Every SaaS company that handles personal data on behalf of its customers relies on other companies to do part of the work: a cloud host, an email provider, a support desk, an AI model. Those companies are its subprocessors, and most B2B software companies publish a list of them. Some put it on a plain page of their website, some inside a DPA, and a fast-growing share inside a trust center run by Vanta, SafeBase or one of a dozen smaller platforms.
To see how this works in practice, we looked for the subprocessor list of 10,379 companies, mostly B2B software and the vendors they rely on, while building the Papertrail directory. This article covers what we found, along with the definitions, the legal background and the questions buyers and vendors ask most.
- companies checked
- 10,379
- publish a subprocessor list
- 35%
- of those lists live in a trust center
- 27%
- of trust-center lists are hosted by Vanta
- 53%
What is a subprocessor?
A subprocessor (also written sub-processor) is a company that processes personal data on behalf of another processor. The chain usually looks like this:
- The controller decides why and how personal data is processed. That is usually your company, the customer of a SaaS product.
- The processor handles that data for the controller. That is the SaaS vendor you signed up with.
- The subprocessor is a third party the processor hires to help deliver its service: the cloud provider that hosts the vendor’s database, the email service that sends its notifications, the AI provider behind its new features.
So when a CRM vendor stores your customer records on Amazon Web Services and sends emails through SendGrid, AWS and SendGrid are subprocessors of that CRM vendor, and indirectly of you.
The term comes from the EU’s General Data Protection Regulation (GDPR), which calls these companies “another processor”. Other privacy laws use similar ideas: the UK GDPR is identical, and US state laws such as the CCPA talk about “service providers” and “contractors” engaged by a service provider.
Why SaaS companies publish a subprocessor list
The obligation comes from Article 28 of the GDPR:
- A processor needs permission to use subprocessors. Under Article 28(2), a processor may not engage another processor without the controller’s prior specific or general written authorisation.
- General authorisation comes with a duty to inform. Most SaaS contracts use general authorisation, because asking every customer to approve each new vendor would be impossible. In return, the processor must tell customers about any intended addition or replacement and give them the chance to object.
- Obligations flow down the chain. Article 28(4) requires the processor to impose the same data protection obligations on each subprocessor, and the processor stays fully liable to the customer for what its subprocessors do.
In practice, the data processing agreement (DPA) grants the general authorisation and points to a list of current subprocessors. Publishing that list on the web is the simplest way to show every customer the same up-to-date information, and it saves the sales and security teams from answering the same question in every security questionnaire.
Where companies publish their subprocessor list
Of the 10,379 companies we checked, 3,641 publish a subprocessor list we could find, either openly or on request. The rest either do not publish one, keep it inside customer contracts, or no longer operate. The most common home for the list is still a plain page on the company’s own website, typically at an address like /subprocessors or /legal/subprocessors.
Each approach has trade-offs:
- A page on the company’s own site (1,678 lists, 46%) is easy to find through search, easy to link from a DPA and easy to update. These lists are also the most detailed, with a median of 16 vendors, often with purpose and location for each.
- A hosted trust center (997 lists, 27%) puts the list next to certifications, policies and security documents. It is the fastest-growing option, and the next section covers it in detail.
- An annex to the DPA (407 lists, 11%) keeps the list inside the contract. It works legally, but every change means a new version of the document, and lists in DPA annexes are the shortest we saw (a median of 8 vendors).
- A section of the privacy policy (296 lists, 8%) is common among smaller companies. We only counted sections that explicitly name the processors. A general list of “tools we use” or cookie providers is not a subprocessor list. This group also has the highest share of lists available only on request (19%), usually because the policy says “a list is available on request” rather than publishing one.
- A PDF document (234 lists, 6%) is popular with large enterprises and groups with many entities. PDFs hold the longest lists, with a median of 21 vendors.
What is a trust center?
A trust center is a public page where a company gathers the information a customer’s security, privacy and procurement teams need before buying: certifications such as SOC 2 and ISO 27001, security and privacy policies, penetration test summaries, data residency details, uptime and incident history, and the list of subprocessors. You will also see it called a trust portal, trust page, security portal or trust centre in British English.
Trust centers grew out of the security questionnaire problem. Instead of filling in the same spreadsheet of questions for every prospect, a vendor publishes the answers once and shares the restricted documents, such as a full SOC 2 report, after the buyer accepts a non-disclosure agreement. Most trust centers live at an address like trust.example.com and are run by a specialist platform rather than built in-house.
