Reference

Sub-processor notice windows, by vendor

When a vendor adds a sub-processor, its data processing agreement usually gives you a fixed period to object. The period runs from the vendor’s publication, not from the day you notice. Below is every window we have been able to quote from the vendor’s own agreement, shortest first.

36 vendors state a window we can quote. 5 were read in context by a person; the rest were found by pattern and are marked.

VendorWindowRead onHow we found it
Gong5 business daysAug 31, 2026read by a person
Airtable10 business daysAug 31, 2026found by pattern
Lovable20 business daysAug 31, 2026found by pattern
Vercel5 daysAug 31, 2026found by pattern
Anyscale10 daysAug 31, 2026found by pattern
AssemblyAI10 daysAug 31, 2026found by pattern
Braintrust10 daysAug 31, 2026found by pattern
Demandbase10 daysAug 31, 2026read by a person
Hebbia10 daysAug 31, 2026found by pattern
Langfuse10 daysAug 31, 2026found by pattern
LiveKit10 daysAug 31, 2026found by pattern
LogicMonitor10 daysAug 31, 2026found by pattern
Mistral AI10 daysAug 31, 2026read by a person
Poolside10 daysAug 31, 2026found by pattern
Vespa10 daysAug 31, 2026found by pattern
Zapier14 daysAug 31, 2026found by pattern
Baseten15 daysAug 31, 2026found by pattern
Cognition15 daysAug 31, 2026found by pattern
PolyAI15 daysAug 31, 2026found by pattern
Smartsheet15 daysAug 31, 2026found by pattern
xAI15 daysAug 31, 2026found by pattern
Intercom20 daysAug 31, 2026found by pattern
Atlassian30 daysAug 31, 2026found by pattern
Automation Anywhere30 daysAug 31, 2026found by pattern
Dataiku30 daysAug 31, 2026found by pattern
Eightfold AI30 daysAug 31, 2026read by a person
ElevenLabs30 daysAug 31, 2026found by pattern
H2O.ai30 daysAug 31, 2026found by pattern
Harvey30 daysAug 31, 2026read by a person
HireVue30 daysAug 31, 2026found by pattern
Insider30 daysAug 31, 2026found by pattern
Lucidworks30 daysAug 31, 2026found by pattern
MongoDB30 daysAug 31, 2026found by pattern
Rev30 daysAug 31, 2026found by pattern
Salesloft30 daysAug 31, 2026found by pattern
Weaviate30 daysAug 31, 2026found by pattern

Gong5 business days

Customer may object to the Processing of Customer’s Personal Data by the New Sub-Processor, for reasonable and explained grounds, by providing a written objection to [email protected] within 5 business days following Gong’s written notice to Customer of the intended engagement with the New Sub-Processor.

https://gong.io/legal/data-processing-addendum · read Aug 31, 2026 · snapshot cab59af09f81 · read by a person

Airtable10 business days

Airtable will provide notice of updates to that list at least ten (10) business days in advance of any intended additions or replacements of sub-processors, in accordance with Section 5 of this DPA.

https://airtable.com/dpa · read Aug 31, 2026 · snapshot b7aad2e67613 · found by pattern

Lovable20 business days

In the event that the Customer does not wish to consent to the use of a new Sub-processor, the Customer may notify Lovable within twenty (20) business days of Lovable notifying the Customer, that the Customer does not consent on reasonable grounds relating to the protection of Personal Data by contacting privacy@lovable.dev.

https://lovable.dev/data-processing-agreement · read Aug 31, 2026 · snapshot 744713e640bf · found by pattern

Vercel5 days

If, within five (5) calendar days after such notice, Customer notifies Vercel in writing that Customer objects to Vercel's appointment of a new Subprocessor based on reasonable data protection concerns, the parties will discuss such concerns in good faith and whether they can be resolved.

https://vercel.com/legal/dpa · read Aug 31, 2026 · snapshot 39299ad58649 · found by pattern

Anyscale10 days

(c) Anyscale shall notify Customer if it engages a new Subprocessor at least ten (10) days prior to any such change if Customer opts-in to receive such notifications in the manner made available on the Subprocessor List.

https://anyscale.com/dpa · read Aug 31, 2026 · snapshot 9f39bea95b71 · found by pattern

AssemblyAI10 days

At least ten (10) days before enabling any third party other than existing Authorized Subprocessors to access or participate in the processing of Personal Data, AssemblyAI will add such third party to the List and notify Customer via the email address subscribed to receive notifications of New Subprocessors as described herein.

https://assemblyai.com/legal/data-processing-addendum · read Aug 31, 2026 · snapshot 41df076a0966 · found by pattern

Braintrust10 days

At least ten (10) days before enabling any third party other than existing Authorized Subprocessors to access or participate in the processing of Personal Data, Company will add such third party to the List and notify Customer via email.

https://braintrust.dev/legal/dpa · read Aug 31, 2026 · snapshot e1f817c48241 · found by pattern

