What should we look for on the list?

Who provides the model, since for an AI product that is where your material actually goes to be worked on. Then whether each entry says what it is for, where each sits, and what notice you get before the list changes. Those four make it a useful document rather than a formality.

Why does this matter more for AI tools?

Because the model behind a product frequently belongs to a different company, so the handling answers you obtained from your vendor have a second set behind them. That is normal and disclosed, and it is one hop further than most buyers picture when they satisfy themselves about a product.

What can we do with the notice?

Subscribe to it, which usually costs nothing, and look at additions when they arrive. Most will be unremarkable, and the value is that a change in where your material goes becomes something you saw rather than something you would have to reconstruct later.

Glossary

Sub processor

Another company your vendor passes your material to in order to deliver the service, named on a list the vendor publishes and updates.

In plain terms

Your vendor does not do everything itself. It rents infrastructure, uses an email service, and for AI tools very often calls a model made by somebody else. Each of those companies touches your material in order for the service to work, and they are named on a list the vendor publishes. Reading it is the closest a buyer gets to seeing the actual path.

Why it matters

Because for AI tools the list frequently contains the answer to a question the buyer thought was already settled. A team that has satisfied itself about a vendor's handling can find that the model behind the product belongs to a different company under different terms, which is not concealed and is simply one hop further than most people picture. The list is where that becomes visible, and it takes a minute to read.

How it works

It exists as a published list because notice is the mechanism, and the notice is the part with practical value. Vendors typically say who is on it and undertake to tell you before it changes, which gives a buyer the chance to look at an addition. Whether anybody does look is a different matter, and subscribing to the change notice costs nothing.

For AI products the interesting entry is usually the model provider. A product built on somebody else's model passes your material to that company, so the handling questions you asked your vendor have a second answer behind them. Some vendors negotiate terms with their provider that they then pass on, and asking about that is a reasonable question rather than an awkward one.

The list shows the shape of the service in a way marketing does not. Infrastructure, storage, analytics, support tooling and model providers all appear, and reading it tells you roughly how something is built and where it runs. That is incidentally useful well beyond the compliance purpose it was published for.

A long list is not a bad sign in itself. Any real service uses other services, and a vendor naming a dozen is being ordinary rather than careless. What is worth noticing is whether the entries are named specifically, whether each says what it is for, and whether the notice arrangement is stated, all of which distinguish a maintained list from one written once.

The path a buyer pictures, and the path on the list

The value of this page is almost entirely in prompting one reading of one document, because the document is short and the discovery it produces is frequently significant. A team can complete a thorough review of a vendor, obtain the audit report, read the data agreement and satisfy itself about retention, and still not have noticed that the answers apply to a company that is passing the actual work to another company. That is not a trick and the second company is often the better known of the two. It simply sits one step past where the review was aimed. Reading the list first, rather than last, also improves every other question a buyer asks, because knowing which model provider is involved tells you which set of published commitments is ultimately doing the work.

Seen in the wild

Finding which company's model actually answers when you use an assistant built on somebody else's model.
Notion AI
Checking what a search vendor passes onward before pointing it at internal systems.
Glean
Seeing infrastructure, storage and model providers named for an automation platform that connects to everything else you run.
Make

Common misconceptions

People assume

Our contract is with the vendor, so only the vendor matters.

In fact

The contract is with the vendor and the material reaches the others in order for the service to work. That is why they are named rather than hidden, and why the list is the place a buyer can see the actual path rather than the intended one.

People assume

A long list means they are careless with our data.

In fact

Any real service is built on other services, so a dozen entries is ordinary. What distinguishes a good list is specificity, a stated purpose for each entry and a clear notice arrangement, none of which correlates with length.

Questions

What should we look for on the list?: Who provides the model, since for an AI product that is where your material actually goes to be worked on. Then whether each entry says what it is for, where each sits, and what notice you get before the list changes. Those four make it a useful document rather than a formality.
Why does this matter more for AI tools?: Because the model behind a product frequently belongs to a different company, so the handling answers you obtained from your vendor have a second set behind them. That is normal and disclosed, and it is one hop further than most buyers picture when they satisfy themselves about a product.
What can we do with the notice?: Subscribe to it, which usually costs nothing, and look at additions when they arrive. Most will be unremarkable, and the value is that a change in where your material goes becomes something you saw rather than something you would have to reconstruct later.

Key takeaways

Your vendor's vendors touch your material; the list is where that is visible.
For AI products the model provider is usually the entry that matters.
A long list is ordinary; specificity and a notice arrangement are the quality signals.
Subscribing to change notices costs nothing and makes additions visible.

Tools that use this

Notion AI
Which company's model answers inside a product built on somebody else's.
Glean
What is passed onward before search reaches internal systems.
Make
Infrastructure, storage and model providers behind a platform connecting everything.

Last checked July 2026

All glossary terms