What is a sub-processor?

Definition

A sub-processor is a company your vendor hires to process data on its behalf: cloud hosting, transcription, or the AI model provider that writes the summaries. Your data reaches them even though you never signed a contract with them.

Most vendors publish a sub-processor list and promise to notify customers of changes.

Why it matters for advisors

For AI tools, the sub-processor list tells you who actually sees client information. Under amended Regulation S-P you oversee service providers that handle customer information, and that oversight is only meaningful if you know who's in the chain.

Our vendor due diligence guide includes sub-processors among the AI-specific questions a SOC 2 report won't answer.

Most vendors publish a sub-processor list and offer notice of changes. Sign up for those notices and assign someone to read them, since a new sub-processor can mean client data going to a new company or a new country.

Example

Reviewing a CRM's new AI feature, the firm finds it adds an AI model provider to the vendor's sub-processor list, and checks that provider's retention and training terms.

Watch out for

Sub-processor lists change. Sign up for change notices and review them.