Provider review and contractual safeguards
A provider review should cover purpose, data categories, access, retention, transfer mechanism, and relevant security documentation. The contractual role matters: a processor, an independent controller, and an app store do not all have identical responsibilities.
The published directory identifies principal service providers. Request the complete feature-specific chain where an AI gateway, search integration, communications service, or removal partner is involved. Applicable DPAs, SCCs, and regional terms should be reviewed alongside that chain.
Providers have different roles
Hosting, authentication, payments, AI inference, and public search use different providers. The information shared should match the requested feature and the provider's role. Some providers act as independent controllers under their own terms.
Contracts and transfer safeguards
Provider arrangements define the service and permitted processing. Where applicable, data processing and international transfer terms form part of the review. A provider's certifications describe that provider's scope.
Find the relevant provider
Our subprocessor directory lists principal service categories and links to provider security resources. Model, search, payment, and communications routing can depend on the feature and configuration. Contact the team for the provider scope applicable to a specific organizational assessment.