For subprocessor lists, a trust center has two practical advantages: the list sits next to the security evidence a buyer is already reviewing, and most platforms let customers subscribe to change notifications, which helps the vendor meet the duty to inform customers before adding a subprocessor.
The trust center market: who hosts subprocessor lists
Of the 997 subprocessor lists we found in hosted trust centers, more than half are on Vanta. SafeBase is a distant second, followed by a long tail of compliance platforms that added trust centers to their products.
A few things stand out:
- Vanta dominates. Vanta hosts 528 of the 997 trust-center lists (53%). Most of them run on the company’s own address, such as
trust.example.com, so a buyer rarely sees the Vanta name, but the layout is easy to recognise once you know it. Vanta sells its trust center alongside its compliance automation product, so companies that use Vanta for their SOC 2 audit tend to publish their trust center there too. - SafeBase is now part of Drata. Drata announced its acquisition of SafeBase in February 2025, and safebase.io now redirects to Drata’s website. Trust centers built on SafeBase keep running on their companies’ own addresses. Together, the two host 175 lists (18% of trust-center lists): 161 on SafeBase and 14 on Drata’s own trust center. SafeBase is also the platform where companies most often keep the subprocessor list behind a request form (18% of its lists, against 9% on Vanta).
- Compliance-platform trust centers fill the long tail. Sprinto (36), Conveyor (28), Oneleet (26), Secureframe (19), Probo (11) and Comp AI (9) each host a meaningful number of lists, usually for smaller software companies that use the same platform for their audits.
- Some trust centers are built in-house or on platforms we could not identify. 116 lists sit in trust centers whose platform we could not determine, often custom pages from larger vendors.
The full breakdown, including platforms with only a handful of lists:
| Platform | Lists | On request | Average size |
|---|---|---|---|
| Vanta | 528 | 47 | 14 vendors |
| SafeBase | 161 | 29 | 14 vendors |
| Sprinto | 36 | 0 | 11 vendors |
| Conveyor | 28 | 1 | 19 vendors |
| Oneleet | 26 | 2 | 13 vendors |
| Secureframe | 19 | 1 | 11 vendors |
| Drata | 14 | 1 | 13 vendors |
| Probo | 11 | 0 | 16 vendors |
| Comp AI | 9 | 1 | 10 vendors |
| HyperComply | 8 | 4 | 18 vendors |
| Thoropass | 6 | 1 | 10 vendors |
| SecurityPal | 5 | 0 | 17 vendors |
| SpotDraft | 5 | 0 | 31 vendors |
| ComplyDog | 4 | 0 | 25 vendors |
| TrustShare | 4 | 1 | 3 vendors |
| Whistic | 3 | 2 | 31 vendors |
| Bastion | 2 | 0 | 10 vendors |
| Delve | 2 | 0 | 3 vendors |
| Mycroft | 2 | 0 | 17 vendors |
| Scrut | 2 | 1 | 5 vendors |
| Anecdotes | 1 | 0 | 6 vendors |
| Noru | 1 | 0 | 6 vendors |
| Orbiq | 1 | 0 | 16 vendors |
| Rippling | 1 | 1 | — |
| TrustCloud | 1 | 0 | 10 vendors |
| Vendict | 1 | 1 | — |
How many companies keep their list behind a request form
Most subprocessor lists are public. Of the 3,641 lists we found, 315 (9%) are available only on request, behind a login, or after signing a non-disclosure agreement. The share depends on where the list lives:
- 6% of lists on a company’s own web page are gated, usually because the page is a customer portal.
- 12% of lists in trust centers are gated, because trust-center platforms make it easy to put any document behind an access request.
- 19% of privacy-policy mentions only offer the list on request.
Gating the list is allowed, since the GDPR only requires that customers are informed. But a list behind a form slows down every security review, and it cannot help prospects who want to check a vendor before talking to sales.
What a good subprocessor list includes
Lists range from a single line (“we use Amazon Web Services”) to hundreds of entries. Across the lists we read, the median list names 13 vendors, and about one in six names five or fewer. The most useful lists share these features:
- The vendor’s name and legal entity. “Google” is less useful than “Google Cloud Platform, Google LLC”, because the legal entity decides which contract and which transfer rules apply.
- What the vendor does. A short purpose such as “cloud hosting”, “transactional email” or “customer support ticketing”.
- Where the data is processed. Countries or regions, so customers can check international transfers.
- The transfer mechanism. For transfers outside the European Economic Area, whether the vendor relies on Standard Contractual Clauses, the EU-US Data Privacy Framework or an adequacy decision.
- The company’s own affiliates. Group companies that process data, such as a support team in another country, count as subprocessors too.
