third party the primary vendor uses to process customer data, including cloud hosting providers, analytics services, support tools, and underlying AI model providers.
Data processing agreements typically require disclosure of subprocessors, advance notice of changes, and flow-down of security and confidentiality obligations.
Alternative Names:
Sub-Processor, Fourth Party
Why it Matters?
Subprocessors are where confidentiality commitments quietly break down. A vendor may promise not to train models on customer data while its underlying model provider operates under different terms, or may host in one region while a support tool operates elsewhere. Requesting the current subprocessor list and confirming that no-training and residency commitments flow down is among the highest-value diligence steps available.
Frequently Confused with
Related terms
Frequently asked questions
Why do subprocessors matter for AI vendors?
Should a customer have a right to object to new subprocessors?
