Security moment
"Can you send us your list of subprocessors?"
It arrives from a prospect's legal team, or lands in a contract redline, and the deal pauses until you answer. Name the wrong vendor, miss one, or take three weeks, and you look like a risk. Here's how to answer accurately, today, and make it the reason they trust you.
Build my vendor inventory free See how to answer
Deal waiting on this? ThreeShield can help: 1-403-538-5053
How to answer the subprocessor question well
1. Know what they're actually asking for
A subprocessor is any outside service that touches your clients' data on your behalf. The client wants a named list: who each vendor is, what they do for you, and, increasingly, which country they store the data in. Vague answers like "industry-standard providers" fail; specific, current lists pass.
2. Don't answer from memory
The shadow tool a department signed up for last quarter is exactly the one that turns a confident answer into an embarrassing correction. Your subprocessor list has to reflect what you actually run today, not what you remember approving. That's why it should come from a living inventory, not a document someone wrote once.
3. Flag which vendors move data across a border
The follow-up question is always "and where does the data live?" A vendor that stores data outside your country triggers extra disclosure obligations under PIPEDA, GDPR, and provincial privacy laws. Knowing which of your subprocessors process data abroad, before the client asks, is what separates a smooth review from a scramble.
4. Hand them a page, not a promise
The vendor who replies with a clean, dated subprocessor list and a short trust page looks like the safe choice. The one who says "let me check with IT and get back to you" looks like the risk. Same company, opposite impression, decided entirely by whether the answer was ready.
5. Keep it current, because contracts require notice
Most data-processing agreements require you to notify clients before you add or change a subprocessor. That's impossible if you don't know when a new tool enters your environment. Continuous discovery turns "notify on change" from a promise you can't keep into one that keeps itself.
The Resilience tools that answer it for you
Subprocessor questions are really data-governance questions. Lavawall®'s Resilience package keeps the answer current, so the next one takes minutes.
Vendor Inventory
A living list of the vendors and tools that touch your data, discovered from what you actually run, so your subprocessor list is a lookup, not a memory test.
Learn more →Data Flow Documentation
Shows what information moves between your systems and each vendor, so you can explain not just who your subprocessors are, but what they receive.
Learn more →Foreign Processing Disclosure
Automatically flags the subprocessors that move data outside the country and generates the outside-Canada disclosure most platforms don't.
Learn more →Trust Centre
A single page you can send a client that shows your posture, your subprocessors, and your data handling, so you answer the same question once.
Learn more →Also useful: a Privacy Policy addendum that names your service providers and international processing, and stakeholder questionnaires to collect what each vendor attests to.
Want the subprocessor list, and the disclosures, done with you?
ThreeShield, the CISSP/CISA team that builds Lavawall®, inventories your vendors, maps your data flows, and produces the subprocessor list, foreign-processing disclosure, and trust page clients ask for, so the next review starts from done.
Common questions
- What exactly is a subprocessor?
- Any third party that processes your clients' personal data on your behalf, your cloud host, email, backup, CRM, analytics, help desk, payment processor. Privacy laws and most contracts require you to disclose them and flow your obligations down to each.
- Do we really need a subprocessor list if we're a small business?
- If you handle other organizations' personal data, yes. Clients, insurers, and regulators increasingly ask for it, and a missing or stale list stalls deals. The list is usually small; the hard part is keeping it current and knowing which vendors move data abroad.
- How does Lavawall help answer subprocessor questions?
- It keeps a living Vendor Inventory, maps how data flows to each vendor, flags cross-border processing, and generates a Foreign Processing Disclosure and Trust Centre page you can hand a client, so the answer is a lookup, not a fire drill.