What are the key takeaways from this article?

AI Governancesubprocessorssupply chainGDPRAI governance

AI Governance

Your AI vendor has vendors

I mapped the subprocessor lists of 87 tech companies, two levels deep: 1,498 nodes, 2,518 edges. Three hyperscalers sit under everything, AI labs arrive one layer down, and 58 companies publish no list at all.

Mohammad Movahedi
October 5, 2026

ShareLinkedIn

Key takeaways

Microsoft, Google and AWS appear in 19, 17 and 20 of the 29 published lists. Concentration risk has a concrete shape.

OpenAI and Anthropic show up one layer down, inherited through a vendor’s AI features rather than your contract.

58 of 87 companies publish no usable public list: 54 none found, 3 login-walled, 1 partial. Most are hardware and semiconductor firms.

In your next renewal, ask which AI models sit inside the product, and when they arrived.

Source: github.com/movahedi-ca/AI-data-map, data/subprocessor-graph/ (snapshot 2026-10-05). 87 companies, 1,498 nodes, 2,518 edges, every edge with source URL and as-of date.

Microsoft names Anthropic as a subprocessor. Not in a blog post. In its subprocessor list, the dull legal page nobody reads: Claude shows up inside Microsoft 365 Copilot. Grok arrives through a side door instead: a documented admin setting, off by default, that brings xAI’s models into Word, Excel, and PowerPoint for eligible Frontier customers. Your enterprise AI stack has a supply chain, and the supply chain has opinions about your data.

I mapped it. Eighty-seven tech companies, the S&P 500 IT sector plus the Nasdaq-100 tech names outside it, two levels deep: who processes data for whom, and then who processes for them. The result is 1,498 nodes and 2,518 edges, every one with a source URL and a date. (Snapshot as of October 5, 2026. Lists change; treat it as a photograph, not a census.)

Here is what the photograph shows.

Interactive: the subprocessor map

Every AI vendor sits on a stack of vendors. We checked 87 index tech companies against the subprocessor lists they publish. The view below shows the 30 most-connected nodes: the hubs most of the index runs through.

Published list
Partial list
No public list
Shared subprocessor

On small screens the map is replaced by the ranked list above. The interactive map is still available below.

The strongest links, as text

The 20 strongest company-to-vendor links in the data.

Alphabet Inc. → Cognizant Worldwide: Technical Support; Assured Support (Israel); Assured Support (EU - Ireland, Romania); Data Labeling
Alphabet Inc. → Palo Alto Networks: Technical Support
Alphabet Inc. → Google: Service Maintenance; Technical Support
Alphabet Inc. → Google: Service Maintenance; Technical Support
Alphabet Inc. → Google: Data Center Operations
Alphabet Inc. → Google: Service Maintenance; Technical Support
Alphabet Inc. → Google: Service Maintenance; Technical Support
Alphabet Inc. → Google: Service Maintenance; Technical Support
Alphabet Inc. → Google: Data Center Operations; Service Maintenance; Technical Support
Alphabet Inc. → Google: Service Maintenance; Technical Support
Alphabet Inc. → Google: Data Center Operations; Service Maintenance; Technical Support
Alphabet Inc. → Google: Service Maintenance; Technical Support
Alphabet Inc. → Google: Service Maintenance; Technical Support
Alphabet Inc. → Google: Service Maintenance; Technical Support
Alphabet Inc. → Google: Service Maintenance; Technical Support
Alphabet Inc. → Google: Service Maintenance; Technical Support
Alphabet Inc. → Google: Service Maintenance; Technical Support
Alphabet Inc. → Google: Service Maintenance; Technical Support
Alphabet Inc. → Google: Data Center Operations; Service Maintenance; Technical Support
Alphabet Inc. → Google: Service Maintenance; Technical Support

Figure 1. AWS, Microsoft and Google appear on 17 to 20 of the 29 published lists. A handful of shared vendors sits behind most of the index.

Default view: the 30 nodes with the most list rows, and the links between them. The button below opens all 147 nodes.

Not shown: the full 1,498-node crawl, second-level vendors (a vendor's own vendors, available per node below), or vendors companies never disclosed. Purposes repeat the lists' own wording.

87 S&P 500 IT and Nasdaq-100 tech companies. 29 published lists captured as rows; 1 partial (Akamai); 57 with no usable public list. Subprocessor families grouped (AWS includes Amazon, Google includes GCP, Microsoft includes Azure).

Source: company subprocessor lists and privacy pages, captured 2026-10-05.

Three clouds under everything. The most frequent names across the 87 companies are not surprising, but the numbers are stark: Microsoft is named in 19 of the 29 published lists, Google in 17, Amazon Web Services in 20. Three hyperscalers underpin the entire index. Concentration risk people usually talk about in the abstract has a very concrete shape here. AWS’s own list names 64 infrastructure affiliates across dozens of countries. Twilio’s list runs to 40 rows and includes its own hyperscaler dependencies. Everybody rents from the same three landlords, and the landlords rent from each other.

The most-named subprocessors

Figure 2. AWS appears on 20 of the 29 published lists; Microsoft on 19; Google on 17. Three vendors sit behind most of the companies that publish.

Count of the 29 captured lists naming each vendor family. Affiliates grouped: AWS includes Amazon, Google includes GCP, Microsoft includes Azure.

Only published lists are counted. The 58 companies with no usable list are invisible here.

Data table

The most-named subprocessors
Vendor	Lists
AWS	20
Microsoft	19
Google	17
Salesforce	12
Twilio	10
OpenAI	8
Okta	7
Datadog	7
Atlassian	7
Oracle	7

Source: company subprocessor lists and privacy pages, captured 2026-10-05.

29 publish. 58 do not.

Published (29)
Partial (1)
No usable list (57)

Figure 3. Two in three index tech companies publish no usable subprocessor list. A vendor's vendors are, most of the time, undisclosed.

Each square is one of the 87 index companies, classified from its privacy pages and search trail on 2026-10-05. Akamai's main list blocked automated retrieval, so it counts as partial.

A published list is not a complete list: some captured lists are excerpts, and lists change without notice.

Data table

29 publish. 58 do not.
Status	Companies
Published (29)	29
Partial (1)	1
No usable list (57)	57

Source: company subprocessor lists and privacy pages, captured 2026-10-05.

The AI labs moved in. OpenAI is named in 8 index-company lists. Anthropic in 4. That is the visible part. The interesting part is how they arrive: not as the headline vendor you contracted with, but one layer down, inside someone else’s product. When your vendor adds an AI feature, the lab becomes your subprocessor by inheritance. If your vendor list review is annual and their AI roadmap is quarterly, do the math on that gap.

