I’m downvoted but I still believe the position doesn’t make sense. You state and negotiate the level of protection you want for your data with your direct interlocutor. They then enforce that with their own suppliers.

You are free to want to know the whole chain of companies involved in providing you a service but that’s very unusual.