Where the processor plans to have sub-contractors process PII, it tells the relevant cloud service customers beforehand. 2019 guidance, not confirmed for this edition: general consent at the start of the service, timely notice of changes so the customer can object or terminate, disclosure of names and processing countries and how obligations flow down, under a non-disclosure agreement where publication would raise security risk.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.