The 87 companies

Every company in the index, what it publishes, and how long its list is.

Default order: published lists first, longest first. An editorial choice; use the column headers to re-sort.

The 87 companies

Alphabet Inc.GOOGL/GOOG	Cloud & Infrastructure	Published, 157 rows	3: Cognizant Worldwide, Palo Alto Networks, Google
Palo Alto NetworksPANW	Other	Published, 107 rows	29: AWS, ClickHouse, Cloudflare +26 more
Motorola SolutionsMSI	Hardware & Devices	Published, 96 rows	29: AWS, Apple, Cloudflare +26 more
Adobe Inc.ADBE	Software & SaaS	Published, 80 rows	25: Microsoft, AWS, Snowflake +22 more
Gen DigitalGEN	Software & SaaS	Published, 73 rows	18: Akamai, AWS, Amplitude +15 more
AccentureACN	IT Services	Published, 69 rows	7: Microsoft, Google, AWS +4 more
ServiceNowNOW	Software & SaaS	Published, 68 rows	7: ServiceNow, Microsoft, AWS +4 more
SalesforceCRM	Software & SaaS	Published, 62 rows	19: Google, Pendo.io, OpenAI +16 more
F5, Inc.FFIV	Hardware & Devices	Published, 39 rows	None
Dell TechnologiesDELL	Hardware & Devices	Published, 38 rows	2: Concentrix, AWS
Hewlett Packard EnterpriseHPE	Hardware & Devices	Published, 38 rows	8: HPE, AWS, Google +5 more
ShopifySHOP	E-commerce & Marketplaces	Published, 34 rows	10: AWS, Anthropic, Cloudflare +7 more
Zebra TechnologiesZBRA	Hardware & Devices	Published, 33 rows	10: Atlassian, Datadog, Google +7 more
Meta PlatformsMETA	Media & Information	Published, 32 rows	None
CiscoCSCO	Hardware & Devices	Published, 31 rows	12: AWS, Google, Microsoft +9 more
GoDaddyGDDY	Cloud & Infrastructure	Published, 27 rows	6: AWS, Cisco, Cloudflare +3 more
Fair IsaacFICO	Software & SaaS	Published, 26 rows	11: AWS, Microsoft, Zoom +8 more
Nebius GroupNBIS	Cloud & Infrastructure	Published, 20 rows	6: Nebius, Microsoft, Functional Software, Inc. +3 more
Trimble Inc.TRMB	Hardware & Devices	Published, 20 rows	12: AWS, Salesforce, Microsoft +9 more
Thomson ReutersTRI	Media & Information	Published, 15 rows	9: AWS, Microsoft, Pendo.io +6 more
DatadogDDOG	Software & SaaS	Published, 13 rows	10: AWS, Anthropic, Google +7 more
PTC Inc.PTC	Software & SaaS	Published, 7 rows	5: AWS, Cisco, Microsoft +2 more
FortinetFTNT	Hardware & Devices	Published, 6 rows	5: Atlassian, Slack, AWS +2 more
Palantir TechnologiesPLTR	Software & SaaS	Published, 6 rows	5: AWS, Microsoft, Google +2 more
Oracle CorporationORCL	Software & SaaS	Published, 4 rows	3: Akamai, OpenAI, Twilio
IntelINTC	Semiconductors	Published, 3 rows	3: AWS, Microsoft, SendGrid
IntuitINTU	Software & SaaS	Published, 3 rows	1: Salesforce
MicrosoftMSFT	Software & SaaS	Published, 2 rows	1: Anthropic
QualcommQCOM	Semiconductors	Published, 2 rows	None
Akamai TechnologiesAKAM	Other	Partial (4)	None
Advanced Micro DevicesAMD	Semiconductors	None found	None
AmphenolAPH	Hardware & Devices	None found	None
Analog DevicesADI	Semiconductors	None found	None
Apple Inc.AAPL	Hardware & Devices	None found	None
Applied MaterialsAMAT	Semiconductors	None found	None
AppLovinAPP	Software & SaaS	None found	None
Arista NetworksANET	Hardware & Devices	None found	None
Arm HoldingsARM	Semiconductors	None found	None
ASML HoldingASML	Semiconductors	None found	None
Astera LabsALAB	Semiconductors	None found	None
AutodeskADSK	Software & SaaS	None found	None
BroadcomAVGO	Semiconductors	None found	None
Cadence Design SystemsCDNS	Software & SaaS	None found	None
CDW CorporationCDW	Hardware & Devices	None found	None
CienaCIEN	Hardware & Devices	None found	None
CognizantCTSH	IT Services	None found	None
Coherent Corp.COHR	Hardware & Devices	None found	None
CoreWeaveCRWV	Cloud & Infrastructure	None found	None
Corning Inc.GLW	Hardware & Devices	None found	None
CrowdStrikeCRWD	Software & SaaS	None found	None
DoorDashDASH	E-commerce & Marketplaces	None found	None
EverpureP	Hardware & Devices	None found	None
First SolarFSLR	Hardware & Devices	None found	None
Flex Ltd.FLEX	Other	None found	None
GartnerIT	IT Services	None found	None
HP Inc.HPQ	Hardware & Devices	None found	None
IBMIBM	Other	Login-walled	None
JabilJBL	Hardware & Devices	None found	None
Keysight TechnologiesKEYS	Hardware & Devices	None found	None
KLA CorporationKLAC	Semiconductors	None found	None
Lam ResearchLRCX	Semiconductors	None found	None
LumentumLITE	Hardware & Devices	None found	None
Marvell TechnologyMRVL	Semiconductors	None found	None
Microchip TechnologyMCHP	Semiconductors	None found	None
Micron TechnologyMU	Semiconductors	None found	None
Monolithic Power SystemsMPWR	Other	None found	None
NetAppNTAP	Hardware & Devices	Login-walled	None
NvidiaNVDA	Semiconductors	None found	None
NXP SemiconductorsNXPI	Semiconductors	None found	None
ON SemiconductorON	Semiconductors	None found	None
PDD HoldingsPDD	E-commerce & Marketplaces	None found	None
Qnity ElectronicsQ	Hardware & Devices	None found	None
Roper TechnologiesROP	Software & SaaS	None found	None
SandiskSNDK	Hardware & Devices	None found	None
Seagate TechnologySTX	Hardware & Devices	None found	None
Skyworks SolutionsSWKS	Semiconductors	None found	None
Strategy Inc.MSTR	Software & SaaS	None found	None
SupermicroSMCI	Hardware & Devices	None found	None
SynopsysSNPS	Software & SaaS	None found	None
TE ConnectivityTEL	Hardware & Devices	None found	None
Teledyne TechnologiesTDY	Hardware & Devices	None found	None
TeradyneTER	Semiconductors	None found	None
Texas InstrumentsTXN	Semiconductors	None found	None
Tyler TechnologiesTYL	Software & SaaS	None found	None
VerisignVRSN	Cloud & Infrastructure	None found	None
Western DigitalWDC	Hardware & Devices	None found	None
Workday, Inc.WDAY	Software & SaaS	Login-walled	None

Figure 4 · Source: company subprocessor lists and privacy pages, captured 2026-10-05.

