Use case · telling your customers
When do you owe your customers notice of a vendor change?
When the agreement you signed with them says so. Your vendor’s edit can start that clock.
If you sell to enterprise customers, their DPA may name a deadline. Here’s which clauses to look for, and how to meet them.
The chain
Their edit becomes your deadline.
Step one can happen without an email to anyone, and the clock at step three is yours.
A vendor in your product edits its sub-processor list.
That new company now handles your customers' data too.
Your agreement with each customer says how soon you must tell them.
What happens downstream follows one change all the way through.
What to look for
Three kinds of notice clause.
In the DPA or security addendum you signed with each customer.
A new sub-processor
- Started by
- A vendor in your product adds one to its list.
- Xither
- Triggered outright. The alert names who you owe and the date.
A material change
- Started by
- A vendor edits its DPA, terms, privacy or trust page.
- Xither
- Flagged as possible. Whether the change is material is your call.
A security breach
- Started by
- A vendor tells you of a breach affecting your data.
- Xither
- Not watched. We read published pages; we don't watch for breaches.
How Xither does it
Your deadline next to your vendor’s.
Optional. Without it you still hear about every change; you just don't get your own date.
Give us one agreement.
Upload the DPA or addendum you signed with a customer, as a PDF, Word file or pasted text.
Confirm what we found.
We pick out the sentences that name a deadline. You confirm each and name the customer it's owed to.
Get both deadlines.
When a vendor's change triggers one, the alert shows the vendor's window and yours side by side, with a drafted notice.
We read the document and discard it. Only its name and fingerprint stay with the clauses you confirmed.
Free
Templates for the notice itself.
Use them with or without Xither.
Fit
Is Xither the right tool for you?
Xither is for software teams that build with AI vendors and sell to businesses. It keeps your public sub-processor list current and watches the pages your vendors publish about your data: sub-processor lists, DPAs, privacy and trust pages, and model retirement schedules. When one changes, you get a message in Slack, Teams or email saying whether you need to do anything, with the lines that moved and any date that applies.
It fits when
- You build software with AI vendors inside it, and your customers ask who handles their data. Check your code
- Your DPA promises customers a current sub-processor list and notice when it changes. What you owe
- Your vendors' DPAs give you a fixed window to object to a new sub-processor, and you need to know the day it starts. Meeting the deadline
- Security questionnaires ask you to list every AI sub-processor in your product. How to answer
- You need proof of what a vendor's page said on a given date.
Use something else when
- You want to watch any page on the web, like a competitor's pricing. A general page-change monitor does that. Xither or Visualping
- You need a whole vendor risk program: questionnaires, risk scores, SOC 2 report reviews and breach alerts. A third-party risk platform does that. Xither and risk platforms
- We don't watch your vendors yet. Run the free scan first, or ask us to add them. Scan your page
- You need to know what a clause means for your contract. That's a lawyer's job; we report what a page says.
Price
What Xither costs.
Two plans, paid by card: Essentials at $10 a month and Pro at $49 a month. A one-time due-diligence pack costs $149. The scan, the public record and the MCP server are free.
- Essentials: $10 a month or $99 a year: daily watch on every vendor you name; alerts by email, Slack or Teams; your sub-processor page, hosted and kept current; your customers subscribe to it and get each change by email; drafted notices for your customers; dated evidence you can export.
- Pro: $49 a month or $490 a year: everything in Essentials; a one-page review of any AI vendor before you adopt it; security-questionnaire answers about your AI vendors, in one export; a monthly vendor-monitoring report for your auditor; up to 5 people.
A 14-day free trial of Pro. No card, so nothing to cancel.
Common questions.
- Do I have to tell my customers when my vendor adds a sub-processor?
- If your agreement says so. Under GDPR Article 28(2), a processor with general authorization must inform the controller of a new sub-processor, and your DPA sets how and when. Your vendor's new sub-processor is a new sub-processor of yours.
- Where do I find my notice obligations?
- In the DPA or security addendum you signed with each customer. Look for a sentence that names a period (days or hours) and says you must notify, inform or give notice.
- Does Xither read my customer contracts?
- Only if you give it one. You upload or paste an agreement; we find the notice clauses and you confirm which apply. The document itself is not stored, only its name and fingerprint.
- Does Xither send the notice to my customers?
- No. Each alert carries a drafted notice with the lines that moved and the vendor's page. You edit it and send it from your own mail.
Not legal advice.
Whether a change triggers a clause in your contract, and what notice it needs, is a question for your counsel.
Xither Staff Writer · reviewed October 31, 2026. Describes how Xither handles your own agreements as of the review date.
Hear the morning we read a change to your vendor’s sub-processor list or DPA.
Name the AI vendors in your product. When a page you watch changes a fact, you get the lines that moved and the date any window runs out.
Try it free for 14 daysNo card. Nothing to cancel.