Inside the Subprocessor Chain 2026

GDPR Article 28(2) requires every processor of personal data to disclose its sub-processors to its customers and provide prior notice before adding or replacing one. The mechanic looks simple: keep a list, update it, send a notification. In practice your list is only as current as your upstreamproviders' lists, because when AWS or Stripe brings on a new sub-processor, that change cascades down the chain to you.

We have been monitoring the published sub-processor pages of 18 widely-used SaaS providers daily since the start of the Registora catalogue. The data below is everything they currently disclose, aggregated. It is observational - we are reporting what these providers themselves publish - and the dataset is frozen so the numbers in this prose match the tables you see.

The single most striking finding is how concentrated the upstream is. Amazon Web Services appears in 17 of 18 provider lists, Google Cloud Platform in 16, and Microsoft Azure in 9. Three companies underpin nearly every B2B SaaS your customers might use.

The AI vendor story is almost as concentrated and considerably newer. OpenAI appears in 12 provider lists and Anthropic in 10. AI model vendors have moved from optional integrations to a recurring line item on the subprocessor pages of mainstream SaaS infrastructure - often invisibly, because the calls happen server-side and never appear in a browser scan of the SaaS's own marketing site.

This is the leaderboard of vendors that appear across the most provider lists, after collapsing common-name aliases. Read it as “if you build on N of these 18providers, you almost certainly rely on the top entries here too”. Citation share is the percentage of monitored providers whose published list cites that vendor.

Each of the 18 monitored providers in the catalogue, with the number of subprocessors currently disclosed in their latest snapshot. The median is 26; the longest list is aws at 110 entries; the shortest is postmark at 2.

• -Source:public subprocessor pages published by each provider on their own domain, scraped daily by the Registora orchestrator. The full source URL per provider is on each  /providers/<slug> page.
• -Cohort: the 18 providers Registora monitors (slack and linear scrapers are deferred and excluded). This is the infrastructure-and-communications backbone of typical B2B SaaS - it is intentionally upstream-heavy.
• -Alias collapse:a manual map normalises common variants (“Amazon Web Services, Inc.”, “AWS”, “Amazon Web Services” → all one entry). The verbatim names per canonical vendor are kept in the dataset and can be audited.
• -Floor, not ceiling: some providers gate their subprocessor pages behind a Trust Center login or a DPA - if we cannot scrape it, it is not counted. The real chain is at least as wide as what we report; possibly wider.
• -No compliance claims: we report what each provider publishes about its own subprocessors. Whether any given downstream SaaS is meeting Art. 28(2) for its own customers is a separate question, depending on its DPA, contract terms, and notification process.