The most-named subprocessors

Subprocessors appearing on the most published lists. 655 distinct names in total; the table opens with the top 60.

Default order: named in the most lists first. An editorial choice; use the column headers to re-sort.

Showing the top 60 of 655

The most-named subprocessors
		Named by
AWS	20 lists	AccentureAdobe Inc.CiscoDatadogDell Technologies
Microsoft	19 lists	AccentureAdobe Inc.CiscoDatadogFair Isaac
Google	17 lists	AccentureAdobe Inc.Alphabet Inc.CiscoDatadog
Salesforce	12 lists	AccentureCiscoDatadogFair IsaacGen Digital
Twilio	10 lists	CiscoDatadogFair IsaacGen DigitalGoDaddy
OpenAI	8 lists	Adobe Inc.DatadogGoDaddyOracle CorporationPalantir Technologies
Okta	7 lists	AccentureAdobe Inc.CiscoFair IsaacMotorola Solutions
Datadog	7 lists	Adobe Inc.Motorola SolutionsPalo Alto NetworksSalesforceThomson Reuters
Atlassian	7 lists	Fair IsaacFortinetMotorola SolutionsNebius GroupPalo Alto Networks
Oracle	7 lists	Gen DigitalPTC Inc.Palantir TechnologiesPalo Alto NetworksSalesforce
Cloudflare	6 lists	Adobe Inc.GoDaddyMotorola SolutionsPalo Alto NetworksSalesforce
Elastic	6 lists	Adobe Inc.Hewlett Packard EnterpriseMotorola SolutionsPalo Alto NetworksThomson Reuters
Zendesk	6 lists	Adobe Inc.DatadogGen DigitalMotorola SolutionsPalo Alto Networks
ServiceNow	5 lists	AccentureFair IsaacMotorola SolutionsServiceNowZebra Technologies
Mailgun	5 lists	DatadogPalo Alto NetworksSalesforceShopifyTrimble Inc.
Snowflake	4 lists	Adobe Inc.CiscoDatadogHewlett Packard Enterprise
Akamai	4 lists	Adobe Inc.Gen DigitalOracle CorporationSalesforce
MongoDB	4 lists	Adobe Inc.Palo Alto NetworksSalesforceZebra Technologies
Splunk	4 lists	Adobe Inc.CiscoFair IsaacMotorola Solutions
Slack	4 lists	Adobe Inc.FortinetNebius GroupPalo Alto Networks
Anthropic	4 lists	DatadogMicrosoftPalo Alto NetworksShopify
Pendo.io	4 lists	Palo Alto NetworksSalesforceThomson ReutersZebra Technologies
CrowdStrike	3 lists	Adobe Inc.Motorola SolutionsTrimble Inc.
SendGrid	3 lists	Adobe Inc.IntelTrimble Inc.
Concentrix	3 lists	Adobe Inc.Dell TechnologiesGen Digital
Intercom	3 lists	Adobe Inc.Motorola SolutionsPalo Alto Networks
Khoros	3 lists	Adobe Inc.CiscoFair Isaac
Amplitude	3 lists	Gen DigitalServiceNowTrimble Inc.
HubSpot	3 lists	Gen DigitalMotorola SolutionsNebius Group
Cisco	3 lists	GoDaddyMotorola SolutionsPTC Inc.
Gainsight	3 lists	FortinetPalo Alto NetworksTrimble Inc.
Palo Alto Networks	3 lists	Alphabet Inc.Motorola SolutionsPalo Alto Networks
SAP SE	2 lists	AccenturePalo Alto Networks
Fastly	2 lists	Adobe Inc.Salesforce
New Relic	2 lists	Adobe Inc.Cisco
Databricks	2 lists	Adobe Inc.Zebra Technologies
Sinch	2 lists	Adobe Inc.Motorola Solutions
Teleperformance	2 lists	Adobe Inc.Gen Digital
Adobe	2 lists	Adobe Inc.Motorola Solutions
Equinix	2 lists	CiscoThomson Reuters
Pendo	2 lists	CiscoFortinet
Zoom	2 lists	Fair IsaacPalo Alto Networks
Apple	2 lists	Gen DigitalMotorola Solutions
Broadcom	2 lists	Gen DigitalMotorola Solutions
Intel	2 lists	Gen DigitalPalo Alto Networks
Ivanti	2 lists	Gen DigitalMotorola Solutions
LexisNexis	2 lists	Gen DigitalMotorola Solutions
SpyCloud	2 lists	Gen DigitalPalo Alto Networks
Stripe	2 lists	GoDaddyShopify
HPE	2 lists	Hewlett Packard EnterpriseMotorola Solutions
Sunguard	2 lists	Hewlett Packard EnterpriseThomson Reuters
Heroku	2 lists	Motorola SolutionsSalesforce
Zapier	2 lists	Motorola SolutionsServiceNow
PagerDuty	2 lists	Motorola SolutionsPalo Alto Networks
IBM	2 lists	Motorola SolutionsPalo Alto Networks
ClickHouse	2 lists	Palo Alto NetworksSalesforce
Functional Software, Inc.	2 lists	Nebius GroupPalo Alto Networks
Cognizant Worldwide	2 lists	Alphabet Inc.Salesforce
Sumo Logic	2 lists	SalesforceTrimble Inc.
Nebius	2 lists	Nebius GroupShopify

Figure 5 · Source: company subprocessor lists and privacy pages, captured 2026-10-05.

The longest lists

Published lists ranked by row count.

Default order: most rows first. An editorial choice; use the column headers to re-sort.

