My impression was they can very much be compliant as long as they sign a contract with you that they only process data themselves in manner compliant with GDPR

My impression was they can very much be compliant as long as they sign a contract with you that they only process data themselves in manner compliant with GDPR in the services you make available for EU citizens.