Reference
Sub-processor notice windows, by vendor
When a vendor adds a sub-processor, its data processing agreement usually gives you a fixed period to object. The period runs from the vendor’s publication, not from the day you notice. Below is every window we have been able to quote from the vendor’s own agreement, shortest first.
36 vendors state a window we can quote. 5 were read in context by a person; the rest were found by pattern and are marked.
| Vendor | Window | Read on | How we found it |
|---|---|---|---|
| Gong | 5 business days | Aug 31, 2026 | read by a person |
| Airtable | 10 business days | Aug 31, 2026 | found by pattern |
| Lovable | 20 business days | Aug 31, 2026 | found by pattern |
| Vercel | 5 days | Aug 31, 2026 | found by pattern |
| Anyscale | 10 days | Aug 31, 2026 | found by pattern |
| AssemblyAI | 10 days | Aug 31, 2026 | found by pattern |
| Braintrust | 10 days | Aug 31, 2026 | found by pattern |
| Demandbase | 10 days | Aug 31, 2026 | read by a person |
| Hebbia | 10 days | Aug 31, 2026 | found by pattern |
| Langfuse | 10 days | Aug 31, 2026 | found by pattern |
| LiveKit | 10 days | Aug 31, 2026 | found by pattern |
| LogicMonitor | 10 days | Aug 31, 2026 | found by pattern |
| Mistral AI | 10 days | Aug 31, 2026 | read by a person |
| Poolside | 10 days | Aug 31, 2026 | found by pattern |
| Vespa | 10 days | Aug 31, 2026 | found by pattern |
| Zapier | 14 days | Aug 31, 2026 | found by pattern |
| Baseten | 15 days | Aug 31, 2026 | found by pattern |
| Cognition | 15 days | Aug 31, 2026 | found by pattern |
| PolyAI | 15 days | Aug 31, 2026 | found by pattern |
| Smartsheet | 15 days | Aug 31, 2026 | found by pattern |
| xAI | 15 days | Aug 31, 2026 | found by pattern |
| Intercom | 20 days | Aug 31, 2026 | found by pattern |
| Atlassian | 30 days | Aug 31, 2026 | found by pattern |
| Automation Anywhere | 30 days | Aug 31, 2026 | found by pattern |
| Dataiku | 30 days | Aug 31, 2026 | found by pattern |
| Eightfold AI | 30 days | Aug 31, 2026 | read by a person |
| ElevenLabs | 30 days | Aug 31, 2026 | found by pattern |
| H2O.ai | 30 days | Aug 31, 2026 | found by pattern |
| Harvey | 30 days | Aug 31, 2026 | read by a person |
| HireVue | 30 days | Aug 31, 2026 | found by pattern |
| Insider | 30 days | Aug 31, 2026 | found by pattern |
| Lucidworks | 30 days | Aug 31, 2026 | found by pattern |
| MongoDB | 30 days | Aug 31, 2026 | found by pattern |
| Rev | 30 days | Aug 31, 2026 | found by pattern |
| Salesloft | 30 days | Aug 31, 2026 | found by pattern |
| Weaviate | 30 days | Aug 31, 2026 | found by pattern |
Gong — 5 business days
Customer may object to the Processing of Customer’s Personal Data by the New Sub-Processor, for reasonable and explained grounds, by providing a written objection to [email protected] within 5 business days following Gong’s written notice to Customer of the intended engagement with the New Sub-Processor.
https://gong.io/legal/data-processing-addendum · read Aug 31, 2026 · snapshot cab59af09f81 · read by a person
Airtable — 10 business days
Airtable will provide notice of updates to that list at least ten (10) business days in advance of any intended additions or replacements of sub-processors, in accordance with Section 5 of this DPA.