The longest lists
		Source
Alphabet Inc.GOOGL/GOOG	157	Open the published list
Palo Alto NetworksPANW	107	Open the published list
Motorola SolutionsMSI	96	Open the published list
Adobe Inc.ADBE	80	Open the published list
Gen DigitalGEN	73	Open the published list
AccentureACN	69	Open the published list
ServiceNowNOW	68	Open the published list
SalesforceCRM	62	Open the published list
F5, Inc.FFIV	39	Open the published list
Dell TechnologiesDELL	38	Open the published list
Hewlett Packard EnterpriseHPE	38	Open the published list
ShopifySHOP	34	Open the published list
Zebra TechnologiesZBRA	33	Open the published list
Meta PlatformsMETA	32	Open the published list
CiscoCSCO	31	Open the published list
GoDaddyGDDY	27	Open the published list
Fair IsaacFICO	26	Open the published list
Nebius GroupNBIS	20	Open the published list
Trimble Inc.TRMB	20	Open the published list
Thomson ReutersTRI	15	Open the published list
DatadogDDOG	13	Open the published list
PTC Inc.PTC	7	Open the published list
FortinetFTNT	6	Open the published list
Palantir TechnologiesPLTR	6	Open the published list
Akamai TechnologiesAKAM	4	Open the published list
Oracle CorporationORCL	4	Open the published list
IntelINTC	3	Open the published list
IntuitINTU	3	Open the published list
MicrosoftMSFT	2	Open the published list
QualcommQCOM	2	Open the published list

Figure 6 · Source: company subprocessor lists and privacy pages, captured 2026-10-05.

The 58 empty chairs

Companies where no usable public list was found, and what the search turned up.

