The Subprocessor Transparency Report 2026

Across the 100 companies, the median site loaded 7.5 third-party services and the mean was 11.5 - skewed upward by the heaviest, which loaded 44. A third of the sites are lean, but 34 of 100 load 15 or more.

It is the norm: 89 of 100 publish a public subprocessor page. Only 11do not, and even most of those have a list, just gated behind an NDA or request-access, or provided only inside a DPA. The harder problem is consistency: the pages live on trust subdomains, in PDFs, on docs sites and at a dozen different URL conventions, with no standard. Our automated check of the obvious paths found only about half on the first pass; we verified the rest by hand. If a purpose-built scan struggles to find a disclosure, a customer security review will too. We counted only a dedicated, public list; subprocessors named only inside a long privacy policy were not counted.

Mostly advertising, analytics and tag-management networks - the vendors that receive visitor data. The most common across the cohort:

• -Google Tag Manager - on 65 of 100 sites (65%)
• -Other Google APIs/SDKs - on 54 of 100 sites (54%)
• -Google/Doubleclick Ads - on 51 of 100 sites (51%)
• -Cloudflare - on 47 of 100 sites (47%)
• -LinkedIn Ads - on 43 of 100 sites (43%)
• -Facebook - on 35 of 100 sites (35%)
• -Optanon - on 35 of 100 sites (35%)
• -Bing Ads - on 34 of 100 sites (34%)
• -Google Analytics - on 31 of 100 sites (31%)
• -reddit - on 31 of 100 sites (31%)
• -Marketo - on 28 of 100 sites (28%)
• -Google Fonts - on 26 of 100 sites (26%)
• -Sentry - on 24 of 100 sites (24%)
• -G2 - on 22 of 100 sites (22%)
• -JSDelivr CDN - on 19 of 100 sites (19%)

100 well-known B2B SaaS products. We loaded each company’s public site in a real headless browser, accepted the cookie banner, visited up to two additional pages, and recorded every third-party host the pages connected to, mapping hosts to named vendors. In parallel we probed common locations for a subprocessor or DPA page, then verified every page result by hand. Scans ran 26 May 2026 to 26 May 2026.

One limit matters: a browser scan only sees what loads in the visitor’s browser. Subprocessors a company calls from its own servers - AI model providers, payment back-ends, data warehouses, transactional email - never appear. GitHub, Slack and Linear, for instance, each loaded zero third parties in this scan, yet GitHub alone publicly lists dozens of subprocessors on its own page. So every count here is a floor. The real subprocessor list for most of these companies is longer than what their website visibly loads, which is precisely why a maintained, public list matters.

The third-party counts are reproducible: paste any company below into the free scanner at registora.com/check and you will see the same scan we recorded.