https://airtable.com/dpa · read Aug 31, 2026 · snapshot b7aad2e67613 · found by pattern
Lovable — 20 business days
In the event that the Customer does not wish to consent to the use of a new Sub-processor, the Customer may notify Lovable within twenty (20) business days of Lovable notifying the Customer, that the Customer does not consent on reasonable grounds relating to the protection of Personal Data by contacting privacy@lovable.dev.
https://lovable.dev/data-processing-agreement · read Aug 31, 2026 · snapshot 744713e640bf · found by pattern
Vercel — 5 days
If, within five (5) calendar days after such notice, Customer notifies Vercel in writing that Customer objects to Vercel's appointment of a new Subprocessor based on reasonable data protection concerns, the parties will discuss such concerns in good faith and whether they can be resolved.
https://vercel.com/legal/dpa · read Aug 31, 2026 · snapshot 39299ad58649 · found by pattern
Anyscale — 10 days
(c) Anyscale shall notify Customer if it engages a new Subprocessor at least ten (10) days prior to any such change if Customer opts-in to receive such notifications in the manner made available on the Subprocessor List.
https://anyscale.com/dpa · read Aug 31, 2026 · snapshot 9f39bea95b71 · found by pattern
AssemblyAI — 10 days
At least ten (10) days before enabling any third party other than existing Authorized Subprocessors to access or participate in the processing of Personal Data, AssemblyAI will add such third party to the List and notify Customer via the email address subscribed to receive notifications of New Subprocessors as described herein.
https://assemblyai.com/legal/data-processing-addendum · read Aug 31, 2026 · snapshot 41df076a0966 · found by pattern
Braintrust — 10 days
At least ten (10) days before enabling any third party other than existing Authorized Subprocessors to access or participate in the processing of Personal Data, Company will add such third party to the List and notify Customer via email.
https://braintrust.dev/legal/dpa · read Aug 31, 2026 · snapshot e1f817c48241 · found by pattern
Demandbase — 10 days
Demandbase shall update that Sub-Processor List at least 10 days prior to any addition of a new Sub-Processor.
https://demandbase.com/data-processing-agreement · read Aug 31, 2026 · snapshot 9c1f580c6615 · read by a person
Hebbia — 10 days
If Customer does not object to the engagement of a third party in accordance with Section 4.2 within ten (10) days of notice by Hebbia, that third party will be deemed an Authorized Sub-Processor for the purposes of this DPA.
https://hebbia.com/dpa · read Aug 31, 2026 · snapshot 391e4ff1e942 · found by pattern
Langfuse — 10 days
Customer may object in writing to ClickHouse's appointment of a new Sub-Processor by notifying ClickHouse promptly in writing within ten (10) calendar days of notice of the change.
https://langfuse.com/dpa · read Aug 31, 2026 · snapshot f9debf41aeb4 · found by pattern
LiveKit — 10 days
With respect to LiveKit's Sub-processors, LiveKit will give written notice no less than ten (10) days prior to any such change. 6.3 Objection Right for new Sub-processors.
https://livekit.io/legal/data-processing-addendum · read Aug 31, 2026 · snapshot 9854ddbe8065 · found by pattern
LogicMonitor — 10 days
Customer may object to the engagement of such New Sub-processor by notifying LogicMonitor within ten (10) days of LogicMonitor's notification, provided that such objection must be on reasonable, substantial grounds, directly related to such New Sub-processor's ability to comply with substantially similar obligations to those set out in this Addendum (an "Objection").
https://logicmonitor.com/legal/data-processing-addendum · read Aug 31, 2026 · snapshot 5fdd6ca730dd · found by pattern
Mistral AI — 10 days
The Customer may only object in writing to Mistral AI's appointment of a new Subprocessor within ten (10) days of such notice by providing a written objection to privacy@mistral.ai, provided that such objection is based on reasonable grounds relating to the Applicable Data Protection Law, otherwise such new Subprocessor will be deemed approved.