The 58 empty chairs
			Search trail
Advanced Micro DevicesAMD	Semiconductors	None found	Show search trail web search 'AMD subprocessor list data processing' - returned only chip specification pages and product marketing, no DPA or subprocessor list web search 'AMD data protection addendum OR data processing agreement privacy amd.com subprocessor' - no AMD DPA or subprocessor list surfaced; AMD operates as a hardware vendor/controller with no public processor disclosure
Akamai TechnologiesAKAM	Other	Partial list (4)	Show search trail
AmphenolAPH	Hardware & Devices	None found	Show search trail web search 'Amphenol subprocessor list' - returned only connector datasheets and distributor catalogs, no DPA or subprocessor list web search 'Amphenol privacy policy data processing addendum subprocessor GDPR' - surfaced subsidiary privacy policies (Amphenol Procom, Amphenol Limited UK) with no subprocessor disclosure or DPA
Analog DevicesADI	Semiconductors	None found	Show search trail web search 'Analog Devices subprocessor list' - returned only product line cards and distributor listings, no DPA or subprocessor list web search 'Analog Devices privacy policy subprocessor data processing addendum' - surfaced the ADI privacy policy at analog.com/en/who-we-are/legal-and-risk-oversight/data-privacy/privacy-policy.html (ADI acts as data controller; no processor subprocessor disclosure)
Apple Inc.AAPL	Hardware & Devices	None found	Show search trail web search 'Apple subprocessor list data processor DPA' - returned only Apple silicon spec pages and unrelated DPAs, no Apple-published list web search 'Apple sub-processors business DPA Apple Business Manager privacy' - no Apple-published subprocessor list; Apple acts as data controller and does not publish a customer-facing subprocessor list
Applied MaterialsAMAT	Semiconductors	None found	Show search trail web search 'Applied Materials subprocessor list' - returned only semiconductor equipment news, no DPA or subprocessor list web search 'Applied Materials privacy policy data processing addendum GDPR subprocessor' - no DPA or subprocessor disclosure surfaced; AMAT is a fab equipment vendor/controller with no public processor disclosure
AppLovinAPP	Software & SaaS	None found	Show search trail https://legal.applovin.com/applovin-platform-data-processing-agreement/ and https://legal.applovin.com/applovin-demand-partner-data-processing-agreement/ - DPA covers (sub-)processor transfers only at category level ('Service providers that AppLovin uses to provide the Services'); parties defined as independent controllers https://legal.applovin.com/privacy/ - fetched full privacy policy (effective Aug 2026); 'Service Providers' named only by category (technical infrastructure, analytics, customer service, payments); advertising partners are independent controllers, not subprocessors https://legal.applovin.com/applovin-partners-privacy/ - partner list covers independent-controller advertising partners
Arista NetworksANET	Hardware & Devices	None found	Show search trail web search 'Arista Networks subprocessor list' - returned only switch datasheets and market news, no DPA or subprocessor list web search 'Arista CloudVision data processing addendum sub-processor' - returned unrelated vendor DPAs; no Arista CloudVision DPA or subprocessor list surfaced
Arm HoldingsARM	Semiconductors	None found	Show search trail https://www.arm.com/-/media/Files/pdf/policies/data-procession-agreement.pdf - Arm's DPA is supplier-facing (Arm as controller; Schedule 3 lists the SUPPLIER's approved sub-processors, not Arm's own) https://www.arm.com/company/policies/privacy and https://www.arm.com/company/policies/privacy/california - fetched search content; sharing described only by category ('Third party service providers ... in order for these third parties to provide services on behalf of Arm') Finding: Arm publishes no subprocessor list for its own processing
ASML HoldingASML	Semiconductors	None found	Show search trail https://www.asml.com/en/privacy/privacy-notice-for-business-partners-and-visitors - fetched; no subprocessor names, only rights notices search: asml.com privacy policy subprocessors - no DPA or subprocessor page on asml.com Finding: ASML publishes no named subprocessor list
Astera LabsALAB	Semiconductors	None found	Show search trail https://asteralabs.com/privacy-policy/ - fetched full policy (updated May 2019); disclosure names only categories ('Agents, Consultants and Related Third Parties'); no named list search: Astera Labs subprocessor list data processing - no DPA/trust page found Finding: Astera Labs publishes no named subprocessor list
AutodeskADSK	Software & SaaS	None found	Show search trail Autodesk EU Data Act Handbook (damassets.autodesk.net/content/dam/autodesk/www/pdfs/autodesk-eu-data-act.pdf) states: 'Autodesk makes available on its website the vendors or sub processors it uses globally', but no URL is given in the document web searches for the page (site:autodesk.com variants, 'Autodesk' sub-processors AWS Snowflake, Autodesk DPA FAQ, Autodesk trust center sub-processors) did not surface the actual list URL; autodesk.com/trust-center fetch returned empty Autodesk SOC 2 report (socthree.com) names subservice organizations AWS, MongoDB, Snowflake, SentinelOne, CrowdStrike, Microsoft Entra ID/MS Authenticator, but that is an audit report, not the published sub-processor list. Autodesk DPA FAQ/Trust Center page remains undiscovered - possible transparency gap or hard-to-find page, flagged for a live-browser follow-up
BroadcomAVGO	Semiconductors	None found	Show search trail https://www.broadcom.com/company/legal/privacy - fetched 2026-10-04; the privacy hub shows a 'Third Party List' page covering Broadcom entities and third-party suppliers for software products and services, but the text fetch exposed no link URL for it, so the page could not be opened https://www.broadcom.com/company/legal/privacy/subprocessors - HTTP 404 on 2026-10-04; this URL is cited as the live subprocessor list in Broadcom's own product transparency notices on docs.broadcom.com https://techdocs.broadcom.com/us/productcontent/admincontent/subprocessorlist.html - HTTP 404 on 2026-10-05; this URL is cited as the subprocessor list in Broadcom's CA data processing addendum
Cadence Design SystemsCDNS	Software & SaaS	None found	Show search trail Targeted searches 'Cadence subprocessor list' and 'Cadence Design Systems data processing addendum subprocessor list privacy' on 2026-10-04 and 2026-10-05 returned unrelated results only (business-wire press releases, other companies' DPAs such as Cordance and Kadence); no Cadence-owned list found cadence.com privacy and legal pages checked via targeted search; no DPA or trust center page with a subprocessor list surfaced
CDW CorporationCDW	Hardware & Devices	None found	Show search trail CDW Data Processing Agreement PDF (https://webobjects2.cdw.com/is/content/CDW/cdw/on-domain-cdw/reference-material/website-terms-conditions-data-processing-agreement-2023.pdf): Section 9 'Subprocessors' permits subcontracting but names no published list Targeted search 'CDW Corporation subprocessor list data processing agreement privacy policy' on 2026-10-05 returned only the DPA PDF and unrelated third-party DPAs; no CDW-owned published list found
CienaCIEN	Hardware & Devices	None found	Show search trail Ciena Supplier Guidelines (https://media.ciena.com/documents/Supplier_Guidelines.pdf): the sub-processing clause only requires Ciena's suppliers to provide Ciena with a list on request; this is a supplier obligation, not a public Ciena customer subprocessor list Targeted searches 'Ciena subprocessor list data processing addendum privacy policy' on 2026-10-04 and 2026-10-05 returned no Ciena-owned published list
CognizantCTSH	IT Services	None found	Show search trail cognizant.com privacy notices (associate and candidate notices) checked via search; they contain no subprocessor list Targeted search 'Cognizant subprocessor list data protection privacy notice cognizant.com' on 2026-10-05 surfaced Cognizant only as a subprocessor named on other companies' lists (Google, Pega, Docusign); no Cognizant-owned published list found
Coherent Corp.COHR	Hardware & Devices	None found	Show search trail Coherent Corp. Website Privacy Notice (custouch-hosted PDF): standard supplier language, no named subprocessor list Targeted search 'Coherent Corp subprocessor list data processing addendum privacy' on 2026-10-05 returned unrelated results (Cohere trust center, Accruent DPA); no Coherent-owned list found
CoreWeaveCRWV	Cloud & Infrastructure	None found	Show search trail https://docs.coreweave.com/policies/terms-of-service/privacy-policy - fetched full policy; sharing described only by category ('Vendors and Service Providers'); names only Google Analytics search: CoreWeave data processing agreement privacy subprocessor and coreweave data processing addendum subprocessor docs.coreweave.com - no published DPA or subprocessor list found Finding: CoreWeave publishes no named subprocessor list
Corning Inc.GLW	Hardware & Devices	None found	Show search trail Corning Global Data Protection Policy (https://www.corning.com/media/worldwide/global/documents/Global_Data_Protection_Policy.pdf): mentions 'Recipients or categories of Recipients' only, no named subprocessor list Corning Data Privacy Policy (https://www.corning.com/content/dam/corning/media/worldwide/global/documents/Data_Privacy_policy.pdf): discusses supplier obligations generally, no named subprocessor list Targeted search 'Corning Inc subprocessor list data processing addendum privacy policy' on 2026-10-05 returned no Corning-owned published list
