The Subcontractor You Didn't Know You Had

You vetted your AI vendor carefully. But your vendor has vendors, and those vendors touch your data too.

Almost no AI company runs entirely on its own infrastructure. Your data flows to cloud hosts, to embedding providers, to analytics services, to customer support platforms — a chain of companies you've never met, each with their own security practices and their own subcontractors. These are called sub-processors, and they inherit all of your risk while receiving none of your diligence.

So ask your vendor for the list. Serious vendors publish a sub-processor list and notify customers before adding new ones. Read it the way you'd read the vendor's own credentials: where is each company, what data do they see, what happens if you object to a new addition?

Then ask the follow-up question: what are your vendors required to do? Your contract is with the AI company, not with its cloud provider. Make sure your vendor is contractually required to hold its own subcontractors to real standards, not just hopes.

You can't manage a risk you can't see. Get the list, read the list, and revisit it every year. The chain only gets longer.

I explain frameworks; I don't give legal counsel.