Skip to content

Report · November 2026

The model labs are in almost every stack now. Most lists do not show it.

By Nikunj Kothari ·

A subprocessor list is the most honest document a software company publishes. It is a legal promise about who touches customer data, so companies have little reason to pad it. It shows what a company does, not what it says.

I read 756 of these lists. For 218 companies I have the list from March and from November, so I can see what changed. Then I followed every list one step further, into the lists of the company's own vendors. Three things stand out.

52% → 94%
52% of lists name OpenAI. 94% name OpenAI or a vendor that names it.
263 of 309
companies with no model provider that use a vendor with one
55 vs 3
55 companies list more model providers than in March. 3 list fewer.
4 deals
since March that changed who owns a vendor on these lists

1 · The hidden layer

Most companies are one vendor away from a model lab

309 of the 756 lists name no model provider at all. But 263 of those companies use at least one vendor whose own list does. Follow the chain one step and the labs go from about half the market to nearly all of it. The same holds for the two largest inference vendors, shown last.

Named on the company's own list Reached within two steps
OpenAI
Named on the company's own list: 52%
Reached within two steps: 94%
Anthropic
Named on the company's own list: 41%
Reached within two steps: 90%
SpaceXAI
Named on the company's own list: 5%
Reached within two steps: 53%
Google (Gemini)
Named on the company's own list: 11%
Reached within two steps: 51%
Baseten
Named on the company's own list: 9%
Reached within two steps: 75%
Fireworks AI
Named on the company's own list: 8%
Reached within two steps: 65%

The carriers are ordinary infrastructure. Companies that do not list Anthropic reach it most often through Cloudflare (135 companies), Datadog (109), Sentry (104), Twilio (94) and Zendesk (80). For OpenAI it is Cloudflare, Slack, Sentry, Datadog and Salesforce.

Two steps means the vendor has written a lab into its own data terms. Your security review approved Sentry. It did not review the model provider on Sentry's own list.

2 · Ownership

The independent AI stack is being bought

Four deals since March changed who stands behind a vendor on these lists. A subprocessor list names the product. It does not name the new parent.

SpaceX buys Cursor
Signed in June, reported closed in August, about $60B. Among the 218 companies, lists that name xAI or Cursor went from 6 to 17. Glean, Procore, Railway, Depot, Samsara, Ahrefs and Avoca now name Cursor as a subprocessor.
Stripe buys OpenRouter
Announced August 19. Stripe is on 39% of lists. It has agreed to buy the router in front of hundreds of models, and it already owns Metronome, which meters usage.
Salesforce buys Fin (Intercom)
Signed June 15, $3.6B. Salesforce, Slack, Tableau and Heroku together are on 44% of lists. With Intercom that becomes 51%.
Dynatrace buys Arize
$915M. In the same months Dynatrace listed a model provider, Anthropic, for the first time.

Cursor's own list after the deal is the most telling. It added two GPU clouds (CoreWeave and Nebius) and two more model sources (Google Gemini and Meta). It dropped Mistral, Turbopuffer, MongoDB and GitHub. It still lists Anthropic and OpenAI. A company owned by one lab names its parent's three rivals as subprocessors.

3 · The labs' own lists

The labs depend on each other's landlords, and on their own customers

The labs publish lists too. OpenAI lists AWS, Azure, Google Cloud, Oracle Cloud, CoreWeave and Cerebras. Anthropic lists AWS, Google Cloud and Azure, plus Palantir, Brave, Parallel, ElevenLabs and Turbopuffer.

There are 86 pairs where each company names the other as a subprocessor. Some of the loops: Anthropic and Cloudflare, Anthropic and ElevenLabs, Anthropic and Sentry, OpenAI and Salesforce, OpenAI and CoreWeave, Vercel and SpaceXAI, Fireworks AI and Linear.

One small move worth watching. OpenAI's March list had Intercom. Its November list does not, and Accenture is new on it. Anthropic's November list has Intercom. I do not know the reason. The months overlap with Salesforce agreeing to buy Intercom.

4 · Model providers

Almost nobody leaves a model provider. They add another.

Across the 218 companies, 55 list more foundation model providers than in March and 3 list fewer. No company removed OpenAI or Anthropic. Companies with two or more providers went from 33% to 44%.

March November
OpenAI
March: 114
November: 132
Anthropic
March: 76
November: 100
Google (Gemini)
March: 7
November: 24
SpaceXAI
March: 6
November: 14
Cohere
March: 8
November: 8
Mistral
March: 8
November: 7

Anthropic grew twice as fast as OpenAI (32% against 16%). Gemini more than tripled. It was added by Cursor, Perplexity, Figma, Clay, Zed, Postman, Snyk and Wiz. There were six removals in the whole group, all in the second tier: Cohere (Asana, Notion), Mistral (Cursor), Amazon Nova (Box, Weaviate) and Meta Llama (Shopify). The big three grow. The middle stands still.

