Which companies belong on the list?
Companies that store, move, or can read customer data. Hosting, email, payments, support, and error tracking often do. A tool that never sees customer data does not.
Subprocessor list template
A subprocessor list template you can copy during a review.
Use this table when a security review asks who handles customer data. The rows are examples. Replace them with your companies. Some forms call this a sub-processor list.
Example rows
These three rows are examples, not your list. Replace them with the companies that actually handle your customer data, and change each date to the day you check that row.
The purpose line can name the kind of customer data.
| Name | What they do | Location | Agreement link | Updated |
|---|---|---|---|---|
| Amazon Web Services | Cloud hosting | https://d1.awsstatic.com/legal/aws-dpa/aws-dpa.pdf | Oct 5, 2026 | |
| Stripe | Payment processing | United States | https://stripe.com/legal/dpa | Oct 5, 2026 |
| Resend | Transactional email | United States | https://resend.com/legal/dpa | Oct 5, 2026 |
Stripe and Resend name the United States on their public data terms, so those locations are filled in. Amazon Web Services does not name one country, so that cell is blank. Write the region you use if the review asks for a place, and open each agreement link before you send the list.
What to write when a vendor will not name one country is in the processing location guide.
Sources for the example agreement links: Amazon Web Services DPA (PDF), Stripe DPA, and Resend DPA.
The spreadsheet includes these examples and two blank rows.
What each column means to a reviewer
- NameThe company the reviewer will look up. Use the name on the agreement, or the product name they already know.
- What they doWhat that company does with customer data. The purpose line can name the kind of customer data. Hosting, email, and payments are enough. Skip a slogan.
- LocationWhere the data is processed, when you know one place. Leave it blank when the provider does not name a single country.
- Agreement linkA public page for that company's data terms. The reviewer opens it instead of waiting on a file from you.
- UpdatedThe date you last checked the row. The reviewer uses it to tell whether the list still matches the product.
Template questions
What if the form says vendor list, or sub-processor?
Use this same table. Vendor is the broader word. A subprocessor, sometimes written sub-processor, is a company that processes personal data for you. Match the word the form uses.
What if I do not have an agreement link?
Leave that cell blank and send the table. Add the link later if the provider publishes one.
Can I send this without a public page?
Yes. Copy the table into the reply, or download the spreadsheet. A public page is optional.
If you want the longer notes
Why security reviewers ask for a vendor list is in the vendor list guide.
How to answer the usual security-review asks is in the security review guide.
How to answer a vendor security questionnaire without SOC 2 is in the security questionnaire guide.
What to do when a vendor will only share a DPA on a higher plan is in the vendor DPA guide.
Whether an AI or model provider belongs on the list, and how to describe it, is in the AI provider guide.
How to tell a controller, a processor, and a subprocessor apart is in the controller and processor guide.
What to write when a vendor will not name one country is in the processing location guide.
Whether customer data is encrypted, and who manages the keys, is not a column on this table. What to write is in the encryption guide.
What to write when they ask what each vendor can see is in the data access guide.
If you are weighing VendorLens against a thin paid vendor list page, see the VendorLens comparison guide.
If you are deciding between a free trust page and paying to publish, see Trust Prep vs a free trust page.
Related guides
Optional next step: a living page
This template is enough for the review in front of you.
If you want one link to send next time, instead of a new file, Trust Prep publishes this same list as a page you edit when a company changes. Reviewers open a public link made from your company name, without an account. They can copy the table or download the spreadsheet there. You can fill in the list and preview the page before you pay to publish the link. Publishing turns on after we confirm your payment.