Demandbase10 days

Demandbase shall update that Sub-Processor List at least 10 days prior to any addition of a new Sub-Processor.

https://demandbase.com/data-processing-agreement · read Aug 31, 2026 · snapshot 9c1f580c6615 · read by a person

Hebbia10 days

If Customer does not object to the engagement of a third party in accordance with Section 4.2 within ten (10) days of notice by Hebbia, that third party will be deemed an Authorized Sub-Processor for the purposes of this DPA.

https://hebbia.com/dpa · read Aug 31, 2026 · snapshot 391e4ff1e942 · found by pattern

Langfuse10 days

Customer may object in writing to ClickHouse's appointment of a new Sub-Processor by notifying ClickHouse promptly in writing within ten (10) calendar days of notice of the change.

https://langfuse.com/dpa · read Aug 31, 2026 · snapshot f9debf41aeb4 · found by pattern

LiveKit10 days

With respect to LiveKit's Sub-processors, LiveKit will give written notice no less than ten (10) days prior to any such change. 6.3 Objection Right for new Sub-processors.

https://livekit.io/legal/data-processing-addendum · read Aug 31, 2026 · snapshot 9854ddbe8065 · found by pattern

LogicMonitor10 days

Customer may object to the engagement of such New Sub-processor by notifying LogicMonitor within ten (10) days of LogicMonitor's notification, provided that such objection must be on reasonable, substantial grounds, directly related to such New Sub-processor's ability to comply with substantially similar obligations to those set out in this Addendum (an "Objection").

https://logicmonitor.com/legal/data-processing-addendum · read Aug 31, 2026 · snapshot 5fdd6ca730dd · found by pattern

Mistral AI10 days

The Customer may only object in writing to Mistral AI's appointment of a new Subprocessor within ten (10) days of such notice by providing a written objection to privacy@mistral.ai, provided that such objection is based on reasonable grounds relating to the Applicable Data Protection Law, otherwise such new Subprocessor will be deemed approved.

https://legal.mistral.ai/terms/data-processing-addendum · read Aug 31, 2026 · snapshot 8778ed476e03 · read by a person

Poolside10 days

At least ten (10) days before enabling any third party other than existing Authorized Subprocessors to access or participate in the processing of Personal Data, Company will add such third party to the List and provide a mechanism for Customer to receive notice of that update.

https://poolside.ai/legal/dpa · read Aug 31, 2026 · snapshot db099ed49ca2 · found by pattern

Vespa10 days

At least ten (10) days before enabling any new Sub-Processors the new Sub-Processor will be added to the List.

https://vespa.ai/data-processing-agreement · read Aug 31, 2026 · snapshot 8b7f0f87275a · found by pattern

Zapier14 days

In the event that Zapier updates the Subprocessor List, Zapier will provide fourteen (14) days’ advance written notice (which may be via email, a posting, notification on an online portal for our services, or other reasonable means). 9.5.

https://zapier.com/dpa · read Aug 31, 2026 · snapshot fd02c3fa6453 · found by pattern

Baseten15 days

Baseten shall notify Customer at least fifteen (15) days prior to engaging a new Sub-Processor by updating the Sub-Processor List or sending notification. - Objection Right for New Subprocessors. Customer may object in writing to a new Sub-Processor based on reasonable data protection concerns by emailing privacy@baseten.co within ten (10) calendar days of notice.

https://baseten.co/dpa · read Aug 31, 2026 · snapshot 2350adf168b1 · found by pattern

Cognition15 days

If Customer does not object within fifteen (15) days of receiving notice, Customer shall be deemed to have accepted the updated Subprocessor list.

https://cognition.ai/dpa · read Aug 31, 2026 · snapshot a3abc3c20417 · found by pattern

PolyAI15 days

You must notify us if you object to the proposed change to the Authorised Sub-processors by providing us with written notice of the objection within fifteen (15) days after PolyAI has provided notice to you of such proposed change (an “ Objection “). 8.4 In the event of an Objection, the parties shall work together in good faith to find a mutually acceptable resolution to address such Objection.

https://poly.ai/dpa · read Aug 31, 2026 · snapshot 732179b3ad44 · found by pattern

Smartsheet15 days

Customer's failure to provide written notice of objection within such fifteen (15) day period shall constitute Customer's approval and authorization of the new Subprocessor's appointment.

https://smartsheet.com/legal/dpa · read Aug 31, 2026 · snapshot 0bff0aa5ecea · found by pattern

xAI15 days

You may object on reasonable grounds relating to data protection to our engagement of any new or replacement Subprocessor by informing us in writing within fifteen (15) days after receiving notice.

https://x.ai/legal/data-processing-addendum · read Aug 31, 2026 · snapshot 02df9ff3fd28 · found by pattern

Intercom20 days

Intercom will notify Customer if it intends to add or replace Sub-processors from the Sub-Processor Page at least twenty (20) days prior to any such changes.

