What we could verify

The answer changes with the OpenAI product and the feature you use. Start with the ChatGPT guide for a personal plan or a managed workspace; the wider company map keeps those contexts separate.

A business subprocessor list is not a recipient list for every ChatGPT conversation. In the reviewed Plus/Pro material, the named Cloudflare hosting connection applies to ChatGPT Sites web pages only.

Choose a service first: ChatGPT account and plan guide.

8 reviewed outbound connections are available in this research. 26 reviewed connections point to this exact company record. This is selected coverage, not a complete recipient list.

Explore OpenAI in the map

Who it works with

Connections from OpenAI, with the purpose and scope attached to each source. A connection documents a relationship; it does not show that your data was transferred.

Processes data on behalf of another company

Amazon Web Services, Inc.

OpenAI → Amazon Web Services, Inc.

Cloud infrastructure

Applies to: ChatGPT Business; ChatGPT Enterprise; ChatGPT Edu.

When this applies

  • The row explicitly names ChatGPT Business, Enterprise and Edu.

What remains unclear

  • The table does not distinguish Standard/Premium Business seats; no seat-specific routing is established.
Data, location and review details
Data categories
Not specified for this connection in the reviewed record. Do not assume all customer data.
Locations
United States (processing location)
Jurisdiction
No narrower jurisdiction recorded for this claim.
Where in the source
Third Party Sub-processors > Amazon Web Services, Inc. row
Source retrieved
Document updated
Claim independently reviewed
· Agent review

Source: OpenAI Sub-processor list · Reviewed

Processes data on behalf of another company

Microsoft Corporation

OpenAI → Microsoft Corporation

Cloud infrastructure

Applies to: OpenAI API; ChatGPT Enterprise, Edu and Business.

No additional condition is recorded for this selected claim. Its stated product scope still applies.

What remains unclear

  • The source lists many processing countries; not all copied into this selected assertion.
Data, location and review details
Data categories
Not specified for this connection in the reviewed record. Do not assume all customer data.
Locations
No specific processing location established for this connection.
Jurisdiction
No narrower jurisdiction recorded for this claim.
Where in the source
Third Party Sub-processors — Microsoft row
Source retrieved
Claim independently reviewed

Source: OpenAI Sub-processor list · Reviewed

Processes data on behalf of another company

CoreWeave, Inc.

OpenAI → CoreWeave, Inc.

Cloud infrastructure

Applies to: ChatGPT Business; ChatGPT Enterprise; ChatGPT Edu.

When this applies

  • The row explicitly names ChatGPT Business, Enterprise and Edu.
Data, location and review details
Data categories
Not specified for this connection in the reviewed record. Do not assume all customer data.
Locations
Norway (processing location); Spain (processing location); Sweden (processing location); United Kingdom (processing location); United States (processing location)
Jurisdiction
No narrower jurisdiction recorded for this claim.
Where in the source
Third Party Sub-processors > CoreWeave, Inc. row
Source retrieved
Document updated
Claim independently reviewed
· Agent review

Source: OpenAI Sub-processor list · Reviewed

Processes data on behalf of another company

Pylon Labs

OpenAI → Pylon Labs

Customer-requested premium support

Applies to: ChatGPT Enterprise; ChatGPT Edu.

When this applies

  • Optional premium support selected by the customer; only data the customer chooses to share in that support case.
  • The ChatGPT product column names Enterprise and Edu, not Business.

What remains unclear

  • Pylon Labs is the disclosed label, not an independently established full legal name.
Data, location and review details
Data categories
Not specified for this connection in the reviewed record. Do not assume all customer data.
Locations
United States (processing location)
Jurisdiction
No narrower jurisdiction recorded for this claim.
Where in the source
Third Party Sub-processors > Pylon Labs row; *** footnote; Customer Support purpose
Source retrieved
Document updated
Claim independently reviewed
· Agent review

Source: OpenAI Sub-processor list · Reviewed

Processes data on behalf of another company

Cloudflare, Ltd.

OpenAI → Cloudflare, Ltd.

Possible hosting of ChatGPT Sites web pages

Applies to: ChatGPT Sites on ChatGPT Plus; ChatGPT Sites on ChatGPT Pro.

When this applies

  • Limited to ChatGPT Sites web pages created by Plus or Pro users; the source says the listed subprocessors may provide Sites hosting and related services.
  • Hosting providers may apply safety/security classifiers to web pages and share results with OpenAI and its subprocessors.