https://legal.mistral.ai/terms/data-processing-addendum · read Aug 31, 2026 · snapshot 8778ed476e03 · read by a person
Poolside — 10 days
At least ten (10) days before enabling any third party other than existing Authorized Subprocessors to access or participate in the processing of Personal Data, Company will add such third party to the List and provide a mechanism for Customer to receive notice of that update.
https://poolside.ai/legal/dpa · read Aug 31, 2026 · snapshot db099ed49ca2 · found by pattern
Vespa — 10 days
At least ten (10) days before enabling any new Sub-Processors the new Sub-Processor will be added to the List.
https://vespa.ai/data-processing-agreement · read Aug 31, 2026 · snapshot 8b7f0f87275a · found by pattern
Zapier — 14 days
In the event that Zapier updates the Subprocessor List, Zapier will provide fourteen (14) days’ advance written notice (which may be via email, a posting, notification on an online portal for our services, or other reasonable means). 9.5.
https://zapier.com/dpa · read Aug 31, 2026 · snapshot fd02c3fa6453 · found by pattern
Baseten — 15 days
Baseten shall notify Customer at least fifteen (15) days prior to engaging a new Sub-Processor by updating the Sub-Processor List or sending notification. - Objection Right for New Subprocessors. Customer may object in writing to a new Sub-Processor based on reasonable data protection concerns by emailing privacy@baseten.co within ten (10) calendar days of notice.
https://baseten.co/dpa · read Aug 31, 2026 · snapshot 2350adf168b1 · found by pattern
Cognition — 15 days
If Customer does not object within fifteen (15) days of receiving notice, Customer shall be deemed to have accepted the updated Subprocessor list.
https://cognition.ai/dpa · read Aug 31, 2026 · snapshot a3abc3c20417 · found by pattern
PolyAI — 15 days
You must notify us if you object to the proposed change to the Authorised Sub-processors by providing us with written notice of the objection within fifteen (15) days after PolyAI has provided notice to you of such proposed change (an “ Objection “). 8.4 In the event of an Objection, the parties shall work together in good faith to find a mutually acceptable resolution to address such Objection.
https://poly.ai/dpa · read Aug 31, 2026 · snapshot 732179b3ad44 · found by pattern
Smartsheet — 15 days
Customer's failure to provide written notice of objection within such fifteen (15) day period shall constitute Customer's approval and authorization of the new Subprocessor's appointment.
https://smartsheet.com/legal/dpa · read Aug 31, 2026 · snapshot 0bff0aa5ecea · found by pattern
xAI — 15 days
You may object on reasonable grounds relating to data protection to our engagement of any new or replacement Subprocessor by informing us in writing within fifteen (15) days after receiving notice.
https://x.ai/legal/data-processing-addendum · read Aug 31, 2026 · snapshot 02df9ff3fd28 · found by pattern
Intercom — 20 days
Intercom will notify Customer if it intends to add or replace Sub-processors from the Sub-Processor Page at least twenty (20) days prior to any such changes.
https://intercom.com/data-processing-agreement · read Aug 31, 2026 · snapshot ee76248a68f4 · found by pattern
Atlassian — 30 days
Atlassian will provide such notice, to those emails subscribed, at least thirty (30) days before allowing any new Sub-processor to Process Customer Personal Data (the “Sub-processor Notice Period”). 4.3 Objection to New Sub-processors.
https://atlassian.com/legal/data-processing-addendum · read Aug 31, 2026 · snapshot a4a76ad105d6 · found by pattern
Automation Anywhere — 30 days
At least 30 days before any new Subprocessor Processes any Customer Personal Data, AAI will add such Subprocessor to the Subprocessor List and notify Customer through email and the support portal.
https://automationanywhere.com/legal/dpa · read Aug 31, 2026 · snapshot 67abcd773770 · found by pattern
Dataiku — 30 days
If Customer does not object within the said period of thirty (30) days, Customer is deemed to have accepted the new Subprocessor.
