Report · November 2026
The model labs are in almost every stack now. Most lists do not show it.
By Nikunj Kothari ·
A subprocessor list is the most honest document a software company publishes. It is a legal promise about who touches customer data, so companies have little reason to pad it. It shows what a company does, not what it says.
I read 756 of these lists. For 218 companies I have the list from March and from November, so I can see what changed. Then I followed every list one step further, into the lists of the company's own vendors. Three things stand out.
- 52% → 94%
- 52% of lists name OpenAI. 94% name OpenAI or a vendor that names it.
- 263 of 309
- companies with no model provider that use a vendor with one
- 55 vs 3
- 55 companies list more model providers than in March. 3 list fewer.
- 4 deals
- since March that changed who owns a vendor on these lists
1 · The hidden layer
Most companies are one vendor away from a model lab
309 of the 756 lists name no model provider at all. But 263 of those companies use at least one vendor whose own list does. Follow the chain one step and the labs go from about half the market to nearly all of it. The same holds for the two largest inference vendors, shown last.
- OpenAI
- Named on the company's own list: 52%Reached within two steps: 94%
- Anthropic
- Named on the company's own list: 41%Reached within two steps: 90%
- SpaceXAI
- Named on the company's own list: 5%Reached within two steps: 53%
- Google (Gemini)
- Named on the company's own list: 11%Reached within two steps: 51%
- Baseten
- Named on the company's own list: 9%Reached within two steps: 75%
- Fireworks AI
- Named on the company's own list: 8%Reached within two steps: 65%
The carriers are ordinary infrastructure. Companies that do not list Anthropic reach it most often through Cloudflare (135 companies), Datadog (109), Sentry (104), Twilio (94) and Zendesk (80). For OpenAI it is Cloudflare, Slack, Sentry, Datadog and Salesforce.
Two steps means the vendor has written a lab into its own data terms. Your security review approved Sentry. It did not review the model provider on Sentry's own list.
2 · Ownership
The independent AI stack is being bought
Four deals since March changed who stands behind a vendor on these lists. A subprocessor list names the product. It does not name the new parent.
- SpaceX buys Cursor
- Signed in June, reported closed in August, about $60B. Among the 218 companies, lists that name xAI or Cursor went from 6 to 17. Glean, Procore, Railway, Depot, Samsara, Ahrefs and Avoca now name Cursor as a subprocessor.
- Stripe buys OpenRouter
- Announced August 19. Stripe is on 39% of lists. It has agreed to buy the router in front of hundreds of models, and it already owns Metronome, which meters usage.
- Salesforce buys Fin (Intercom)
- Signed June 15, $3.6B. Salesforce, Slack, Tableau and Heroku together are on 44% of lists. With Intercom that becomes 51%.
- Dynatrace buys Arize
- $915M. In the same months Dynatrace listed a model provider, Anthropic, for the first time.
Cursor's own list after the deal is the most telling. It added two GPU clouds (CoreWeave and Nebius) and two more model sources (Google Gemini and Meta). It dropped Mistral, Turbopuffer, MongoDB and GitHub. It still lists Anthropic and OpenAI. A company owned by one lab names its parent's three rivals as subprocessors.
3 · The labs' own lists
The labs depend on each other's landlords, and on their own customers
The labs publish lists too. OpenAI lists AWS, Azure, Google Cloud, Oracle Cloud, CoreWeave and Cerebras. Anthropic lists AWS, Google Cloud and Azure, plus Palantir, Brave, Parallel, ElevenLabs and Turbopuffer.
There are 86 pairs where each company names the other as a subprocessor. Some of the loops: Anthropic and Cloudflare, Anthropic and ElevenLabs, Anthropic and Sentry, OpenAI and Salesforce, OpenAI and CoreWeave, Vercel and SpaceXAI, Fireworks AI and Linear.
One small move worth watching. OpenAI's March list had Intercom. Its November list does not, and Accenture is new on it. Anthropic's November list has Intercom. I do not know the reason. The months overlap with Salesforce agreeing to buy Intercom.
4 · Model providers
Almost nobody leaves a model provider. They add another.
Across the 218 companies, 55 list more foundation model providers than in March and 3 list fewer. No company removed OpenAI or Anthropic. Companies with two or more providers went from 33% to 44%.
- OpenAI
- March: 114November: 132
- Anthropic
- March: 76November: 100
- Google (Gemini)
- March: 7November: 24
- SpaceXAI
- March: 6November: 14
- Cohere
- March: 8November: 8
- Mistral
- March: 8November: 7
Anthropic grew twice as fast as OpenAI (32% against 16%). Gemini more than tripled. It was added by Cursor, Perplexity, Figma, Clay, Zed, Postman, Snyk and Wiz. There were six removals in the whole group, all in the second tier: Cohere (Asana, Notion), Mistral (Cursor), Amazon Nova (Box, Weaviate) and Meta Llama (Shopify). The big three grow. The middle stands still.
