Subprocessors
The public register needs the real production providers.
Publishing guessed vendors or regions would be worse than clearly marking the register incomplete.
Draft — not effective. This page still needs the operator’s legal identity, jurisdiction and service-specific review before publication.
Required inventory
Verify every provider before publication.
The final register should include legal name, service purpose, data categories, processing locations, transfer mechanism and the date each provider was added.
| Category | Information still required |
|---|---|
| Hosting and delivery | Production compute, storage, CDN, DNS and logging providers and regions. |
| Account and communication | Email delivery, support, authentication and incident communication providers. |
| Billing | Card, crypto payment, invoicing and tax providers actually used in production. |
| Operations and security | Monitoring, alerting, backup, abuse prevention and security service providers. |