CrowdStrikeCRWD	Software & SaaS	None found	Show search trail Targeted searches on 2026-10-04 and 2026-10-05 ('CrowdStrike subprocessor list Falcon', 'CrowdStrike sub-processor policy Falcon data processing agreement list of subprocessors', 'CrowdStrike data processing addendum subprocessor notification trust center') surfaced CrowdStrike only as a subprocessor named on other companies' lists (UKG, Netlify, Precisely, Ping Identity, commercetools, Optiv, NCC Group, A10, Genesys, Fenix24, CIS, Trimble); no CrowdStrike-owned list found https://www.crowdstrike.com/dataprotectionagreement - HTTP 404 on 2026-10-05; this URL is cited in CrowdStrike's UK G-Cloud terms as its Data Protection Addendum location
DoorDashDASH	E-commerce & Marketplaces	None found	Show search trail web search 'DoorDash subprocessor list' - only Openli vendor-assessment page, no DoorDash-published list opened https://explore.openli.com/privacy/doordash/subprocessors - assessment framework only, no subprocessor names listed web search 'doordash.com sub-processors list data processing' - no doordash.com list page found
EverpureP	Hardware & Devices	None found	Show search trail https://www.everpuredata.com/legal/data-processing-addendum.html - company verified real: formerly Pure Storage (NYSE: PSTG), rebranded to Everpure Feb 2026, ticker changed to P Apr 2026, HQ Santa Clara CA. DPA (last updated July 28, 2026) section 5 authorizes only 'those Subprocessors listed in Everpure's Annex 1 to the Standard Contractual Clauses, attached as Exhibit 3', but Annex I.A on the public page is not populated with any named subprocessors; no standalone subprocessor list found on everpuredata.com trust center or legal pages.
First SolarFSLR	Hardware & Devices	None found	Show search trail web search 'First Solar subprocessor list' - no company-published list found; results were SolarWinds/Firstup/Reflektive lists and trade data, nothing from firstsolar.com web search 'First Solar privacy policy data processing agreement subprocessor' - no DPA or subprocessor list on firstsolar.com surfaced; only SEC filings and unrelated DPAs web search 'firstsolar.com privacy policy sub-processor data protection' - no published list found
Flex Ltd.FLEX	Other	None found	Show search trail web search 'Flex Ltd subprocessor list flex.com data protection addendum' - no flex.com list; hits were unrelated (Flexera, FlexFactor, Flex HRM) web search 'flex.com subprocessor OR sub-processor list' - no flex.com-published list; hits were Flexera community page and Flexopus web search 'Flex flex.com privacy policy data processing agreement sub-processor' - no published list on flex.com
GartnerIT	IT Services	None found	Show search trail web search 'Gartner subprocessor list' - no Gartner-published list found; results were unrelated companies' lists web search 'gartner.com data processing addendum sub-processor' - no gartner.com DPA/subprocessor page found web search 'Gartner data processing agreement gartner.com legal' - found Gartner's Information Security at Gartner whitepaper (describes DPA practices, no named list); no public subprocessor list
HP Inc.HPQ	Hardware & Devices	None found	Show search trail https://www.hp.com/content/dam/sites/worldwide/privacy/pdf/dpa/2025/EN.pdf - HP Data Processing Agreement for HP Services, sec 4.1: HP shall make available to Customer the current list of Subprocessors for the Services. No public list URL given; list is provided to customers, not published publicly. web search 'HP Inc subprocessor list DPA' - only DPA PDFs returned, no published list page found. web search 'HP subprocessor list site:hp.com trust' - no list page; only DPA and unrelated support pages.
IBMIBM	Other	Login-walled	Show search trail https://www.ibm.com/services/us/dpa/ (IBM DPA hub, referenced in IBM DPA exhibits) - fetch blocked with HTTP 403; instructed not to retry. web search 'IBM subprocessor list ibm.com trust center' - no published consolidated list found; IBM publishes per-offering subprocessor info in DPA exhibits and Software Product Compatibility Reports. https://www.ibm.com/docs/en/order-management?topic=regulations-general-data-protection-regulation-gdpr-support - IBM Sterling Order Management GDPR page states 'IBM does not use sub-processors for Sterling Order Management System processing' (a no-subprocessor statement, not a list).
JabilJBL	Hardware & Devices	None found	Show search trail web search 'Jabil subprocessor list data processing privacy trust center' - no published list found; only supplier-side security requirements mentioning the term subprocessor. web search 'Jabil data processing agreement OR privacy notice subprocessor jabil.com' - no DPA or subprocessor list; openli.com privacy pages for Jabil Incontrol and Jabil Nypro Healthcare reference the concept but list no subprocessors.
Keysight TechnologiesKEYS	Hardware & Devices	None found	Show search trail web search 'Keysight Technologies subprocessor list data processing addendum' - no published list found. web search 'Keysight data processing addendum OR Data Processing Agreement keysight.com' - no DPA or subprocessor list found. web search 'Keysight PathWave OR Keysight Care data processing addendum subprocessor pdf' - only product datasheets and EULAs, no DPA or subprocessor list.
KLA CorporationKLAC	Semiconductors	None found	Show search trail web search 'KLA Corporation subprocessor list data processing privacy' - no published list; only KLA Data Protection Standards (http://www.KLA-Tencor.com/documents/2023/KLA_Data_Protection_Standards.pdf), which are requirements KLA imposes on its suppliers, not a list of KLA's own subprocessors. web search 'KLA data processing agreement subprocessor kla.com OR kla-tencor.com GDPR' - same Standards document only; career site privacy policies list no subprocessors.
Lam ResearchLRCX	Semiconductors	None found	Show search trail web search 'Lam Research subprocessor list data processing agreement privacy' - no published list found. web search 'Lam Research trust center OR DPA OR data processing addendum pdf' - no DPA or subprocessor list found.
LumentumLITE	Hardware & Devices	None found	Show search trail web search 'Lumentum subprocessor list data processing privacy policy DPA' - no published list; results were for Lumen Technologies (different company), not Lumentum. web search 'Lumentum data processing addendum OR DPA lumentum.com pdf' - no Lumentum DPA or subprocessor list found. web search 'Lumentum privacy policy cookies subprocessors site:lumentum.com' - zero results.
Marvell TechnologyMRVL	Semiconductors	None found	Show search trail https://www.marvell.com/data-processing-agreement.html - DPA is bare EU Standard Contractual Clauses; Clause 9 gives general written authorisation for an 'agreed list' of sub-processors but no public list is linked or named. https://www.marvell.com/privacy-statement.html - website privacy policy has no subprocessor list or DPA reference. Web searches for 'Marvell subprocessor list' and 'marvell.com subprocessor' returned no published list (only privacy notices and the DPA).
Microchip TechnologyMCHP	Semiconductors	None found	Show search trail microchip.com: privacy policy, career-site privacy and cookie statements found; no DPA or subprocessor list on the official site. Web searches for 'Microchip Technology subprocessor list' returned no published list (results were unrelated: pet microchip registries, supplier codes of conduct). explore.openli.com hosts a vendor privacy page for Microchip but its subprocessor tab exposed no names publicly (direct fetch returned 403).
Micron TechnologyMU	Semiconductors	None found	Show search trail micron.com: employment privacy notices and country privacy supplements found; no DPA or subprocessor list. Web searches for 'Micron Technology subprocessor list' returned nothing for Micron Technology (a litera.com page titled 'Subprocessors for Micron Products' is Litera's legal-software product line, not Micron Technology).
Monolithic Power SystemsMPWR	Other	None found	Show search trail monolithicpower.com: Privacy Policy, Privacy and Cookie Policy, and Job Application Privacy Policy found; no DPA or subprocessor list. Web searches for 'Monolithic Power Systems subprocessor list' returned no published list (only third-party PESTLE/GDPR analyses).
NetAppNTAP	Hardware & Devices	Login-walled	Show search trail https://kb.netapp.com/cs/General_Support/What_subprocessors_does_NetApp_use_to_deliver_services - NetApp's own KB article states the subprocessor list lives on TrustShare at https://netapp-security.trustshare.com/subprocessors and that 'Customers and partners need to create an account and accept NetApp NDA before viewing certain content'. List exists but is not publicly published. assets.netapp.com Customer Data Processing Addendum says the subprocessor list is posted to a 'Customer-accessible site (the Agreed List)', not a public page. Web searches for a public NetApp subprocessor list returned no public copy.
NvidiaNVDA	Semiconductors	None found	Show search trail https://www.nvidia.com/en-us/about-nvidia/privacy-policy/feb2025/ (effective Feb 3 2025) - full privacy policy read; no subprocessor list or DPA section. NVIDIA Privacy Center (nvidia.com/en-us/privacy-center/) references privacy rights but no subprocessor list. Web searches for 'nvidia subprocessor list published' returned only third-party documents naming NVIDIA as THEIR subprocessor (e.g. accessguard TIA, OneHillAI AOI); no NVIDIA-published list found.
