Enterprise security reviews increasingly look past a vendor’s headline certifications and into the vendors that support its service. That shift matters because sub-processors can handle personal data or support critical service functions without appearing prominently in a public sales process.