https://dataiku.com/legal/data-processing-addendum · read Aug 31, 2026 · snapshot bf87d89961f9 · found by pattern
Eightfold AI — 30 days
Eightfold will provide a notice, to those emails subscribed, at least thirty (30) days before allowing any new Subprocessor to process Customer Personal Data.
https://eightfold.ai/dpa · read Aug 31, 2026 · snapshot 810256afb095 · read by a person
ElevenLabs — 30 days
ElevenLabs will notify Customer at least thirty (30) days prior to appointing any new or replacement Subprocessor (“Notice Period”) by updating the Subprocessor List.
https://elevenlabs.io/dpa · read Aug 31, 2026 · snapshot d282e82b19f8 · found by pattern
H2O.ai — 30 days
Customer may object to a new Subprocessor within thirty (30) days of such notice on reasonable data protection grounds.
https://h2o.ai/legal/dpa · read Aug 31, 2026 · snapshot b74466d17e81 · found by pattern
Harvey — 30 days
If You subscribe to receive email notifications at the Subprocessor List, then Harvey will notify You if Harvey intends to add one or more Subprocessors to the Subprocessor List at least 30 days before the change takes effect.
https://harvey.ai/legal/data-processing-addendum · read Aug 31, 2026 · snapshot ee151b0c86f9 · read by a person
HireVue — 30 days
The data importer shall specifically inform the data exporter in writing of any intended changes to that list through the addition or replacement of sub-processors at least 30 days in advance, thereby giving the data exporter sufficient time to be able to object to such changes prior to the engagement of the sub-processor(s).
https://hirevue.com/legal/dpa · read Aug 31, 2026 · snapshot 7b7c43638a24 · found by pattern
Insider — 30 days
If Insider One is unable to make available such change within a reasonable period of time, which shall not exceed thirty (30) days, Customer may terminate the applicable Order Form(s) with respect only to those Services which cannot be provided by Insider One without the use of the objected-to new Sub-processor, by providing written notice to Insider One.
https://useinsider.com/legal/dpa · read Aug 31, 2026 · snapshot 973ff7c99281 · found by pattern
Lucidworks — 30 days
We will give you the opportunity to object to the engagement of new Subprocessors on reasonable grounds relating to the protection of Personal Data within 30 days of notifying you.
https://lucidworks.com/legal/dpa · read Aug 31, 2026 · snapshot 4fb55c7b06ca · found by pattern
MongoDB — 30 days
We maintain a current list of our Subprocessors at: https://www.mongodb.com/products/platform/trust/subprocessors which we will update at least 30 days before the addition or replacement of any Subprocessor.
https://mongodb.com/legal/dpa · read Aug 31, 2026 · snapshot 4a0902e0e3c6 · found by pattern
Rev — 30 days
On at least 30 days’ notice to Customer, Rev may engage new Subprocessors subject to requirements of Privacy Laws.
https://rev.com/legal/data-processing-addendum · read Aug 31, 2026 · snapshot fd37ce76dc15 · found by pattern
Salesloft — 30 days
Customer will have thirty (30) days from such notice to object to the newly proposed Sub-Processor.
https://salesloft.com/legal/data-processing-addendum · read Aug 31, 2026 · snapshot d62dcda1f8cf · found by pattern
Weaviate — 30 days
The Customer, upon being informed, may object to the appointment of that Subprocessor within 30 days on reasonable data protection grounds.
https://weaviate.io/dpa · read Aug 31, 2026 · snapshot 04705ac5e06a · found by pattern
What this table is not
It is not legal advice, and it is not your agreement. Your contract with a vendor may replace these terms. What is quoted here is the published document on the date shown; a negotiated addendum will say something else.
A vendor absent from this table has not been found to state a window we can quote. That covers vendors whose agreement states none, and vendors whose agreement we cannot read. Where vendors publish separates those two.
What happens downstream when an AI vendor changes a page works through what one of these periods costs the company that embeds the vendor, and the enterprise behind it.