How to find and read a vendor’s subprocessor list
A subprocessor is any third party your vendor hands your data to in order to deliver the service — the host, the database, the email sender, the error tracker, and the CDN sitting in front of all of them. Vendors publish that list in one of four places: a dedicated legal page, a trust center, an annex to the data processing agreement, or a change-notice mailing list. There is no standard URL and no legal requirement to publish one publicly at all, which is why guessing the address fails roughly half the time.
Last updated August 26, 2026 · Deadpan Labs, Miami, FL
We tried guessing. It worked eleven times out of twenty-eight.
On August 26, 2026 we took twenty-eight well-known infrastructure and ecommerce vendors, guessed the most plausible subprocessor URL for each, and requested it with a plain HTTP client following redirects — no browser, no JavaScript, roughly what an automated crawler or a reviewer’s script sees.
- 11 served a page at the exact URL we guessed.
- 4 more redirected somewhere else and served a page there.
- 10 returned 404.
- 3 refused the request outright with a 401 or 403 — the page may well exist, but not for a non-browser client.
Two of the eleven that resolved returned HTML containing no occurrence of the word at all: the list renders client-side after the page loads. That is worth knowing beyond a manual review, because it is also what a crawler that does not execute JavaScript sees — a subprocessor page with no subprocessors on it.
We are not naming which vendors landed in which bucket, and the reason is not tact. Several that failed the guessed URL publish a perfectly complete list somewhere else, so a pass/fail table keyed on our guess would report them as something they are not. The finding is about the method, not the vendors: do not guess.
The four places vendors publish it
A dedicated legal page
The most common pattern, and the one worth trying first. There is no standard path, which is the whole problem: the same list lives at /legal/subprocessors on one vendor, /subprocessors on another, /legal/sub-processors on a third, /gdpr/subprocessors on a fourth, and /legal/service-providers on a fifth. Vendors also split on the hyphen — "subprocessor" and "sub-processor" are both in wide use, and a site search for one will miss the other.
A trust center
Larger vendors put the list inside a trust or security portal alongside the SOC 2 report and the penetration-test summary. Check whether the portal is public before you cite it: some trust centers return a normal-looking page to an anonymous visitor and put the documents themselves behind a sign-in or an NDA click-through, so a working link is not the same as an accessible document.
Inside the DPA itself
Plenty of vendors never publish a standalone page and instead attach the list as an annex to the data processing agreement, often as a PDF. If the public site has no subprocessor page, read the DPA before concluding the vendor does not disclose — the annex is a disclosure, it is just an inconvenient one.
A change-notice subscription
The list is only half of it. The other half is how you learn it changed. Mature vendors publish the list with a mailing list or an RSS feed for additions, plus a stated objection window. A list with no notice mechanism tells you who the subprocessors were on the day you looked, which is not what your own obligations run on.
What a complete list actually contains
A list of company names is not a subprocessor list; it is a vendor roster. Five fields are what make it reviewable, and the ones most often missing are the last two.
The entity, not the brand
The legal entity that signs, which is frequently not the product name on the marketing site. Corporate groups route the same product through different entities by region, and the entity is what determines which regulator and which transfer mechanism applies to you.
What it does, in a sentence
The processing purpose. "Infrastructure" is not a purpose. "Hosts the application and serves requests" is. A purpose you cannot picture is a purpose you cannot scope, and the scope is what your DPA is supposed to bound.
Which data it can touch
Categories, not adjectives. There is a real difference between a subprocessor that holds account records at rest and one that only ever sees request metadata in transit, and a list that describes both as "customer data" has flattened the distinction you were reading for.
Where it processes
The processing location, and for a global edge network the honest answer is a network rather than a country. If your own obligations turn on where data goes, this is the row that answers it, and it is the row most often left off.
The date, and what happens next
When the list was last revised, plus how additions are announced and how long you have to object. Under GDPR Article 28 a processor operating on general written authorization has to inform you of intended changes and give you the chance to object. A list with no date and no notice mechanism cannot support that.
Common questions
What is a subprocessor?
A subprocessor is a third party that your vendor engages to help process data on your behalf. If you are the controller and your vendor is the processor, anyone the vendor hands the data to in order to deliver the service is a subprocessor: the hosting provider, the database platform, the email sender, the error-tracking service, the CDN in front of all of it. The relationship is chained, and under GDPR Article 28 the original processor stays fully liable to you for what its subprocessors do.
Is a CDN a subprocessor?
Almost always, yes — and it is the one people forget. A CDN terminates the TLS connection, which means it sees the request in the clear: headers, IP address, path, and anything in the body. IP addresses are treated as personal data under GDPR, so a CDN is processing personal data on your behalf even when it caches nothing and stores nothing. "It is just caching" describes what the CDN retains, not what it processes, and the obligation attaches to the processing. The same reasoning applies to a WAF, a bot-protection service, and an edge function platform.
Where do I find a vendor's subprocessor list?
Try four places in order: a dedicated legal page (paths vary wildly — /legal/subprocessors, /subprocessors, /legal/sub-processors, /gdpr/subprocessors and /legal/service-providers are all in live use), the vendor's trust or security center, the annex of the data processing agreement, and the vendor's change-notice mailing list. Search for both spellings, "subprocessor" and "sub-processor", because vendors split roughly evenly on the hyphen and most site searches will not match across it. If none of the four turns anything up, ask your account contact in writing and keep the reply — a written statement of the subprocessor list is itself a usable artifact.
Does a vendor have to publish a subprocessor list publicly?
No, and this trips up a lot of questionnaires. GDPR Article 28 requires that a processor not engage a subprocessor without your authorization, that any subprocessor be bound by equivalent data protection obligations, and that you be informed of intended changes with an opportunity to object. It does not require a public web page. Publishing one is simply the most practical way for a vendor to satisfy general written authorization and change notice at scale. A vendor that discloses its subprocessors in the DPA and notifies you by email is compliant; a vendor that will not tell you at all is the actual problem.
What is the difference between a processor and a subprocessor?
Position in the chain, not kind. You are the controller: you decide why and how the data is processed. The vendor you contract with is the processor. Anyone that vendor brings in to help deliver the service is a subprocessor. The distinction matters for one practical reason: your contract is with the processor, so your leverage over a subprocessor is entirely indirect and runs through the terms your processor agreed to flow down.
What should I do if a subprocessor list has not been updated in years?
Treat a stale date as a finding in its own right, not a formatting nit. Every vendor's infrastructure changes; a list that has not moved in two years is either wrong or unmaintained, and either way it cannot support the change-notice obligation it exists to satisfy. Ask when it was last reviewed and how additions are announced. The answer to the second question tells you more about the vendor's data governance than the list itself does.
A worked example
Ours is public and written to the five fields above — every third party that can touch client or personal data, what each one does, which data it can reach, where it operates, and what its published compliance posture is, including the ones that are switched off today and would switch on with a feature. Read the Deadpan Labs subprocessor list if you want to see the shape, or our security page for the controls behind it, including the section on what we don’t do yet.
This page is written for people running vendor reviews. It is not legal advice, and it is not a substitute for your counsel reading your own data processing agreement.
Running a security review?
Send us the questionnaire. We answer them ourselves, in full sentences, and we tell you which lines we can’t answer yes to.
Get in touch →