Security questionnaire answers › Vendor management
Can you provide a list of your subprocessors? How to answer it in a security questionnaire
Why buyers ask this
GDPR and customer contracts require transparency about who processes personal data on your behalf.
What a strong answer includes
- Publish a page listing each subprocessor, purpose, data location and entity.
- Offer email notification when it changes.
- Keep it current whenever you add an AI or infrastructure vendor.
Sample answer to adapt
Replace the bracketed parts with your own facts. Only state what is true for your environment.
Yes. Our subprocessors, their purpose and processing location are listed at [URL]. Customers can subscribe to change notifications, and we give [30 days] notice before authorizing a new subprocessor.
Evidence to attach
- Public subprocessor page
- DPA subprocessor annex
Common mistakes
- Omitting AI model providers from the list.
Answer questionnaires from your own documents
Korrali Trust drafts answers from your policies and evidence so every response traces back to its source, and a person reviews it before it goes out.