Map Every Vendor Behind the AI Toggle Before You Turn It On

Consider one ordinary workflow: a support agent opens a ticket containing a customer-uploaded PDF and clicks “Summarize with AI.” The application shows a short answer beside the ticket. Its settings page identifies the model provider, which can make the data path look like a single transfer.

It rarely is.

The application vendor may store the PDF, extract its text with another service, submit that text to a model host, run the prompt or response through a safety filter, record traces in an observability platform, and copy selected content into a support system when an engineer investigates a failure. A subprocessor is a company hired by a processor to handle personal data on its behalf. Each company that receives the ticket content, attachment, derived text, or identifiable metadata belongs on the map.

This walkthrough produces that map. It is an operational review method, not legal advice, and it does not replace analysis of contracts, sector rules, or transfer requirements by qualified counsel.

Start with the data, not the vendor list

Return to the support ticket. Record exactly what the agent can submit: the message body, prior replies, account fields, the PDF, internal notes, and any text the application adds automatically. Then run a test with synthetic content containing distinct markers such as `PROMPT-MARKER`, `PDF-MARKER`, and `ACCOUNT-MARKER`. Synthetic data avoids exposing a real customer while making each copy easier to identify in exports and logs.

Capture the browser request, but do not treat it as the whole route. Developer tools may show only a call from the browser to the application vendor’s own domain; the consequential transfers usually happen from that vendor’s backend, outside the customer’s network view. Ask for the feature’s data-flow diagram, AI-specific security documentation, data processing addendum, and subprocessor list.

The useful unit is a handoff. For each one, write down the sending service, receiving legal entity, data elements, purpose, storage behavior, processing region, retention period, deletion trigger, encryption statement, and whether people can access the content. Add the document and section supporting every entry. “See privacy policy” is not a completed field.

Vendor documentation changes, so save the version reviewed or a dated copy. A live web page without a captured revision is weak evidence when an auditor later asks which terms applied when the feature was approved.

Follow the PDF through every service

The first node is the application vendor. Determine whether clicking “Summarize with AI” sends only the visible ticket or also includes conversation history, profile attributes, hidden system instructions, and attachments. A system instruction is vendor-written text that tells the model how to behave; it may contain workflow details but can also cause the application to retrieve more customer context than the user selected.

Next, isolate file handling. The application may pass the PDF directly to a model that accepts files, or it may use a parser, optical character recognition service, or malware scanner first. Optical character recognition converts text in an image into machine-readable characters. Those services count even if their output, rather than the original file, reaches the model host.

Derived text can preserve names, account numbers, health information, and document metadata.

Now trace the model call. Confirm the provider, product, hosting arrangement, and endpoint region. Documentation for a consumer chatbot does not establish the controls for an API, and documentation for a cloud-hosted model does not establish the behavior of the model maker’s own service. The contract should match the route that the application vendor uses.

Look for exact statements on training, abuse monitoring, temporary storage, and deletion. “Customer data is not used to train models” answers one question. It does not establish zero retention, prevent safety review, identify a processing location, or promise that backups disappear on the same schedule as the primary record.

The support-ticket PDF should now appear as at least three possible objects on the map: the original file, extracted text, and the prompt sent to the model. Keep them separate. They may have different destinations and deletion clocks.

Treat safety and logging as independent routes

Safety filters are easy to miss because the application presents them as part of the AI feature. A filter may inspect the prompt before generation, examine the response afterward, or do both. It may run inside the model service, inside the application vendor’s environment, or through another provider. Ask which arrangement applies and whether flagged content receives longer retention or human review.

Logging creates a second hidden route. An observability service, meaning software that records system behavior for debugging and performance analysis, may capture prompts, responses, user identifiers, file names, token counts, error messages, and model settings. Sampling does not remove the issue. It means only some requests are copied, often under rules that can change without an obvious update to the AI settings page.

Search the vendor’s documentation for prompt logging, trace collection, session replay, error reporting, and support diagnostics. Then test the synthetic markers. If `PDF-MARKER` appears in an administrator trace or downloadable diagnostic bundle, record that destination as a content-bearing system rather than labeling it “metadata only.”

Reducing logs has a cost. Engineers lose evidence needed to reproduce failures, evaluate unsafe outputs, and resolve billing disputes. A better control is often structured redaction before export, paired with short retention and access restrictions, but redaction can miss unexpected fields or sensitive text embedded in an attachment. The residual gap belongs in the approval record.