What remains unclear

  • Does not establish Cloudflare's role for ordinary Plus/Pro conversations, Free or Go.
  • Consumer Sites processing locations and Pro-tier differences are not separately stated.
  • Cloudflare, Ltd. remains the exact source label; no merger with Cloudflare, Inc. is asserted.
Data, location and review details
Data categories
Not specified for this connection in the reviewed record. Do not assume all customer data.
Locations
No specific processing location established for this connection.
Jurisdiction
No narrower jurisdiction recorded for this claim.
Where in the source
Cloudflare Web Hosting row; Web Hosting purpose; Processing for ChatGPT Pro and Plus users
Source retrieved
Document updated
Claim independently reviewed
· Agent review

Source: OpenAI Sub-processor list · Reviewed

Processes data on behalf of another company

Cloudflare, Ltd.

OpenAI → Cloudflare, Ltd.

Content delivery

Applies to: OpenAI API; ChatGPT Enterprise, Edu and Business.

When this applies

  • Requests to us.api.openai.com or eu.api.openai.com use Regional Services for TLS termination and HTTPS decryption within the selected region.

What remains unclear

  • The disclosure names Cloudflare, Ltd.; the suggested target ID does not establish equivalence with another Cloudflare legal entity.
Data, location and review details
Data categories
Not specified for this connection in the reviewed record. Do not assume all customer data.
Locations
Data center closest to end user (processing location)
Jurisdiction
No narrower jurisdiction recorded for this claim.
Where in the source
Third Party Sub-processors — Cloudflare CDN row
Source retrieved
Claim independently reviewed

Source: OpenAI Sub-processor list · Reviewed

Processes data on behalf of another company

Snowflake, Inc.

OpenAI → Snowflake, Inc.

Data warehousing

Applies to: OpenAI API; ChatGPT Enterprise, Edu and Business.

When this applies

  • For API, excluded where Zero Data Retention is used.
Data, location and review details
Data categories
Not specified for this connection in the reviewed record. Do not assume all customer data.
Locations
United States (processing location)
Jurisdiction
No narrower jurisdiction recorded for this claim.
Where in the source
Snowflake row and * footnote
Source retrieved
Claim independently reviewed

Source: OpenAI Sub-processor list · Reviewed

Processes data on behalf of another company

WorkOS, Inc.

OpenAI → WorkOS, Inc.

Cross-domain identity management

Applies to: ChatGPT Enterprise, Edu and Business.

When this applies

  • At customer election.
Data, location and review details
Data categories
Not specified for this connection in the reviewed record. Do not assume all customer data.
Locations
United States (processing location)
Jurisdiction
No narrower jurisdiction recorded for this claim.
Where in the source
WorkOS row and ** footnote
Source retrieved
Claim independently reviewed

Source: OpenAI Sub-processor list · Reviewed

Who names OpenAI

These disclosures belong to the companies named below. They do not establish which of OpenAI’s own suppliers are involved further on.

Processes data on behalf of another company

Microsoft

Microsoft → OpenAI

Providing OpenAI-operated models for enterprise Copilot experiences

Applies to: Microsoft Copilot for organizations (work or school account); Microsoft Copilot Studio.

When this applies

  • Applies to OpenAI-operated models made available through Microsoft enterprise Online Services, when enabled for the user or group; Microsoft-operated Azure OpenAI models are a separate deployment path.
  • The page dates availability to July 9, 2026 and default enablement for eligible commercial customers to July 24, 2026; administrators can select No users or restrict access to specified users and groups.
  • Copilot Studio creators select the model, and additional Power Platform administrative controls apply.
  • OpenAI-operated models are unavailable in GCC, GCC High, DoD and sovereign clouds; applicable in-country processing commitments exclude these models. The page includes them in the EU Data Boundary subject to its linked exceptions.
  • The Microsoft DPA and Product Terms apply subject to documented exclusions. Certain Copilot experiences use the OpenAI Responses API with Zero Data Retention subject to OpenAI's feature-specific limits.

What remains unclear

  • This establishes an optional/eligible provider route, not a guarantee that every Copilot prompt is sent to OpenAI.
  • No consumer Copilot, Microsoft 365 home-plan or ordinary Azure OpenAI route is established by this enterprise article.
Data, location and review details
Data categories
Not specified for this connection in the reviewed record. Do not assume all customer data.
Locations
No specific processing location established for this connection.
Jurisdiction
No narrower jurisdiction recorded for this claim.
Where in the source
Important; opening paragraphs; Manage OpenAI as a subprocessor; user/group access; Exclusions
Source retrieved
Document updated
Claim independently reviewed
· Agent review

Source: OpenAI as a subprocessor in Microsoft Online Services · Reviewed

Processes data on behalf of another company

ActiveCampaign

ActiveCampaign → OpenAI

Artificial intelligence services.