NXP SemiconductorsNXPI	Semiconductors	None found	Show search trail explore.openli.com/privacy/nxp - NXP's vendor privacy page (powered by Openli) has a 'Subprocessors' section, but the names are not publicly rendered (page shell fetched with no list content). https://www.nxp.jp/docs/en/supporting-information/NXP-DTA-PROT-TERMS-PDF.pdf - NXP Data Protection Terms (04-2025) reference approved subprocessors under general written authorisation, but name no public list. Web searches for an NXP-published subprocessor list of names returned no public list.
ON SemiconductorON	Semiconductors	None found	Show search trail onsemi.com: human rights policy references an 'onsemi Privacy Policy' and job-applicant privacy notices exist; no DPA or subprocessor list found on the official site. Web searches for 'onsemi subprocessor list' and 'onsemi privacy policy GDPR data processing agreement' returned no published list (results were employment forms and third-party PDFs).
PDD HoldingsPDD	E-commerce & Marketplaces	None found	Show search trail web search 'Temu PDD Holdings subprocessor list' - no PDD or Temu published list web search 'Temu sub-processor list temu.com' - only seller-eu.temu.com DPA Appendix 4, which governs SELLERS' subprocessors (Seller warrants and notifies Temu), not Temu's own list opened Temu UK privacy policy (https://www.temu.com/uk/privacy--policy.html) - names only categories (payment processors, logistics providers, mapping platforms, advertising partners), no vendor list; no sub-processor mentions
Qnity ElectronicsQ	Hardware & Devices	None found	Show search trail https://qnity.com/privacy-policy - full privacy policy read; names no subprocessors, only generic 'third party service providers' for data storage, retrieval, backup, newsletters and surveys https://careers.qnityelectronics.com/us/en/qnity-applicant-notice - applicant notice mentions service providers generically, no named list web search 'Qnity subprocessor OR subprocessors privacy policy' - no trust center, DPA, or subprocessor list found
Roper TechnologiesROP	Software & SaaS	None found	Show search trail https://www.ropertech.com/policies/ - page read; contains only a cookie policy, no privacy policy, DPA, or subprocessor list web search 'Roper Technologies subprocessor list' - no results; only SEC filings and stock analysis web search '"Roper" subprocessor OR subprocessors ropertech.com privacy' - no results
SandiskSNDK	Hardware & Devices	None found	Show search trail web search 'Sandisk subprocessor list' - no results; only applicant privacy notices web search 'Sandisk data processing addendum subprocessors privacy' - applicant privacy notices found; no DPA or subprocessor list web search '"sandisk" sub-processor OR subprocessor list' - no list; only a Sandisk controller-to-processor SCC template on documents.sandisk.com that references an 'agreed list' without publishing it
Seagate TechnologySTX	Hardware & Devices	None found	Show search trail web search 'Seagate subprocessor list' - no results; only product docs web search 'Seagate Lyve cloud subprocessor list data processing' - product/marketing pages only, no DPA or subprocessor list web search 'Seagate "subprocessor" privacy policy list' - Seagate publishes supplier/controller DPAs (e.g. https://www.seagate.com/content/dam/seagate/assets/legal/privacy/data-privacy-agreement/files/2025-07(Jul)-31_seagate-controller-dpa_4.published.pdf) requiring suppliers to maintain lists, but Seagate itself publishes no subprocessor list
Skyworks SolutionsSWKS	Semiconductors	None found	Show search trail https://www.skyworksinc.com/Articles/Privacy-Policy - fetched full Website Global Privacy Policy (last updated 8/31/2026): discloses personal information to unnamed third-party vendors and service providers acting on Skyworks' behalf, no published subprocessor list anywhere on the page web search 'Skyworks Solutions subprocessor list' - no published list found, only unrelated product news web search 'Skyworks data processing agreement sub-processor site:skyworksinc.com' - only an SEC merger filing, no list
Strategy Inc.MSTR	Software & SaaS	None found	Show search trail web search 'Strategy MicroStrategy subprocessor list' - found DPA references to list at community.microstrategy.com/s/article/GDPR-Cloud-Sub-Processors Strategy Cloud (MCE) Service Guide DPA (assets.contentstack.io PDF) confirms the list is maintained at community.microstrategy.com/s/article/GDPR-Cloud-Sub-Processors direct text fetch of that article URL failed (HTTP 403); that request is not retried
SupermicroSMCI	Hardware & Devices	None found	Show search trail web search 'Supermicro subprocessor list GDPR' - no published list found, only generic GDPR explainer results web search 'Supermicro data processing agreement sub-processor site:supermicro.com' - no list found on supermicro.com web search '"Supermicro" sub-processor data processing' - no published list found (only third-party Openli privacy-assessment page)
SynopsysSNPS	Software & SaaS	None found	Show search trail https://www.synopsys.com/company/legal/dpa-supplement.html - DPA Supplement clause 9 references engagement of sub-processors from 'an agreed list' but publishes no list https://www.synopsys.com/content/dam/synopsys/company/about/legal/synopsys-data-privacy-and-protection-statement-15Jul2023.pdf - states Synopsys does not typically process personal data on customers' behalf, only rare processor cases; no published subprocessor list web search 'Synopsys subprocessor list' - no list on synopsys.com; note Synopsys sold its software integrity (Black Duck) business in 2024, remaining business is primarily EDA hardware/software licensing
TE ConnectivityTEL	Hardware & Devices	None found	Show search trail https://te.com/en/policies-agreements/privacy-policy.html - fetched privacy policy: names Microsoft Clarity as a GDPR Art. 28 processor, no published subprocessor list https://supplier.te.com/documents/8614675/0/Jurisdiction+Specific+Privacy+Terms+2021.10.25.pdf - Data Protection Addendum where TE is the controller, not a subprocessor disclosure web searches 'TE Connectivity subprocessor list' and '"TE Connectivity" "sub-processor" GDPR' - no published list found
Teledyne TechnologiesTDY	Hardware & Devices	None found	Show search trail https://www.teledyne.com/privacy-policy - privacy notice mentions third-party service providers generically, no published subprocessor list web search 'Teledyne Technologies subprocessor list GDPR' - no list found web search 'Teledyne data processing addendum subprocessor site:teledyne.com' - no results
TeradyneTER	Semiconductors	None found	Show search trail https://www.teradyne.com/privacy-policy/ - fetched full privacy policy: lists Teradyne Affiliates and generic third-party service providers, no sub-processor list (text search for 'sub-processor' returned zero matches) web search 'Teradyne subprocessor list' - no published list found web search 'Teradyne data processing agreement subprocessor site:teradyne.com' - no list found
Texas InstrumentsTXN	Semiconductors	None found	Show search trail web search 'Texas Instruments subprocessor list' - no published list found, only chip product news web search '"Texas Instruments" data processing addendum ti.com subprocessor' - no list on ti.com web search 'Texas Instruments privacy policy subprocessor TI cloud' - only generic privacy/HR documents
Tyler TechnologiesTYL	Software & SaaS	None found	Show search trail https://www.tylertech.com/about-us/security-compliance/gdpr-compliance - fetched GDPR compliance page: states client data hosted on AWS servers in Ireland, no published subprocessor list https://www.tylertech.com/privacy - fetched privacy page: discloses personal data to unnamed 'sub-processors or service providers' and Tyler affiliates, names no sub-processor list web searches 'Tyler Technologies subprocessor list GDPR DPA' and '"Tyler Technologies" "sub-processors" list GDPR' - no published list found
VerisignVRSN	Cloud & Infrastructure	None found	Show search trail https://verisign.com/assets/Version_3.3_Privacy_Statement.pdf - fetched full privacy statement (v3.4, Jul 2024); sharing section names only categories (registrars, business partners); text search for 'subprocessor' returned zero hits search: verisign privacy center data processing addendum subprocessor - only third-party aggregator pages (explore.openli.com) and unrelated DPAs (Verizon, vsi-group.net) search: 'verisign' subprocessor verisign.com data processing - no company-published list found
Western DigitalWDC	Hardware & Devices	None found	Show search trail https://www.westerndigital.com/legal/privacy-statement - disclosure section names only categories ('service providers and other companies' for website hosting, email, marketing, payment processing, cloud storage); no named list search: Western Digital wdc.com data processing addendum subprocessor privacy - no DPA or subprocessor page found; applicant privacy notices also category-level Finding: Western Digital publishes no named subprocessor list
Workday, Inc.WDAY	Software & SaaS	Login-walled	Show search trail https://www.workday.com/en-us/legal/subprocessors.html - page EXISTS with sections 'Workday subprocessors for enterprise cloud applications' and 'for professional services', but actual subprocessor names render only via JS and customer login; text fetch returned only marketing copy Workday DPA/UDPE docs (workday.com PDFs): define Subprocessor List as 'accessible through Workday's customer website (currently located at: https://community.workday.com)' - i.e. customer-portal gated Finding: the list is published but gated to customers via login; not retrievable as a public list

