---
title: "Sub-processor"
canonical: https://replypen.com/glossary/sub-processor
description: "A sub-processor is a company that a service provider uses to process your data on its behalf, such as a hosting provider, an AI model provider or an email delivery service."
question: "What is a sub-processor?"
author: "ReplyPen team"
published: 2026-09-30
operator: ProBackup BV (Hasselt, Belgium)
---

# What is a sub-processor?

A sub-processor is a company that a service provider uses to process your data on its behalf, such as a hosting provider, an AI model provider or an email delivery service. Under the GDPR the provider must tell you who its sub-processors are and hold them to the same data protection terms.

This is a general explanation, not legal advice. If your business is the controller and a software
tool is your processor, every company that tool relies on to handle your data is a sub-processor.
The list usually lives in or next to the [data processing agreement](https://replypen.com/glossary/data-processing-agreement.md).

## Why it matters

Each sub-processor is another place your customers' data goes. The list tells you where the data is
stored, which countries it passes through, and which companies' terms apply. A provider normally has
to tell you before adding a new sub-processor, so you can object.

For AI tools in particular, the list answers a question buyers often ask: which AI companies see the
email, and on what terms?

## An example

An email drafting tool lists three sub-processors: a cloud host for storage, an AI provider for
writing drafts, and an error-monitoring service that sees technical details but no email content.

**In ReplyPen:** The companies ReplyPen relies on, and what each one sees, are listed on
[where your data goes](https://replypen.com/data-residency.md).

## Related

- [Data processing agreement (DPA)](https://replypen.com/glossary/data-processing-agreement.md): A data processing agreement, or DPA, is the contract between a business and a service provider that handles personal data on its behalf.
- [GDPR](https://replypen.com/glossary/gdpr.md): The GDPR, the European Union's General Data Protection Regulation, is the law that governs how organisations collect, use, store and share personal data about people in the EU.
- [Data residency](https://replypen.com/glossary/data-residency.md): Data residency is the country or region where your data is physically stored and processed, for example in data centres inside the EU.