- A “last updated” date and a way to subscribe. Customers need to know when the list changed and how they will be told about future changes. Notice periods of around 30 days before a new subprocessor starts are common in DPAs.
- Separate sections per product or region where the processing differs, rather than one list that mixes them.
How to find a company’s subprocessor list
If you are reviewing a vendor, these steps find the list in almost every case:
- Check the website footer for links named Trust, Security, Legal, Privacy, DPA or GDPR.
- Try the common addresses:
/subprocessors,/sub-processors,/legal/subprocessorsandtrust.followed by the company’s domain. - Search for the company name with “subprocessors” or “sub-processors”. For non-English companies, try the local term, such as Unterauftragsverarbeiter in German or sous-traitants in French.
- Open the DPA. Many DPAs include the list as an annex or link to it.
- Check the parent company. A subsidiary or acquired brand often relies on its parent group’s list.
- Look the company up on Papertrail, which lists each company’s published subprocessors with a link to the original page, or request a company we have not covered yet.
Choosing where to publish your own list
If you run a SaaS company and need to publish or move your subprocessor list, a few principles follow from what we saw:
- Keep it public unless you have a strong reason not to. A public list answers the question before it is asked and shows up when buyers search for it.
- Give it a stable, obvious address. Link it from your DPA, your footer and your trust center, and keep the address when you change tools.
- Use a trust center if you already have one, so the list sits next to your certifications and customers can subscribe to changes. Make sure the list itself is not hidden behind the NDA form meant for your audit reports.
- Date every change and keep a short change history, so customers can see what changed since they last looked.
- Include purpose and location for every entry. Most of the questions customers send about subprocessors are answered by those two columns.
FAQ
What is the difference between a processor and a subprocessor?
A processor handles personal data on behalf of a controller, the customer. A subprocessor handles that data on behalf of the processor. If you use a SaaS help desk, the help desk vendor is your processor, and the cloud provider hosting the help desk is a subprocessor.
Does the GDPR require a public subprocessor list?
No. The GDPR requires a processor to have the controller’s authorisation before using subprocessors and, under a general authorisation, to inform the controller of changes so it can object. Publishing a list online is the most common way to meet that duty for many customers at once, but sharing it privately with each customer also complies.
How often should a subprocessor list be updated?
Whenever a subprocessor is added, replaced or removed. Most DPAs require the vendor to announce new subprocessors in advance, often around 30 days before they start processing data, so customers have time to object.
What is a trust center?
A trust center is a page, usually at trust. followed by the company’s domain, that collects a company’s security and privacy information in one place: certifications, policies, security documents and its subprocessor list. Some documents are public and others are shared after the visitor requests access.
What is the difference between a trust center, a trust portal and a trust page?
They are different names for the same thing. Microsoft calls its version the Service Trust Portal, and British companies often write “trust centre”.
Which trust center platform is the most popular?
For subprocessor lists, Vanta by a wide margin: it hosts 53% of the trust-center lists we found. SafeBase, now owned by Drata, is second with 16%, followed by Sprinto, Conveyor, Oneleet and Secureframe.
Is SafeBase part of Drata?
Yes. Drata announced the acquisition of SafeBase in February 2025. SafeBase trust centers still appear under the SafeBase name, and Drata also offers a trust center of its own.
Do I need a trust center to publish a subprocessor list?
No. Almost half of the lists we found are plain pages on the company’s own website. A trust center helps when you also want to share certifications and security documents, or offer change notifications, but a simple, dated page meets the same purpose.
Can a company keep its subprocessor list private?
Yes, as long as customers who rely on general authorisation are informed of the list and of changes. In our data, 9% of lists are available only on request. A private list makes vendor reviews slower, so most companies publish theirs.
What is the difference between a DPA and a subprocessor list?
The data processing agreement (DPA) is the contract that sets out how a vendor processes personal data for its customer, including the rules for using subprocessors. The subprocessor list is the current list of those subprocessors. The DPA usually links to the list or includes it as an annex.
How we collected the data
The figures come from the Papertrail directory as of 28 October 2026. For each of 10,379 company domains, we looked for the company’s own published subprocessor list, or its parent group’s, and recorded where it was published and whether it was public or available only on request. The companies are mostly B2B software companies, including many Y Combinator startups, and the vendors that appear on their lists, so smaller companies are well represented. We identified the trust-center platform from the address of each list, from where the company’s trust-center address points, and from the page itself. Each company is counted once, by where its current list lives. Lists that merely mention a few vendors in a privacy policy without calling them processors were not counted.