Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The document states that WorkOS (cross-domain identity management) and Merge API (infrastructure management via Connectors) are engaged only when the customer elects to use those features. Pylon Labs is engaged only when the customer elects premium support. These sub-processors do not process Customer Data by default.
This analysis describes what OpenAI's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes that three sub-processors are conditionally engaged based on feature or support tier elections, meaning the applicable sub-processor set varies by customer configuration. Compliance teams should document which optional features are enabled to maintain accurate sub-processor records.
Under this clause, WorkOS, Merge API, and Pylon Labs are not engaged as sub-processors unless the customer explicitly enables Connectors, cross-domain identity features, or premium support, respectively. Customers who have not activated these features are not subject to data processing by these entities.
Cross-platform context
See how other platforms handle Customer-Elected Sub-processors (WorkOS, Merge API, Pylon Labs) and similar clauses.
Compare across platforms →Monitoring
OpenAI has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"** At election of customer ***At election of customer; applicable to premium support onlyExcerpt from OpenAI's Sub-Processor List
1. REGULATORY LANDSCAPE: Conditional sub-processor engagement is relevant to GDPR Article 28 obligations regarding sub-processor disclosure and the accuracy of Article 30 records of processing activities. Customers must ensure their internal records reflect only active sub-processors based on their current feature configuration. The ICO and EU supervisory authorities may evaluate whether customer records accurately reflect the sub-processor chain. 2. GOVERNANCE EXPOSURE: Low. The customer-election mechanism limits sub-processor exposure to features explicitly activated by the customer. However, customers who enable Connectors (Merge API) or cross-domain identity (WorkOS) should update their data processing records and assess the transfer implications, as Merge API processes in multiple international jurisdictions. 3. JURISDICTION FLAGS: Merge API processes in Australia, Canada, France, India, Ireland, Japan, Singapore, South Korea, Sweden, UK, and US. Customers enabling Connectors should assess which of these locations are active for their account and whether applicable transfer mechanisms are in place. EU/EEA and UK customers face the most complex transfer analysis given the breadth of Merge API processing locations. 4. CONTRACT AND VENDOR IMPLICATIONS: Enterprise customers should confirm with OpenAI which optional sub-processors are currently active for their account and reflect those in their DPA and vendor management records. Enabling new features (such as Connectors) may activate additional sub-processors and should trigger a DPA review or update notification workflow. 5. COMPLIANCE CONSIDERATIONS: Legal teams should establish an internal process to track feature activations that trigger additional sub-processor engagements. Customers subscribed to new sub-processor notifications should also monitor feature-level changes that activate existing conditional sub-processors.
This provision establishes that three sub-processors are conditionally engaged based on feature or support tier elections, meaning the applicable sub-processor set varies by customer configuration. Compliance teams should document which optional features are enabled to maintain accurate sub-processor records.
Under this clause, WorkOS, Merge API, and Pylon Labs are not engaged as sub-processors unless the customer explicitly enables Connectors, cross-domain identity features, or premium support, respectively. Customers who have not activated these features are not subject to data processing by these entities.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by OpenAI.