Figure 7 · Source: company subprocessor lists and privacy pages, captured 2026-10-05.

Fifty-eight companies publish no usable list. This is the thread I keep coming back to. We expected every company to have a list: GDPR Article 28(2) requires processors to disclose subprocessor additions and replacements, and the public list is the standard way to do it. Twenty-nine companies had one. Fifty-eight did not, and that is after exhaustive search, with a search trail for each one so the absence is a finding, not a shrug.

The missing ones are not random. They are mostly hardware and semiconductor firms: AMD, Nvidia, Micron, Applied Materials, ASML, Corning. Plus Apple. Their posture is controller-side privacy policies with no processor disclosure at all. Now, the fair counterargument: a chipmaker that sells you silicon is not your processor, so Article 28(2) arguably never fires. That reads fine until you remember the same companies sell cloud services, developer platforms, and managed offerings where they absolutely are processors. The legal read and the business reality are pulling in different directions, and nobody has published a number on which one wins.

A smaller wrinkle: some lists exist but sit behind logins. Workday, NetApp, and IBM gate theirs. A controller doing due diligence hits a login wall, which is a strange place for a transparency mechanism to live.

The longest lists tell their own story. Alphabet’s runs to 157 rows. Palo Alto Networks: 107. Motorola Solutions: 96. Adobe: 80. Length is not virtue. A long list can mean sprawl. But it does mean someone did the inventory. The 58 empty chairs are the louder signal.

So what do you do with this? If you run vendor reviews, pull your top ten vendors’ lists this week and diff them against what you thought you had. Look one level down, not just at the logo on the contract. And ask the awkward question in your next renewal: which AI models sit inside this product, and when did they get there?

One thing I could not resolve: how many controllers actually audit these lists against their own records, versus filing the vendor’s PDF and moving on. If you have a number on that, I want to hear it.

How we counted

The index covers 87 companies: the S&P 500 IT sector plus the Nasdaq-100 tech names outside it. A company counts as publishing a list when its public subprocessor list could be captured as rows; 29 cleared that bar. One more, Akamai, counts as partial: its main list blocked automated retrieval, so only 4 rows from its Linode-specific list were captured. The remaining 57 break down as 54 with no list found and 3 whose lists sit behind logins (Workday, NetApp, IBM). “Named in N lists” means N of the 29 published lists had at least one row matching that vendor’s family of names (Microsoft includes Azure, Google includes GCP, AWS includes Amazon); matching runs on the subprocessor name field only, and counts include companies naming their own affiliates (Alphabet’s list names dozens of Google entities, for instance). Of the 1,400 second-level edges, 572 are marked synthesized: inferred from an index company’s own published list rather than captured from a separate page, and tagged as synthesized wherever they appear. Snapshot date: October 5, 2026. Lists change, some captured lists are excerpts, and a raw-data entry labeled “SpaceXAI” was normalized to xAI. The second level covers the vendors’ own vendors (Twilio’s 40-row list and the 64 affiliates on AWS’s list, both researched as shared subprocessors); it lives in the network map’s side panel, not the tables.

Legal note

This article is built from subprocessor lists and privacy policies that were publicly available on October 5, 2026. Companies change these lists without notice, so read every number as a snapshot, not a live record. We searched each company exhaustively and kept a record of every search, but a list we could not find may still exist behind a login, in another language, or under a different name. Absence from this index is a finding about what is publicly available, not a verdict on how a company handles data. Company names appear for identification only. This is general information for people who run vendor reviews, not legal advice for your situation. If you spot an error, or your company’s list has moved, contact us and we will correct it.

Your AI vendor has vendors

Company (87)

Shared subprocessor (60)

The strongest links, as text

The most-named subprocessors

29 publish. 58 do not.

The 87 companies

The most-named subprocessors

The longest lists

The 58 empty chairs

How we counted

Legal note

Company (87)

Shared subprocessor (60)

The strongest links, as text

The most-named subprocessors

29 publish. 58 do not.

The 87 companies

The most-named subprocessors

The longest lists

The 58 empty chairs

How we counted

Legal note

Related insights

Work with Mohammad on this topic