Extend the map to support access

The summary fails. An agent opens a support case with the application vendor and attaches a screenshot showing the bad output. That action creates another copy outside the original product path, possibly in a ticketing platform, file-sharing tool, email system, or engineering incident tracker.

Vendor subprocessor pages often name these general business systems without explaining whether they receive customer content from the AI feature. Ask how support personnel collect diagnostics, whether attachments are optional, where cases are hosted, which affiliates or contractors can access them, and when copied data is deleted. A contractual confidentiality clause is useful, but it is not a routing diagram.

Human access needs its own column. Distinguish routine access, access triggered by abuse detection, and access authorized through a support request. If the vendor says access is controlled, request the mechanism described in its documentation: role restrictions, approval workflows, audit logs, or customer-managed authorization. Record what is stated, not what the team assumes a mature vendor must do.

This is where the support-ticket workflow often leaves its chosen region. The model inference may stay in one geography while centralized support, security monitoring, or telemetry runs elsewhere. A regional endpoint is therefore evidence about one node, not proof that the whole feature remains in-region.

Reconcile retention one copy at a time

A single retention answer is inadequate. Write a deletion event for every object: ticket deletion, workspace closure, expiration after a fixed period, manual support-case removal, or log rotation. Then identify backups and legal or security exceptions described by the vendor.

Pay close attention to mismatched triggers. Deleting the ticket in the application may remove the visible PDF while leaving extracted text in a trace until that system’s separate retention period ends. Closing the account may start deletion at the application vendor but not at a support platform holding an attached diagnostic file. If the documentation does not connect those events, mark the deletion propagation as unverified.

Retention settings also differ from contractual commitments. A console control that allows an administrator to choose a shorter period is an implemented control only after someone configures it and preserves evidence of the configuration. A marketing statement can guide further research, but it should not close a review item.

Turn the map into an enablement decision

The final record should distinguish three states. “Verified” means a contract, product control, or current technical document supports the claim. “Vendor asserted” means the statement appears in documentation but lacks the contractual or configuration evidence your policy requires. “Unknown” means the route or condition remains unresolved.

A team can adopt a control statement such as:

Before production customer content enters an AI feature, the owner must identify every service that receives content or identifiable metadata, document its purpose, retention, processing location, and human-access conditions, and block the feature when a required field remains unknown.

That is proposed internal policy language, not a quotation from a law or a claim about what every organization must enforce. Its value is mechanical: an attractive “no training” statement cannot override an unknown logging destination, and a regional model endpoint cannot override an unverified support route.

Return once more to the “Summarize with AI” button. If the PDF parser has no documented deletion trigger, disable attachment summarization while allowing text-only summaries, provided the text route passes review. If telemetry cannot exclude prompt content, turn off that export or keep the feature in synthetic-data testing. Where the vendor cannot identify a downstream recipient, the fallback is the existing manual support workflow.

That fallback costs staff time, while tighter logging can slow incident response and regional routing may add configuration work, latency, or expense. Those are visible tradeoffs. An unmapped copy of customer data is not.

Questions people ask

Does a

“no training” promise mean customer data is not retained?

No. Training use and retention are separate controls. A provider may exclude API content from model training while temporarily storing prompts for abuse detection, debugging, or service delivery, so the review still needs the applicable retention period, deletion trigger, access conditions, and exceptions.

Is the model provider the only AI subprocessor that matters?

No. The application vendor may route files or derived text through parsing, safety, observability, and support services. A company belongs on the map when it receives customer content or identifiable metadata, even if it never runs a model and appears nowhere in the feature’s user interface.

Can network monitoring reveal the complete data path?

Usually not. Browser and firewall records can show the transfer into the application vendor, but server-to-server calls happen inside vendor infrastructure. Combine technical testing with the vendor’s architecture documents, subprocessor disclosures, data processing terms, configuration evidence, and written clarification of unresolved handoffs.

Should the feature stay off if one retention field is unknown?

That depends on the organization’s approved policy and the sensitivity of the data, not on a universal rule. A defensible fallback is to block production content, limit the feature to synthetic data, or narrow its scope, such as disabling PDF submission while a documented text-only route remains available.