Subprocessors

How to answer subprocessor questions

Explain subprocessors, purpose, customer data access, and notification practices in security reviews.

List vendors clearly

Include vendor name, purpose, data category, and region where appropriate.

Use your contractual language for notification and objection rights.

Subprocessor lists should be updated when vendors change.

Upload a questionnaire, generate evidence-backed draft answers, reuse approved responses, and export clean files for customer review.

FAQ

Yes. Draft answers should be reviewed before they are sent to customers because they represent your company's security posture.

Flag the answer as missing information, add the right policy or document, or answer manually with a clear caveat.

Yes, but only after checking that the scope, product behavior, and supporting evidence are still current.