Methodology
We report what a page says. Never what it means.
No score. No ranking. No model deciding what’s true. Here is how a vendor’s page becomes a finding, and where that can go wrong.
Every finding carries four things.
So you can check us instead of trusting us. This one is real.
Gong · data processing agreement
“Customer may object to the Processing of Customer's Personal Data by the New Sub-Processor, for reasonable and explained grounds, by providing a written objection … within 5 business days following Gong's written notice to Customer of the intended engagement with the New Sub-Processor.”
- read 2026-08-31
- sha256 cab59af09f81c04cb4e38b68afce317de95e2bd8dc6b701e7a848857830d2043
- 1The quoteWord for word, from the vendor's own page. Never paraphrased.
- 2The sourceThe exact address we read it from. One click takes you there.
- 3The dateWhen we read it. A page can say something else tomorrow.
- 4The fingerprintA hash of the copy we kept. If the page changes, so does this.
Read. Keep. Compare. Quote.
Read
Our scanner, XitherBot, opens the vendor's public page. It says who it is and follows robots.txt. If a page fails to load for it, we may read it through a third-party reader service.
Keep
We store a dated copy of exactly what we read, with a fingerprint (a SHA-256 hash) that changes if a single character does.
Compare
The next reading is checked against the copy before it. Formatting and boilerplate are set aside; a moved fact is not.
Quote
What moved is reported in the vendor's own words, with the source, the date and both fingerprints.
- Every day
- Sub-processor lists, most DPAs, model cards, changelogs, deprecation schedules, status pages
- Every week
- Privacy policies, terms of service, trust and security pages, pricing
The full list of pages we watch for any vendor is on that vendor’s record, free, with no sign-up.
Three things we don’t do.
We don't judge.
If a vendor says it doesn't train on your data, we record that it says so. Whether that's true is for your own review.
We don't guess why.
We can see that a page changed, and when. We can't see the reason, so we never write one.
We don't see the private side.
Emails to customers, contract amendments and calls are outside what we can read. Only published pages are.
Six rules the system can’t break.
Enforced by the database and by automated checks on every change, not by anyone remembering to follow them.
- 01
No source, no finding.
Every finding needs a URL, a read time, a fingerprint and a verbatim quote. The database refuses anything less.
- 02
No model writes the record.
Pages are assembled from stored findings. No sentence in the record is written by AI.
- 03
We never cite ourselves.
A source must be on a domain we neither own nor publish to.
- 04
Our reading sits beside theirs.
Any interpretation is labeled as ours and shown next to the quote it reads.
- 05
Silence is a gap, never a blank.
When we find nothing on a subject, the record says we haven't found it anywhere we looked. It never leaves a blank to be read as a yes.
- 06
A page must pass a check.
Pages are admitted by an automated check of each page's content, so a login wall or a page about something else is not filed as a DPA.
What can go wrong, and what we might miss.
No record of the web is complete. Here is where ours stops.
A vendor's site refuses our scanner.
The record says the page didn't load for us, never that the vendor publishes nothing. If a page fails to load for XitherBot, we may read it through a third-party reader service.
A page changes and changes back between readings.
We only see what is on the page when we read it. That is why sub-processor lists and most DPAs are read every day.
A vendor tells its customers privately.
Private notices never reach us. If a change appears only in an email, our record won't have it.
Our reader misreads a page.
Every finding carries its source and the fingerprint of the copy we read, so you can check it yourself. A change to a notice clause we quote is logged below, with the before, the after and the reason.
We haven't found a vendor's notice clause.
The record says we haven't isolated one. It never says the vendor's agreement has none.
A page moves to a new address.
The old address stops loading. The vendor's record shows that page's last reading and what it returned, until the new address is added and passes the same automated check.
Every change to a quoted notice clause, on the record.
Since September 30, 2026, when a notice clause we quote changes, the before, the after and the reason land here automatically, whether or not anyone chose the change.
2026-10-17Re-readToloka30 → 10 days
Re-survey of https://toloka.ai/legal/dpa_sag produced a different clause than the one previously published.
6.3. Changes. If the Processor adds or changes one or more Sub-Processor(s), it will notify the Controller at least 30 days prior to any such change and provide the Controller the opportunity to object to the engagement of the new Sub-Processors on reasonable grounds relating to the protection of Personal Data within 15 days.
If the Processor adds or changes one or more Sub-Processor(s), it will notify the Controller at least 10 days prior to any such change and provide the Controller the opportunity to object to the engagement of the new Sub-Processors on reasonable grounds relating to the protection of Personal Data within 10 days.
2026-10-12Re-readInsider
Re-survey of https://useinsider.com/legal/dpa produced a different clause than the one previously published.
Objection Right for New Sub-processors. Customer may object to Insider One’s use of a new Sub-processor by notifying Insider One promptly in writing within ten (10) business days after receipt of Insider One’s notice in accordance with Schedule 2.
5.3 Objection Right for New Sub-processors. Customer may object to Insider One’s use of a new Sub-processor by notifying Insider One promptly in writing within ten (10) business days after receipt of Insider One’s notice in accordance with Schedule 2.
2026-10-06Re-readPolyAI
Re-survey of https://poly.ai/dpa produced a different clause than the one previously published.
You must notify us if you object to the proposed change to the Authorised Sub-processors by providing us with written notice of the objection within fifteen (15) days after PolyAI has provided notice to you of such proposed change (an “ Objection “).
You must notify us if you object to the proposed change to the Authorised Sub-processors by providing us with written notice of the objection within fifteen (15) days after PolyAI has provided notice to you of such proposed change (an “Objection“).
