Subprocessor

A Subprocessor is a third-party service provider that processes customer data on behalf of a company as part of delivering its product or service. Subprocessors are typically used to support specific operational functions such as cloud hosting, payment processing, analytics, customer support, or infrastructure management.

For example, a SaaS company may rely on subprocessors for services like cloud infrastructure, email delivery, monitoring, or billing. These vendors may have access to or process customer data while performing their services.

Because subprocessors handle data on behalf of another organization, companies are responsible for ensuring these vendors maintain appropriate security and privacy protections. Many compliance frameworks and privacy regulations—including GDPR, SOC 2, and ISO 27001—require organizations to assess and monitor their subprocessors as part of their vendor risk management practices.

Organizations often maintain a Subprocessor List that discloses the vendors involved in processing customer data. This list is commonly published in a company’s Trust Center to provide transparency to customers and partners.

See how the Openlane Trust Center helps organizations publish and manage their subprocessor disclosures.

Related Topics