https://intercom.com/data-processing-agreement · read Aug 31, 2026 · snapshot ee76248a68f4 · found by pattern

Atlassian30 days

Atlassian will provide such notice, to those emails subscribed, at least thirty (30) days before allowing any new Sub-processor to Process Customer Personal Data (the “Sub-processor Notice Period”). 4.3 Objection to New Sub-processors.

https://atlassian.com/legal/data-processing-addendum · read Aug 31, 2026 · snapshot a4a76ad105d6 · found by pattern

Automation Anywhere30 days

At least 30 days before any new Subprocessor Processes any Customer Personal Data, AAI will add such Subprocessor to the Subprocessor List and notify Customer through email and the support portal.

https://automationanywhere.com/legal/dpa · read Aug 31, 2026 · snapshot 67abcd773770 · found by pattern

Dataiku30 days

If Customer does not object within the said period of thirty (30) days, Customer is deemed to have accepted the new Subprocessor.

https://dataiku.com/legal/data-processing-addendum · read Aug 31, 2026 · snapshot bf87d89961f9 · found by pattern

Eightfold AI30 days

Eightfold will provide a notice, to those emails subscribed, at least thirty (30) days before allowing any new Subprocessor to process Customer Personal Data.

https://eightfold.ai/dpa · read Aug 31, 2026 · snapshot 810256afb095 · read by a person

ElevenLabs30 days

ElevenLabs will notify Customer at least thirty (30) days prior to appointing any new or replacement Subprocessor (“Notice Period”) by updating the Subprocessor List.

https://elevenlabs.io/dpa · read Aug 31, 2026 · snapshot d282e82b19f8 · found by pattern

H2O.ai30 days

Customer may object to a new Subprocessor within thirty (30) days of such notice on reasonable data protection grounds.

https://h2o.ai/legal/dpa · read Aug 31, 2026 · snapshot b74466d17e81 · found by pattern

Harvey30 days

If You subscribe to receive email notifications at the Subprocessor List, then Harvey will notify You if Harvey intends to add one or more Subprocessors to the Subprocessor List at least 30 days before the change takes effect.

https://harvey.ai/legal/data-processing-addendum · read Aug 31, 2026 · snapshot ee151b0c86f9 · read by a person

HireVue30 days

The data importer shall specifically inform the data exporter in writing of any intended changes to that list through the addition or replacement of sub-processors at least 30 days in advance, thereby giving the data exporter sufficient time to be able to object to such changes prior to the engagement of the sub-processor(s).

https://hirevue.com/legal/dpa · read Aug 31, 2026 · snapshot 7b7c43638a24 · found by pattern

Insider30 days

If Insider One is unable to make available such change within a reasonable period of time, which shall not exceed thirty (30) days, Customer may terminate the applicable Order Form(s) with respect only to those Services which cannot be provided by Insider One without the use of the objected-to new Sub-processor, by providing written notice to Insider One.

https://useinsider.com/legal/dpa · read Aug 31, 2026 · snapshot 973ff7c99281 · found by pattern

Lucidworks30 days

We will give you the opportunity to object to the engagement of new Subprocessors on reasonable grounds relating to the protection of Personal Data within 30 days of notifying you.

https://lucidworks.com/legal/dpa · read Aug 31, 2026 · snapshot 4fb55c7b06ca · found by pattern

MongoDB30 days

We maintain a current list of our Subprocessors at: https://www.mongodb.com/products/platform/trust/subprocessors which we will update at least 30 days before the addition or replacement of any Subprocessor.

https://mongodb.com/legal/dpa · read Aug 31, 2026 · snapshot 4a0902e0e3c6 · found by pattern

Rev30 days

On at least 30 days’ notice to Customer, Rev may engage new Subprocessors subject to requirements of Privacy Laws.

https://rev.com/legal/data-processing-addendum · read Aug 31, 2026 · snapshot fd37ce76dc15 · found by pattern

Salesloft30 days

Customer will have thirty (30) days from such notice to object to the newly proposed Sub-Processor.

https://salesloft.com/legal/data-processing-addendum · read Aug 31, 2026 · snapshot d62dcda1f8cf · found by pattern

Weaviate30 days

The Customer, upon being informed, may object to the appointment of that Subprocessor within 30 days on reasonable data protection grounds.

https://weaviate.io/dpa · read Aug 31, 2026 · snapshot 04705ac5e06a · found by pattern

What this table is not

It is not legal advice, and it is not your agreement. Your contract with a vendor may replace these terms. What is quoted here is the published document on the date shown; a negotiated addendum will say something else.

A vendor absent from this table has not been found to state a window we can quote. That covers vendors whose agreement states none, and vendors whose agreement we cannot read. Where vendors publish separates those two.

What happens downstream when an AI vendor changes a page works through what one of these periods costs the company that embeds the vendor, and the enterprise behind it.