How it works in a data room
The provider is the processor for its customers, and any company it relies on to store or handle their data is a subprocessor. Providers usually publish a list naming each subprocessor, its purpose and the country where processing happens. The data processing agreement requires the provider to flow down equivalent protections, give notice before adding new subprocessors and let customers object. AI features often bring new subprocessors, because model hosting may sit with a separate company.
Why it matters in a deal
Your data is only as safe as the weakest link in the chain. A subprocessor in a country without adequate protection may need standard contractual clauses and a transfer assessment. Security teams also check each subprocessor’s certifications. Sellers handling sensitive personal or regulated data should review the list before choosing a provider and watch for change notices during long processes.
Example
A European healthcare company reviews a provider’s subprocessor list and sees that AI summaries are processed by a model host outside the EU. The provider confirms the feature can be disabled per room and that all other processing stays in the EU. The company switches AI features off for the patient-related folders and signs. The healthcare services guide covers sector expectations.