OpenAI Sub-Processor List

This document is OpenAI's sub-processor list, published under the OpenAI Data Processing Agreement (DPA), identifying the third-party entities and OpenAI affiliate companies authorized to process Customer Data across OpenAI's API, ChatGPT Enterprise, ChatGPT Edu, and ChatGPT Business products. The document states that third-party sub-processors are engaged for purposes including cloud infrastructure, content delivery, data warehousing, customer support, content moderation, user authentication, identity management, and ETL processing, with geographic processing locations specified per entity. Notably, the document states that for content moderation purposes, OpenAI may share samples of flagged Customer Content with sub-processors such as TaskUs, Accenture, and Cinder Technologies, with retention limited to the period of review; additionally, three sub-processors (Snowflake, Confluent, and Cinder Technologies) are excluded when Zero Data Retention (ZDR) is in use, and two sub-processors (WorkOS and Merge API) are engaged only at the election of the customer. This list engages GDPR Article 28 obligations regarding sub-processor disclosure and contractual chain requirements, CCPA obligations regarding service provider relationships, and cross-border data transfer frameworks, with the document stating that Standard Contractual Clauses are used as the transfer mechanism among OpenAI affiliate entities. Compliance teams should note that processing locations span multiple jurisdictions including the EU, UK, US, Philippines, Japan, Brazil, and others, creating layered transfer and localization considerations depending on the customer's own regulatory obligations.