OpenAI Sub-Processor List

This document is OpenAI's Sub-processor List, published pursuant to the OpenAI Data Processing Agreement (DPA), identifying third-party entities that may process Customer Data on behalf of OpenAI in connection with its API and enterprise services. The document discloses the identities, locations, and processing activities of sub-processors engaged by OpenAI, fulfilling a transparency obligation commonly required under data processing agreements and applicable to business customers and API users operating under the DPA. The list is operationally significant for enterprise customers conducting vendor due diligence because it identifies the infrastructure and service providers through which Customer Data flows, including cloud infrastructure, analytics, and support tooling providers; the specific sub-processors named, their countries of operation, and their stated processing activities are the primary compliance reference points for downstream data mapping and transfer assessments. This document engages GDPR Article 28 obligations (which require controllers to be informed of sub-processor arrangements and permit objection rights), as well as analogous requirements under the UK GDPR and other data protection frameworks applicable to international data transfers; compliance exposure depends on the jurisdiction of the business customer and the nature of Customer Data processed. Enterprise customers subject to GDPR, UK GDPR, CCPA, or sector-specific regulations such as HIPAA should evaluate this list against their own data processing obligations, including cross-border transfer mechanisms, contractual flow-down requirements, and sub-processor change notification procedures.