We know what your AI vendors did last summer.
And last week. And last night.
Your AI vendors change their promises by editing a web page, and your customers expect you to pass it on. Xither notices what matters, and notifies you.
No card. Nothing to cancel.
These pages move more often than your annual review.
of the sub-processor lists we watch were updated in the last 90 days.
Of the 63 lists that print a date, by the vendor’s own date.
of the vendors we watch rewrote a privacy policy, DPA, terms or sub-processor list in the past year.
Of 160 vendors that date those pages.
OpenAI, Anthropic, AWS and more than 180 others.
Name the ones inside your product. We read their sub-processor lists and most DPAs every day.
OpenAI · Anthropic · Amazon Web Services · Google Cloud · Microsoft · Databricks · Snowflake · Hugging Face · Pinecone · Mistral AI · Notion · Vercel 1,149 pages we watch. 913 we can read today.
Xither is not affiliated with, endorsed by, or in partnership with any company named here, and none has authorized this. We read the pages they publish, as anyone can. All names and marks belong to their respective owners.
The four things your customers ask about most.
A footer or a reworded heading never reaches your inbox.
Who touches your data.
The list of companies your vendor hands data to. A new name here is the change your customers ask about first.
What they promise you.
Data processing agreements (DPAs), privacy policies and terms. Retention, residency, and whether they train on your data.
What stops working.
Deprecation and retirement schedules, so the model your feature runs on doesn’t go dark on a Tuesday.
The deadline it sets.
Windows to object and notice periods. When a change starts one, you get the date it ends.
Nothing moves for weeks. Then one line does.
And the clock it starts is already running. You hear about it the morning we read it, in the vendor’s own words.
edits to the vendor pages we watch.
changed a fact: a sub-processor, a retention window, a retirement date.
hear about those, the morning we read them. Only those.
Xither to youHubSpot added three sub-processors for HubSpot AI
Three new rows on HubSpot’s sub-processor list. All three start on October 16.
- Baseten LabsAI Service Provider
- Bright DataWeb Search Results
- Exa LabsWeb Search Results
days to object, counted from when HubSpot notifies you. Your own customer notice is drafted and waiting.
A real change from the record, September 2026.
- Only what moves a fact.A new sub-processor, a shorter retention window, a retirement date.
- Their words, not ours.The exact lines that changed, with a dated copy of the page we read them from.
- Who you owe, by when.Matched to your own customer agreements, with the notice already written.
Watch
How a quiet edit on their page becomes your deadline.
A short film, 2 min 26 sec.
One line on their page. Two problems on yours.
When a vendor adds a company
Two clocks start.
The window your DPA gives you to object, and the notice you owe your own customers.
When a vendor removes one
Your disclosure is now wrong.
The page your customers were told to check quietly stops being true. The next person to notice is their security reviewer.
One we caught · September 17
IntouchCX Inc.
- Canada
- Customer support
Your window to object can be shorter than a week.
4 vendors give you 5 days to object to a new sub-processor. That’s the shortest we quote.
- 80
vendors whose notice clause we quote
- 55
give you a window to object
- 20
give a notice period instead
- 49
are shorter than 30 days
The other 5 state notice and a time to object together. See every clause
Demandbase
5 days to object
Window to object
“Customer may object in writing to Demandbase’s appointment of a new Sub-processor on reasonable grounds relating to data protection by notifying Demandbase promptly in writing within five (5) calendar days of an update to the Sub-processor List referenced in Section 3.3 and the parties shall discuss Customer concerns in good faith with a view to achieving a commercially reasonable resolution.”
Demandbase’s DPA, read October 9, 2026. Found by pattern, not yet read by a person.
Mistral AI
10 days to object
Window to objectSilence counts as approval
“The Customer may only object in writing to Mistral AI's appointment of a new Subprocessor within ten (10) days of such notice by providing a written objection to [email address on the vendor's page], provided that such objection is based on reasonable grounds relating to the Applicable Data Protection Law, otherwise such new Subprocessor will be deemed approved.”
Mistral AI’s DPA, read August 31, 2026. Read in context by a person.
Harvey
15 days to object
Window to object
“You may, within 15 days of receiving the notice of the change, reasonably object to Harvey’s use of a Subprocessor on reasonable grounds relating to the protection of Customer Personal Data (the “Objection”) by following the instructions set forth in the Subprocessor List or by contacting [email address on the vendor's page] (the “Objection Notice”).”
Harvey’s DPA, read October 16, 2026. Found by pattern, not yet read by a person.
DocuSign
30 days’ notice
Notice period
“Docusign will maintain an up-to-date list of its Subprocessors, and it will provide Customer with thirty (30) days’ prior notice of any new Subprocessor added to the list.”
DocuSign’s DPA, read October 17, 2026. Found by pattern, not yet read by a person.
Three questions you’ll be asked anyway.
The questionnaire
“List every AI sub-processor.”
Today that's an afternoon of re-reading vendor pages and hoping none moved. It should be a document you already have.
The clause you signed
“Notice before material changes.”
You can only pass on a change you've seen, and nothing obliges your vendor to make it visible.
The audit
“What changed this year?”
Answering means a dated copy of each page from before and after the change. We keep both.
What you can check, and what we can’t see.
Every quote links to the public page it came from, with the date we read it. We keep a dated copy of every reading.
Coverage is uneven. Of the 187 vendors we watch, we can quote:
- How they say they'll tell you: 47
- Models and APIs being retired: 36
- How long they keep it: 35
- Silence counted as consent: 18
We can’t see private notices, emails, contract amendments or roadmap calls. We don’t judge whether a statement is true, and we don’t score anyone.
Hear it while you can still do something about it.
Name your vendors. We’ll take it from there.
No card. Nothing to cancel. Plans from $49 a month after that.