Essays on AI softwareSunday, November 1, 2026Independent · No sponsors
TalkAI Tools
EssayBy The Talk AI Tools editorsOctober 31, 2026

The subprocessor list you agreed to

The subprocessor list you agreed to

Somewhere in every cloud contract is a clause in which you agree, in advance and in general, to a list of other companies that will handle your data. The list is published. It changes without your involvement.

What this note covers, in order.
What this note covers, in order.

Four vendor pages and two data processing addenda were read against their live markup on October 24, 2026. The interesting part is not who is on the lists. It is what the lists say about consent.

Cursor's public homepage, captured automatically on October 13, 2026. Not a logged-in account; the page may have changed since.
Cursor's public homepage, captured automatically on October 13, 2026. Not a logged-in account; the page may have changed since.

You consented in advance, by signing

Google's Cloud Data Processing Addendum sets out the structure in two sentences. Section 11.1 says the customer "specifically authorizes" the subprocessors disclosed as at the effective date.

Then: "Customer generally authorizes Google's engagement of other third parties as Subprocessors ('New Subprocessors')." The authorisation is forward-looking and open-ended.

Atlassian's addendum uses almost the same construction at section 4.1. "By entering into this DPA, Customer provides general authorisation for Atlassian to engage Sub-processors to Process Customer Personal Data."

This is a reasonable way to run a platform and a strange way to think about permission. The approval was granted once, at signature, for parties that did not exist on the list yet.

What both addenda do give back is liability. Google "will remain fully liable for all obligations subcontracted to, and all acts and omissions of, the Subprocessor". Atlassian commits in the same terms.

What the lists actually name

The Google Cloud Platform subprocessor page is the most detailed public list of this kind we read. Its table carries nine columns per entity.

They include the relevant services, the applicable cloud regions, the activity performed, the "Country where processing is performed", a registered address, a country of registration, a company number and an ultimate parent company.

The level of specificity changes what the list is for. A nine-column row is auditable; a company name on its own is an assurance.

The activity definitions above the table are the part worth reading closely. "Data Labeling: Human labelers apply labels to datasets submitted by Customer based on instructions provided by Customer."

And: "Voice Transcription: Human transcribers label and transcribe audio recordings. This activity only occurs if Customer elects to opt in to the Speech-to-Text data logging program."

The technical support definition is the reassuring one, and it is conditional. The subprocessor "does not have access to Customer Data stored or processed by the Services" unless the customer "explicitly elects to share Customer Data in the course of a support case".

Attaching those definitions to rows produces concrete facts. Accenture International Limited, registered in Ireland, is listed for technical support across all Google Cloud Platform services.

Processing for that entry is performed in "Bulgaria, Canada, India, Israel, Japan, Malaysia, Mexico, Philippines, Romania and United States of America". Ten countries, named, for one support function.

Cognizant Worldwide Limited appears against "All AI Solutions, Pre-Trained APIs, AI Platform/Gemini platform (formerly Vertex AI), Generative AI Services and Agentic AI Services", with data labeling among its listed activities.

Your AI vendor's subprocessors are other AI vendors

Atlassian's list groups entities by function, and one group did not exist on lists of this kind a few years ago: "AI and Analytics Service Providers".

Three names sit in it. Amazon Web Services, Inc. is listed as "(AWS Bedrock)", alongside Google Vertex AI and OpenAI, L.L.C.

The scope column is the sentence to copy into your own records. These apply to "All Atlassian Cloud Products with enabled Atlassian Intelligence, Loom AI, or Rovo".

The stated purpose is "Generative AI services provider for intelligence product features". Turning on an assistant inside a project tracker therefore adds a model provider to your processing chain.

The same list names Cantab Research Ltd, trading as Speechmatics, for transcription services, which is the sort of entry that matters once meeting recordings enter the product.

The support group is equally concrete about geography: e-Core in Brazil and Mexico, Partner Hero in the Philippines, Romania and South Africa, SoftServe in Bulgaria, Poland and the United States, and Telus in Romania.

Atlassian also describes its own diligence, which is the kind of claim worth quoting rather than paraphrasing. It "carries out annual compliance reviews of its Sub-processors" and conducts transfer impact assessments for cross-border transfers.

Notice is thirty days, and one vendor makes you ask for it

Both addenda specify the same notice period and deliver it differently, and the difference is the practical finding of this essay.

Google commits to notify "at least 30 days before the New Subprocessor starts processing any Customer Data", including "the name, location and activities of the New Subprocessor".

Its subprocessor page explains the channel. Notices go to "the email address(es) your organization has designated in the Admin Console or Order Form", managed through the Legal category in Essential Contacts.

The page then answers the subscription question directly. "Do I need to subscribe to receive notice of changes to the Subprocessor page?" Answer: no, provided a notification address is on file.

Atlassian's clause 4.2 commits to the same thirty days with one qualifying phrase. It will provide notice "to those emails subscribed, at least thirty (30) days before allowing any new Sub-processor to Process Customer Personal Data".

Its list page carries the matching instruction: "Sign up for emails to be notified when we add new Atlassian Sub-processors." Nobody subscribed means nobody notified.

There is also a carve-out for early-access products on the same page. "If a Beta or EAP service uses a new Sub-processor, Atlassian may use an alternative notification mechanism."

Objecting means leaving

Both addenda grant a right to object, and both define objection as termination rather than as a veto.

Google: a customer may, "within 90 days after being notified of the engagement of a New Subprocessor, object by immediately terminating the applicable Agreement for convenience".

Atlassian is more compressed and more explicit about the limit. If the customer objects, it "as its sole and exclusive remedy, may terminate the applicable Order for the affected Cloud Product".

So the choice presented by a new contractor on the list is to accept it or to migrate. That is a real option for a two-person team and an abstraction for a company with five years of history in the product.

One list says None, and two could not be read

Not every list is long. Amazon Web Services publishes a page headed Subcontractor Access, and on October 24, 2026 the entire list under "Page information current as of today" was a single bullet reading "None".

The page offers a sign-up "to be notified of a change to the list on this webpage", which is the correct design for a list whose current value is nothing.

Two lists we could not verify, and the failures are worth recording rather than glossing. OpenAI's subprocessor policy page returned a Cloudflare interstitial reading "Just a moment" and "Enable JavaScript and cookies to continue" to a headless browser on October 24, 2026.

The address we tried for Anthropic's list, at anthropic.com/legal/subprocessors, returned the site's 404 page on the same date. We could not read either list that day, which is not the same as saying neither exists.

What to check in your own file

What follows in practice

Put the subprocessor page of each vendor on a quarterly calendar reminder, and confirm which mailbox the thirty-day notice reaches. Both steps take ten minutes and neither happens by default.

Then treat enabling an AI feature as a data-flow change rather than a settings change, because on at least one published list that is precisely what it is.

The adjacent questions are argued in who reads what you type and the default that trains on your work, with the technical limits of what gets sent examined in what a context window costs you.

Plan and price detail, with the date each figure was read, sits in our primer on AI assistant pricing for small teams.

Subject pages for the assistants most often added to a stack this way: Claude, ChatGPT and Cursor, with the two consumer plans compared in ChatGPT versus Claude.

A subprocessor list is not a disclosure you receive. It is a document you already agreed to, maintained by the other party, changing on thirty days of notice you may have to ask for.

Sources, read against the live page markup on October 24, 2026: cloud.google.com Google Cloud Platform Subprocessors and Cloud Data Processing Addendum; atlassian.com list of data subprocessors and data processing addendum; aws.amazon.com subcontractor access page.

Sources