16 of 42 SaaS Vendors We Checked Receive Email Through a Provider Their Sub-processor List Omits

SaaS vendors that process personal data for European customers keep a list of their sub-processors under Article 28 of the GDPR, and most publish it. Data protection officers rely on that list when they approve a vendor, and again each time the vendor gives notice of a change. Most of them never compare it with anything, because there is nothing obvious to compare it with.

Part of a vendor's supply chain is visible in public DNS. Mail exchanger (MX) records show who receives the domain's email. SPF records list who may send email in its name. The hostnames where the product itself runs, such as app. and api., resolve to a CDN or a cloud network. We took 42 vendors that European companies commonly buy, 16 of them headquartered in the EU, collected each published list by hand, and compared it with those records. The largest gap is in email, and it comes with an argument about whether a company's own mailbox provider belongs on the list at all; the narrower product-infrastructure test follows it.

Inbound mail: 16 of 42

41 of the 42 vendors receive mail through a provider we can identify from its MX hosts. 16 use a provider their list does not name anywhere: Google 7, Proofpoint 6, Mimecast 2, Cisco 1. Six of the 16 are headquartered in the EU.

Whether a company's own mailbox provider belongs on a sub-processor list is a fair question. Vendors that leave it off would say it handles their own business mail, not customer data. But support requests, data subject requests and bug reports with screenshots arrive by email, and most vendors in our set publish a support address on the same domain. Some vendors list their mail provider for exactly that reason: nine name it in an entry described as email, messaging or office tools. Another 17 name the same company only for something else, such as hosting or an AI model.

Product infrastructure: 4 of 42

This is the narrower test. 39 vendors had a product hostname that resolves to a CDN or cloud network we can identify. 37 of them name that company somewhere on their list (two name one provider and not another). 16 serve their product through Cloudflare, and 12 of those list Cloudflare.

The other 4 do not. Their product hostnames are CNAMEs to cdn.cloudflare.net, which means Cloudflare terminates the TLS connection and handles the traffic in clear before passing it on. Three of the four are headquartered in the EU.

One candidate did not survive checking. A US vendor's login host resolved through akadns.net, which looked like Akamai sitting in front of the product. It is Akamai's DNS-based traffic steering: the answer points at Microsoft Azure addresses, and Akamai never carries the traffic. The vendor lists Microsoft. We removed the finding.

Outbound mail: 29 of 42, with a large caveat

29 vendors publish an SPF record that authorises a sender their list does not name. The most frequent are HubSpot (8 vendors), Mailchimp and Salesforce (7 each), Marketo and Google (6 each) and Zendesk (5). Most of these are marketing and CRM platforms, and most of that mail is the vendor selling to prospects, which is the vendor's own processing rather than processing for customers. SPF also shows authorisation, not traffic: an include can outlive the contract that created it. We report this number because it is what a naive comparison produces, not because each row is a missing sub-processor.

We also left verification records out of every count. Anthropic (16 vendors), Microsoft (13) and OpenAI (8) tokens, where the vendor's list does not name the company, show that someone at the vendor set up an account, nothing about customer data.

How lists are written

The lists themselves vary more than the DNS does. The shortest in our set has 6 entries and the longest 338, spread across about 80 product sections in a 105-page PDF; the median is 33. One vendor describes its Azure hosting in prose above its sub-processor table and leaves it out of the table, and we counted it as listed. Another vendor's public page covers only three of its side services and none of its core product, so we excluded it. Seven vendors we wanted to include publish their list only behind a login, an NDA, or a page our tools could not read.

None of this says a vendor has broken a rule. A list can be accurate and still incomplete in ways a reader would care about, and a DNS record can sit there long after the relationship ended. What the comparison gives a reviewer is a short set of specific questions to send the vendor, each with a record anyone can reproduce with dig.