5 · The undercount

Many cloud entries are really a model entry

Many companies reach models through their cloud and list only the cloud. Reading the stated purpose of each entry: 81 of the 279 companies that list Azure say it is for AI or language models. So do 122 of the 506 that list Google Cloud and 66 of the 621 that list AWS. This is a keyword match on the purpose text, so treat it as a floor. Azure is the usual route to OpenAI models, so a count of OpenAI users taken from vendor names alone is too low.

6 · Late adopters

The new AI adopters are the old infrastructure companies

24 companies listed a model provider for the first time. Most are not AI startups. 16 chose Anthropic, 15 chose OpenAI, and 9 chose both at once.

Dynatrace, New Relic, Darktrace, Wiz, Netlify, Neon, Airbyte, Starburst, Qdrant, Brex, Procore, Tailscale, Iterable, Workato, Gumroad, Weights & Biases.

7 · Inference

Inference grew by half, and the leader changed

Companies with a model-serving vendor went from 22% to 33%. In March the most-listed serving vendor was Groq. In November it is Baseten. Baseten and Fireworks AI each gained 14 companies and lost none.

March November
Baseten
March: 16
November: 30
Fireworks AI
March: 14
November: 28
Groq
March: 19
November: 18
Modal (code execution)
March: 5
November: 17
Amazon Bedrock
March: 6
November: 10

The adopters are large products. Baseten: Datadog, HubSpot, MongoDB, Zapier, Glean, Sierra. Fireworks AI: Shopify, Asana, Datadog, Linear, Zapier. Modal: Notion, Linear, Glean, Sierra, Hex.

8 · China

Chinese AI vendors enter Western stacks through video, not text

ByteDance is on 9 lists, Kling on 9 and MiniMax on 7. The companies are creative tools: Canva, Figma, ElevenLabs, HeyGen, Synthesia, Luma AI, Runway, Hedra, InVideo. Chinese text models (DeepSeek, Moonshot) appear only on routers and low-code tools that let the customer pick the model: ngrok, Taskade, Glide, n8n, Browser Use.

9 · Fragmentation

Leaders are losing share, and three layers have a new leader

The 218 companies used 599 distinct vendors in March and 725 in November. In the layers I checked, the most-listed vendor lost share in most. Data pipelines are the exception.

March share of the layer November share
Stripe, of billing
March share of the layer: 60%
November share: 53%
OpenAI, of model providers
March share of the layer: 50%
November share: 45%
Exa, of web search
March share of the layer: 42%
November share: 36%
Auth0, of auth
March share of the layer: 27%
November share: 19%
Fivetran, of data pipelines
March share of the layer: 33%
November share: 37%

New leaders by number of lists: auth went from Auth0 to WorkOS, analytics from Segment to PostHog, model serving from Groq to Baseten. In support, Pylon gained 12 companies and lost none. Zendesk was dropped by Ada, CircleCI, Dynatrace, Netlify, New Relic and OpenRouter.

10 · Retrieval

Standalone embeddings are disappearing

Companies with a separate embeddings vendor fell from 6% to 3%. Jina AI went from 12 lists to 3. It is gone from the lists of Databricks, MongoDB, Shopify, Weaviate and Contentful. This rests on a small number of removals, so it is the weakest finding here. My read is that retrieval moved inside the model providers and the main database, but the lists do not prove that.

  • Source: public subprocessor lists, trust centers and privacy policies. Vendor customer pages are not used in this report.
  • March to November numbers compare only the 218 companies whose list did not shrink by more than half or grow by more than half. Bigger jumps usually mean we read the page more fully, not that the company changed.
  • Two steps: company, then a vendor on its list, then a vendor on that vendor's list. It shows who a vendor is permitted to send data to. It does not show that a given customer's data goes there.
  • Both directions have error. March lists were entered by hand, so some additions were already there in March and missed. A vendor missing in November can be a reading error. Every company named above as dropping a vendor was checked against the text of its November page.
  • Two-step numbers depend on which vendors publish a list. More lists would raise them.
  • Deal facts are from the companies' announcements: Stripe, Salesforce, Dynatrace. The SpaceX and Cursor closing date is from press reports that do not fully agree.

The live version of these numbers is on Insights. To see which labs a company reaches through its vendors, open any company page. Found a mistake? Tell me.