# What is a sub-processor?

> A sub-processor is a vendor an AI provider uses behind the scenes to handle a company's data, and GDPR requires permission before it does.

Source: https://meshin.co/glossary/sub-processor
Updated: 2026-10-02

---

## Why it comes up

It is a routine line on a security questionnaire: "list your sub-processors." It is also a revealing one. Teams build most AI features on someone else's model, which makes a sub-processor almost guaranteed rather than an edge case. A buyer who skips the question is signing a contract blind. They will not know where their data actually goes once it leaves the vendor's own systems.

## What to do about it

Ask every AI vendor for its sub-processor list, and how it notifies customers of a change. Then check honestly: does the notice give a real chance to object, or just a record that it happened? Add the answer to the AI register entry for that vendor, next to the data classification of what reaches them. The [Fractional CAIO Retainer](/services/fractional-caio-retainer) is where I check vendor contracts for this gap before a renewal.