Applies to: ActiveCampaign Services.

When this applies

  • Feature Specific Sub-processors category.
Data, location and review details
Data categories
Not specified for this connection in the reviewed record. Do not assume all customer data.
Locations
United States (location type not established)
Jurisdiction
No narrower jurisdiction recorded for this claim.
Where in the source
Feature Specific Sub-processors, OpenAI row
Source retrieved
Effective date
Claim independently reviewed

Source: List of Sub-processors · Reviewed

Processes data on behalf of another company

Asana

Asana → OpenAI OpCo, LLC

AI functionality

Applies to: Enabled Asana AI features.

When this applies

  • Specific AI features enabled.
Data, location and review details
Data categories
Not specified for this connection in the reviewed record. Do not assume all customer data.
Locations
United States (location type not established); Norway (location type not established)
Jurisdiction
No narrower jurisdiction recorded for this claim.
Where in the source
Feature-Specific OpenAI row
Source retrieved
Claim independently reviewed

Source: Asana Subprocessors · Reviewed

Processes data on behalf of another company

Ashby

Ashby → OpenAI

Third-party AI functionality

Applies to: Ashby recruiting platform and opted-in AI Tools.

When this applies

  • Customer opts into AI Tools
Data, location and review details
Data categories
Customer Data
Locations
No specific processing location established for this connection.
Jurisdiction
No narrower jurisdiction recorded for this claim.
Where in the source
AI Terms sections 2(a), 6(b)
Source retrieved
Effective date
Claim independently reviewed

Source: Ashby Terms for AI Features — named third-party AI services · Reviewed

Processes data on behalf of another company

Calendly

Calendly → OpenAI

AI features, Notetaker meeting summaries and SMS compliance

Applies to: Calendly customer Services; Calendly Notetaker.

When this applies

  • Purpose-specific use; table does not establish that every scheduling record is sent to this provider.

What remains unclear

  • Legal entity is not specified.
Data, location and review details
Data categories
Not specified for this connection in the reviewed record. Do not assume all customer data.
Locations
USA (hosting location)
Jurisdiction
No narrower jurisdiction recorded for this claim.
Where in the source
Table — OpenAI
Source retrieved
Claim independently reviewed

Source: Calendly sub-processors (GDPR, CCPA) · Reviewed

Processes data on behalf of another company

Check Point

Check Point → OpenAI

AI service

Applies to: AI Guardrails.

When this applies

  • Only AI Guardrails product scope.
Data, location and review details
Data categories
Not specified for this connection in the reviewed record. Do not assume all customer data.
Locations
United States (processing location)
Jurisdiction
No narrower jurisdiction recorded for this claim.
Where in the source
OpenAI row
Source retrieved
Claim independently reviewed

Source: Subprocessor disclosure · Reviewed

Processes data on behalf of another company

ClickUp

ClickUp → OpenAI

Application AI functionality

Applies to: ClickUp AI functionality.

When this applies

  • Relevant AI feature usage; exact model routing not specified.
Data, location and review details
Data categories
Not specified for this connection in the reviewed record. Do not assume all customer data.
Locations
USA (location type not established)
Jurisdiction
No narrower jurisdiction recorded for this claim.
Where in the source
AI OpenAI row
Source retrieved
Claim independently reviewed

Source: List of Sub-processors – ClickUp · Reviewed

Processes data on behalf of another company

Close

Close → OpenAI

AI functionality and tools.

Applies to: Close CRM.

When this applies

  • AI functionality purpose; exact feature enablement not specified.
Data, location and review details
Data categories
Not specified for this connection in the reviewed record. Do not assume all customer data.
Locations
No specific processing location established for this connection.
Jurisdiction
No narrower jurisdiction recorded for this claim.
Where in the source
Close subprocessors, OpenAI entry
Source retrieved
Claim independently reviewed

Source: Close CRM security and privacy · Reviewed

Showing 8 of 26 reviewed incoming connections. Browse all 26 connections to OpenAI.

Sources behind this explanation

Retrieval records when a source was opened. Review records when a particular claim was independently checked. Neither date guarantees that a source has stayed unchanged.