5 · The undercount
Many cloud entries are really a model entry
Many companies reach models through their cloud and list only the cloud. Reading the stated purpose of each entry: 81 of the 279 companies that list Azure say it is for AI or language models. So do 122 of the 506 that list Google Cloud and 66 of the 621 that list AWS. This is a keyword match on the purpose text, so treat it as a floor. Azure is the usual route to OpenAI models, so a count of OpenAI users taken from vendor names alone is too low.
6 · Late adopters
The new AI adopters are the old infrastructure companies
24 companies listed a model provider for the first time. Most are not AI startups. 16 chose Anthropic, 15 chose OpenAI, and 9 chose both at once.
Dynatrace, New Relic, Darktrace, Wiz, Netlify, Neon, Airbyte, Starburst, Qdrant, Brex, Procore, Tailscale, Iterable, Workato, Gumroad, Weights & Biases.
7 · Inference
Inference grew by half, and the leader changed
Companies with a model-serving vendor went from 22% to 33%. In March the most-listed serving vendor was Groq. In November it is Baseten. Baseten and Fireworks AI each gained 14 companies and lost none.
- Baseten
- March: 16November: 30
- Fireworks AI
- March: 14November: 28
- Groq
- March: 19November: 18
- Modal (code execution)
- March: 5November: 17
- Amazon Bedrock
- March: 6November: 10
The adopters are large products. Baseten: Datadog, HubSpot, MongoDB, Zapier, Glean, Sierra. Fireworks AI: Shopify, Asana, Datadog, Linear, Zapier. Modal: Notion, Linear, Glean, Sierra, Hex.
8 · China
Chinese AI vendors enter Western stacks through video, not text
ByteDance is on 9 lists, Kling on 9 and MiniMax on 7. The companies are creative tools: Canva, Figma, ElevenLabs, HeyGen, Synthesia, Luma AI, Runway, Hedra, InVideo. Chinese text models (DeepSeek, Moonshot) appear only on routers and low-code tools that let the customer pick the model: ngrok, Taskade, Glide, n8n, Browser Use.
9 · Fragmentation
Leaders are losing share, and three layers have a new leader
The 218 companies used 599 distinct vendors in March and 725 in November. In the layers I checked, the most-listed vendor lost share in most. Data pipelines are the exception.
- Stripe, of billing
- March share of the layer: 60%November share: 53%
- OpenAI, of model providers
- March share of the layer: 50%November share: 45%
- Exa, of web search
- March share of the layer: 42%November share: 36%
- Auth0, of auth
- March share of the layer: 27%November share: 19%
- Fivetran, of data pipelines
- March share of the layer: 33%November share: 37%
New leaders by number of lists: auth went from Auth0 to WorkOS, analytics from Segment to PostHog, model serving from Groq to Baseten. In support, Pylon gained 12 companies and lost none. Zendesk was dropped by Ada, CircleCI, Dynatrace, Netlify, New Relic and OpenRouter.
10 · Retrieval
Standalone embeddings are disappearing
Companies with a separate embeddings vendor fell from 6% to 3%. Jina AI went from 12 lists to 3. It is gone from the lists of Databricks, MongoDB, Shopify, Weaviate and Contentful. This rests on a small number of removals, so it is the weakest finding here. My read is that retrieval moved inside the model providers and the main database, but the lists do not prove that.
How this was measured
- Source: public subprocessor lists, trust centers and privacy policies. Vendor customer pages are not used in this report.
- March to November numbers compare only the 218 companies whose list did not shrink by more than half or grow by more than half. Bigger jumps usually mean we read the page more fully, not that the company changed.
- Two steps: company, then a vendor on its list, then a vendor on that vendor's list. It shows who a vendor is permitted to send data to. It does not show that a given customer's data goes there.
- Both directions have error. March lists were entered by hand, so some additions were already there in March and missed. A vendor missing in November can be a reading error. Every company named above as dropping a vendor was checked against the text of its November page.
- Two-step numbers depend on which vendors publish a list. More lists would raise them.
- Deal facts are from the companies' announcements: Stripe, Salesforce, Dynatrace. The SpaceX and Cursor closing date is from press reports that do not fully agree.
The live version of these numbers is on Insights. To see which labs a company reaches through its vendors, open any company page. Found a mistake? Tell me.