Observed — verbatim
Gong — data processing addendum
Customer may object to the Processing of Customer's Personal Data by the New Sub-Processor, for reasonable and explained grounds, by providing a written objection … within 5 business days following Gong's written notice to Customer of the intended engagement with the New Sub-Processor.
gong.io/legal/data-processing-addendum
Read 2026-08-31 · sha256 cab59af09f81c04c… · copy held
Five business days, counted from a notice you only get if someone at your company is on the right mailing list. That clause is not unusual, and Gong is not doing anything wrong by publishing it — it is simply a deadline nobody is watching.
Also watched for Gong
- subprocessors
- dpa
- privacy
- terms
- trust
- pricing
Every one of them re-read on a schedule, and kept when it changes. Same for the other 183 vendors on the list.
For companies that use AI vendors and sell to enterprises
Your AI vendors change their terms by editing a page.
When they do, your promises change with them — and you are the one your customers ask.
Xither keeps a dated copy of every page your vendors publish — sub-processors, DPAs, retention and model terms, trust pages, changelogs, pricing — and tells you what moved, with the quote and the source.
Sometimes that is a deadline: a new sub-processor starts a clock your contract gives you ten days, sometimes five to answer. Sometimes it is a retention window, a model you depend on being retired, or a certification quietly dropped. They all arrive the same way, and none of them arrive in your inbox.
Every vendor in your stack, no card, nothing to cancel.
What your contracts already say
Most of these deadlines are shorter than a month.
We hold 70 data-processing agreements in full. 50 of them name a sub-processor, and 38 state an explicit deadline for objecting to a new one. 23 of those 38 give you less than thirty days. Counted from our own archive on 2026-08-31, and re-counted every time we publish.
Gong
5
business days
Customer may object to the Processing of Customer's Personal Data by the New Sub-Processor, for reasonable and explained grounds, by providing a written objection … within 5 business days following Gong's written notice to Customer of the intended engagement with the New Sub-Processor.
gong.io/legal/data-processing-addendum · read 2026-08-31 · sha256 cab59af09f81…
Mistral AI
10
days
The Customer may only object in writing to Mistral AI's appointment of a new Subprocessor within ten (10) days of such notice … otherwise such new Subprocessor will be deemed approved.
legal.mistral.ai/terms/data-processing-addendum · read 2026-08-31 · sha256 8778ed476e03…
Silence counts as approval
Demandbase
10
days
Demandbase shall update that Sub-Processor List at least 10 days prior to any addition of a new Sub-Processor.
demandbase.com/data-processing-agreement · read 2026-08-31 · sha256 9c1f580c6615…
Harvey
15
days
If You subscribe to receive email notifications at the Subprocessor List, then Harvey will notify You if Harvey intends to add one or more Subprocessors to the Subprocessor List at least 30 days before the change takes effect. You may, within 15 days of receiving the notice of the change, reasonably object …
harvey.ai/legal/data-processing-addendum · read 2026-08-31 · sha256 ee151b0c86f9…
Notice owed only if you subscribed
Eightfold AI
15
days
Eightfold will provide a notice, to those emails subscribed, at least thirty (30) days before allowing any new Subprocessor to process Customer Personal Data. The Customer may, within (fifteen) 15 days of the receipt of the notification, object in writing …
eightfold.ai/dpa · read 2026-08-31 · sha256 810256afb095…
Notice owed only if you subscribed
Datadog
30
days
Datadog will update the Subprocessors List at least 30 days before appointing a new Subprocessor and will provide Customer with a mechanism to receive notifications of new Subprocessors (a “Change Notice”), which today is available through the Subprocessors List.
datadoghq.com/legal/data-processing-addendum · read 2026-08-31 · sha256 b749e9e5aab8…
Inference — not observation
Two patterns in that set are worth your attention. 7 of the agreements we hold owe you notice only if someone at your company subscribed to a mailing list, so if nobody did, you may be owed nothing at all. And at least one states plainly that if you do not object in time, the new sub-processor is deemed approved. That is our reading of the clauses quoted above, which are printed in full so you can form your own.
Seven things a quiet edit can cost you
A deadline is only the sharpest one.
Sub-processors
A new company starts processing your customers' data
Your DPA gives you a window to object, and it opens when the vendor edits a list. Miss it and, in at least one agreement we hold, the new sub-processor is deemed approved.
Terms · privacy
Your data becomes training data
A clause about what may be used to improve the service is one sentence, and changing it changes what you have promised your own customers. This is the change that makes the news.
DPA · privacy
Retention or deletion windows move
You told a customer their data is deleted in 30 days. If your vendor now says 90, that commitment is no longer yours to keep, and you will find out during their audit rather than yours.
Sub-processors
Processing moves to another country
A region added to a sub-processor list is a cross-border transfer question, and for some of your customers a contractual one. It looks like a table edit.
Trust
A certification lapses, or a claim disappears
Trust pages are edited, not versioned. A SOC 2 date that quietly slips, or a paragraph that stops being there, is exactly what a customer's reviewer will ask you about.
Model cards · changelog
A model you depend on is retired
Deprecations are announced on a changelog with a date attached. If nobody is reading it, the date arrives as an outage.
Pricing
The renewal is not the number you budgeted
Public pricing moves ahead of renewals. Knowing when it moved, and what it said before, is the difference between a negotiation and a surprise.
We watch all seven surfaces on every vendor in your register, on a schedule, and keep a copy each time. What we cannot see is anything a vendor has not published — a private notice, a contract amendment, a roadmap call.
You are the one who has to answer for this.
All seven land on the same desk. Xither is built for companies that build on AI vendors and sell to enterprise customers, and in most of them that is one person — a security or GRC lead, a general counsel, sometimes the CTO — sitting between vendors who change quietly and customers who ask for proof.
The security questionnaire
A customer asks who processes their data, whether any of it trains a model, and how you would know if that changed. Today you re-read a dozen vendor pages and hope none moved since the last time. The answer pack is the thing you actually needed.
Nobody else is doing it
Watching a dozen vendors' legal pages is a job with no owner. It is too slow to notice by hand and too consequential to skip, so it quietly becomes yours the first time something goes wrong.
The renewal and the audit
Someone asks what changed across your AI stack in the last year, and there is no record because nobody kept one. A dated archive answers that in a paragraph instead of a project.
What we observe
We read a named set of public pages every week: sub-processor lists, DPAs, privacy and retention terms, trust pages, model and system cards, changelogs and pricing. You can see the full list of pages we watch for any vendor, because we publish it. When a page changes, we keep both copies, so the diff is checkable rather than asserted.
What we do not
We do not see anything a vendor has not published, which includes private notices, contract amendments and roadmap calls. We also do not verify whether a vendor's statement is accurate, and we do not score or rank anyone. Our record shows that they published it, and the date it changed. How we read a page.
Put your whole stack on the record.
Name every vendor you depend on and we will show you what their pages say today, what we hold from before, and what their contracts give you to work with. The trial takes no card, so there is nothing to cancel.