Sub-processor

A sub-processor is a third-party vendor that processes your customers' personal data on your behalf — the cloud host, email service, analytics tool, or AI API sitting behind your product. Under GDPR and most enterprise contracts, you (the processor) must disclose your sub-processors, bind them with contractual data-protection terms, and often give customers advance notice before adding new ones. This matters twice over for AI SaaS builders: every model provider you call is a sub-processor handling whatever your users send, and enterprise buyers will scrutinize that chain during procurement. A single unlisted vendor can stall a deal or trigger a compliance finding. Practical note: keep a public sub-processor list with names, purposes, and locations; wire up a notification mechanism (a page plus an email list) for changes; and check each vendor's own DPA and data-residency options before you route customer data through them. Fewer, well-documented sub-processors are easier to sell and audit.