2026-10-05Re-readMicrosoft
Re-survey of https://www.microsoft.com/licensing/docs/documents/download/MicrosoftProductandServicesDPA(WW)(English)(May2026)(CR).docx produced a different clause than the one previously published.
Microsoft will give Customer notice and, as applicable, update the website and provide Customer with a mechanism to obtain notice of that update of any new Subprocessor at least 6 months in advance of providing that Subprocessor with access to Customer Data or for subprocessors that support artificial intelligence functionality, 30 days’ notice with the ability to disable use of that subprocessor until at least 6 months after notice.
Microsoft will give Customer notice and, as applicable, update the website and provide Customer with a mechanism to obtain notice of that update of any new Subprocessor at least 6 months in advance of providing that Subprocessor with access to Customer Data or for subprocessors that support artificial intelligence functionality, 30 days’ notice with the ability to disable use of that subprocessor until at least 6 months after notice.
2026-10-05Re-readSema4.ai
Re-survey of https://sema4.ai/dpa produced a different clause than the one previously published.
3.5 Right to Object – Company may object in writing to Sema4.ai’s appointment of a new Sub-Processor on reasonable grounds relating to data protection by notifying Sema4.ai in writing within thirty (30) calendar days of receipt of notice in accordance with Section 3.4.
3.5 Right to Object – Company may object in writing to Sema4.ai ’s appointment of a new Sub-Processor on reasonable grounds relating to data protection by notifying Sema4.ai in writing within thirty (30) calendar days of receipt of notice in accordance with Section 3.4 .
2026-10-03Re-readSema4.ai
Re-survey of https://sema4.ai/dpa produced a different clause than the one previously published.
3.5 Right to Object – Company may object in writing to Sema4.ai ’s appointment of a new Sub-Processor on reasonable grounds relating to data protection by notifying Sema4.ai in writing within thirty (30) calendar days of receipt of notice in accordance with Section 3.4 .
3.5 Right to Object – Company may object in writing to Sema4.ai’s appointment of a new Sub-Processor on reasonable grounds relating to data protection by notifying Sema4.ai in writing within thirty (30) calendar days of receipt of notice in accordance with Section 3.4.
2026-10-02First publishedToloka
First publication of this clause, read from a snapshot of https://toloka.ai/legal/dpa_sag taken 2026-10-01.
6.3. Changes. If the Processor adds or changes one or more Sub-Processor(s), it will notify the Controller at least 30 days prior to any such change and provide the Controller the opportunity to object to the engagement of the new Sub-Processors on reasonable grounds relating to the protection of Personal Data within 15 days.
2026-10-02First publishedCoreWeave
First publication of this clause, read from a snapshot of https://docs.coreweave.com/policies/terms-of-service/sub-processors taken 2026-10-01.
CoreWeave will update this page at least 30 days before engaging a new sub-processor.
2026-10-01First publishedZscaler
First publication of this clause, read from a snapshot of https://www.zscaler.com/legal/data-processing-agreement taken 2026-10-01.
Customer may object to a new Sub-processor within thirty (30) days of such notice on reasonable grounds relating to data protection.
2026-10-01First publishedNebius
First publication of this clause, read from a snapshot of https://docs.nebius.com/legal/dpa taken 2026-10-01.
For the purposes of Clause 9 of the SCC (concerning Module Three transfers), the Parties choose the option 2 “General Written Authorisation” in Clause 9 of the SCC shall apply, and specify that the processor shall inform in writing the controller of any intended changes of that list through the addition or replacement of Sub-processors at least fifteen (15) days in advance, thereby giving the controller sufficient time to be able to object to such changes prior to the engagement of the concerned Sub-processor(s).
2026-10-01First publishedMicrosoft
First publication of this clause, read from a snapshot of https://www.microsoft.com/licensing/docs/documents/download/MicrosoftProductandServicesDPA(WW)(English)(May2026)(CR).docx taken 2026-10-01.
Microsoft will give Customer notice and, as applicable, update the website and provide Customer with a mechanism to obtain notice of that update of any new Subprocessor at least 6 months in advance of providing that Subprocessor with access to Customer Data or for subprocessors that support artificial intelligence functionality, 30 days’ notice with the ability to disable use of that subprocessor until at least 6 months after notice.
2026-10-01First publishedHugging Face
First publication of this clause, read from a snapshot of https://cdn-media.huggingface.co/landing/assets/Data+Processing+Agreement.pdf taken 2026-10-01.
6.3 When Provider engages any new Subprocessor after the effective date of the Agreement, Provider will update the Subprocessors List. If Customer objects to such engagement in a written notice to Provider within 30 days after the publication of the updated list on reasonable grounds relating to the protection of Personal Data, Customer and Provider will work together in good faith to find a mutually acceptable resolution to address such objection.
Every correction request, and what we decided.
Tell us a page says otherwise and we check it. Each decision lands here with our reason, whether we changed the record or not. We never name the person who asked.
No correction has been decided yet. The first one will appear here the day we decide it.
Nothing here is for sale.
Claim it. Free.
A vendor can claim its record with an email at its own domain and take a copy of its own record. The copy is free.
Correct it. Free.
Point us at the page that says otherwise. We check it and reply within 2–3 business days. Each decision is logged above with our reason. Always free.
Buy a change? No.
No vendor can buy a change to what we publish. Not an edit, a removal, a validation or a better position.
Don’t take our word for it. Every finding is produced mechanically, every quote can be checked against the vendor’s live page in one click, and every change to a quoted notice clause lands in the log above.
We don’t name which vendors hold a copy of their record. We do say how many: none so far.
Something wrong in your record?
Tell us and we’ll reply within 2–3 business days. If our scanner is being refused, allowlist XitherBot and your record can be kept current.