Your vendor says 'no US subprocessors.' Here's how to actually check
Your DPO just forwarded you another vendor questionnaire with a checked box next to "no US subprocessors." Before you forward it back with a thumbs up, know this: most of those boxes get checked optimistically, not accurately. If you're the engineer who ends up answering "where does our data actually live" during procurement calls, this list is for you.
The gap is rarely malicious. It's usually a monitoring tool that defaulted to a US region, a backup target nobody revisited after setup, or a subprocessor that's legally based in the EU but owned by a US parent. Sovereignty audits exist to find exactly that gap.
Why yes/no questionnaires fail
A vendor questionnaire asks "do you store data in the EU?" and gets a yes. It doesn't ask who holds the encryption keys, where support engineers sit, or whether the CDN in front of the app routes through a US edge network. Evidence beats assertions every time.
The checks that actually matter
Subprocessor list freshness. If a vendor's public subprocessor list hasn't changed in over a year despite shipping new features, it's probably stale, not accurate.
Parent company ownership, not just contracting entity. A subprocessor incorporated in Germany can still be a wholly owned US subsidiary, which pulls it under the CLOUD Act regardless of server location. Always ask for the ultimate parent, not the signing entity.
Support and escalation location. If a US-based support engineer can remote into production to debug something, that's a data access path your residency clause doesn't cover.
Monitoring and APM defaults. Sentry, Datadog, and New Relic all offer EU hosting, but it's opt-in. Primary infra can be EU-only while telemetry leaks through a third-party integration nobody checked.
CDN and DNS routing. A CDN is a subprocessor too. Origin in Frankfurt doesn't mean much if the CDN is a US hyperscaler's edge network. You can verify this yourself:
# Check which edge network is actually serving a domain
dig +short CNAME cdn.example.com
# Trace the resolved IP's registered location
whois $(dig +short cdn.example.com | tail -1)
This won't give you a legal answer, but it'll tell you fast whether the CDN claim matches DNS reality.
Backup and DR region. EU-only production paired with a US backup target is common, usually because backup tooling defaulted there during setup and nobody revisited it. Ask explicitly where backups, snapshots, and DR replicas live.
Who holds the encryption keys, and from where. Encryption at rest is table stakes. If a US entity or cloud provider holds the keys, EU residency doesn't block a lawful access request.
Legal basis for remaining transfers. If zero international transfers isn't achievable, find out if they're relying on SCCs, BCRs, or something else, and whether it's been tested against post-Schrems II expectations.
Documented incident response for law enforcement requests. Ask what happens procedurally if a non-EU authority requests data. If there's no written process, there's no real process.
Whether the infra partner's own tooling is sovereign. Some vendors sell you an EU-region sovereignty story while their own ticketing or remote access tooling runs on US SaaS.
Failover and migration behavior. Sovereignty guarantees are easiest to break during a DR drill or fast migration. Ask the vendor to walk through a specific failover scenario and confirm the DR target still meets the same residency commitments as production.
Direct technical contact. Can someone answer these questions in a conversation, or does everything route through a ticket queue with a copy-pasted compliance statement three days later? The former usually means they understand their own subprocessor chain.
Get the real subprocessor table, not a summary
Ask for the DPA's actual subprocessor annex. It should look like this:
Subprocessor | Purpose | Entity location | Parent HQ
EU hosting partner| Infrastructure | Netherlands | Netherlands
EU email relay | Transactional email | Germany | Germany
Monitoring vendor | APM / error tracking | EU region (opt-in) | United States
That third row fails a strict no-US-subprocessor policy even though the data is technically hosted in the EU. The parent HQ column is the one most vendor tables conveniently leave out.
Rolling this out without reopening every contract at once
Most teams have ten to thirty vendors already under contract. Don't try to audit all of them simultaneously.
- Tier vendors by how much regulated or personal data they touch
- Run the full check against top-tier vendors first: core infra, email/identity, anything handling payment or health data
- Bake the subprocessor table requirement into procurement for new vendors from day one
Full details and context: the original sovereignty audit checklist.
Originally published on binadit.com
Top comments (0)