Resource · Reading a DPA
AI addendum clause bank
7terms to ask for when a vendor’s data processing agreement moves the work onto you, each paired with a published clause from the 36 in the record that does the thing it fixes.
Two things this is not
It was not drafted by a lawyer and does not pretend to be. These are plain-language statements of what to ask for, in the shape a redline takes. Your counsel writes the final wording, and should.
And it is not a claim that the vendors named are behaving badly. Every one of these terms is ordinary drafting a competent counsel wrote on purpose. The pairing says something narrower: this term moves work onto you, here is a published agreement that contains it, and here is language that does not.
Ask for the fallback. Each entry carries a smaller version under the main ask. That is the one that tends to be granted — a vendor that will not remove a silence clause will often agree to a termination right, and a redline offering only the maximum gets refused whole rather than negotiated down.
Silence counts as agreement
Not replying inside a window you may never have seen approves the sub-processor for you.
Ask for
If Customer objects to a new Sub-processor within the Objection Period, Supplier shall not use that Sub-processor to process Customer Personal Data unless and until the objection is withdrawn. Customer's failure to respond within the Objection Period shall not constitute approval.
If that is refused
If Customer objects within the Objection Period and the parties do not resolve the objection within thirty (30) days, Customer may terminate the affected Services on written notice, without penalty and with a pro-rata refund of pre-paid fees.
Published clauses this fixes · 2
Mistral AI
The Customer may only object in writing to Mistral AI's appointment of a new Subprocessor within ten (10) days of such notice by providing a written objection to privacy@mistral.ai, provided that such objection is based on reasonable grounds relating to the Applicable Data Protection Law, otherwise such new Subprocessor will be deemed approved.
legal.mistral.ai/terms/data-processing-addendum · read Aug 31, 2026
Cognition
If Customer does not object within fifteen (15) days of receiving notice, Customer shall be deemed to have accepted the updated Subprocessor list.
cognition.ai/dpa · read Aug 31, 2026
Notice means the page changed
Notice is defined as updating a page, so nothing arrives and the window spends itself.
Ask for
Supplier shall give notice of any intended addition or replacement of a Sub-processor by email to the addresses Customer designates in writing, at least thirty (30) days before the Sub-processor begins processing Customer Personal Data. Publication on a website shall not by itself constitute notice.
If that is refused
Supplier shall maintain a subscription mechanism for Sub-processor changes and shall enroll the addresses Customer designates on execution of this Agreement, without requiring further action by Customer.
Published clauses this fixes · 1
Vespa
At least ten (10) days before enabling any new Sub-Processors the new Sub-Processor will be added to the List.
vespa.ai/data-processing-agreement · read Aug 31, 2026
Notice only if you subscribed first
The notice exists but only reaches you if someone found and completed a sign-up form first.
Ask for
Supplier shall enroll the notification addresses designated by Customer in Schedule [X] on the Effective Date, and shall not require Customer to subscribe, register or opt in as a condition of receiving Sub-processor notices.
If that is refused
Supplier shall confirm in writing within ten (10) days of the Effective Date that Customer's designated addresses are receiving Sub-processor notifications.
Published clauses this fixes · 4
Anyscale
(c) Anyscale shall notify Customer if it engages a new Subprocessor at least ten (10) days prior to any such change if Customer opts-in to receive such notifications in the manner made available on the Subprocessor List.
anyscale.com/dpa · read Aug 31, 2026
AssemblyAI
At least ten (10) days before enabling any third party other than existing Authorized Subprocessors to access or participate in the processing of Personal Data, AssemblyAI will add such third party to the List and notify Customer via the email address subscribed to receive notifications of New Subprocessors as described herein.
assemblyai.com/legal/data-processing-addendum · read Aug 31, 2026
Poolside
At least ten (10) days before enabling any third party other than existing Authorized Subprocessors to access or participate in the processing of Personal Data, Company will add such third party to the List and provide a mechanism for Customer to receive notice of that update.
poolside.ai/legal/dpa · read Aug 31, 2026
and 1 more.
You may object only on stated grounds
The clause limits which reasons count, and the vendor decides whether yours does.
Ask for
Customer may object to a new Sub-processor on any ground relating to the protection of Personal Data, including Customer's own obligations to its customers. Supplier shall not require Customer to demonstrate that a ground is reasonable as a condition of the objection being recorded.
If that is refused
Where Supplier disputes that an objection is made on reasonable data protection grounds, Supplier shall set out its reasons in writing within ten (10) days, and the Objection Period shall be suspended until it does so.
Published clauses this fixes · 7
Gong
Customer may object to the Processing of Customer’s Personal Data by the New Sub-Processor, for reasonable and explained grounds, by providing a written objection to …
gong.io/legal/data-processing-addendum · read Aug 31, 2026
Lovable
In the event that the Customer does not wish to consent to the use of a new Sub-processor, the Customer may notify Lovable within twenty (20) business days of Lovable notifying the Customer, that the Customer does not consent on reasonable grounds relating to the protection of Personal Data by contacting privacy@lovable.dev.
lovable.dev/data-processing-agreement · read Aug 31, 2026
Vercel
If, within five (5) calendar days after such notice, Customer notifies Vercel in writing that Customer objects to Vercel's appointment of a new Subprocessor based on reasonable data protection concerns, the parties will discuss such concerns in good faith and whether they can be resolved.
vercel.com/legal/dpa · read Aug 31, 2026
and 4 more.
Objecting starts a conversation, not a veto
Objecting obliges the vendor to talk to you and to nothing else.
Ask for
If the parties do not resolve an objection within thirty (30) days of Supplier's receipt of it, Customer may terminate the affected Services on written notice, without penalty and with a pro-rata refund of pre-paid fees covering the terminated period.
If that is refused
Supplier shall respond substantively to an objection within ten (10) days and shall state what alternatives, if any, are available to Customer.
Published clauses this fixes · 1
Vercel
If, within five (5) calendar days after such notice, Customer notifies Vercel in writing that Customer objects to Vercel's appointment of a new Subprocessor based on reasonable data protection concerns, the parties will discuss such concerns in good faith and whether they can be resolved.
vercel.com/legal/dpa · read Aug 31, 2026
The window is in business days
A window in business days is shorter than it reads, and holidays are the vendor's.
Ask for
All periods in this Section are calendar days and run from Customer's receipt of notice.
If that is refused
Where a period would expire on a day that is not a business day in Customer's principal place of business, it shall expire on the next business day.
Published clauses this fixes · 3
Gong
Customer may object to the Processing of Customer’s Personal Data by the New Sub-Processor, for reasonable and explained grounds, by providing a written objection to …
gong.io/legal/data-processing-addendum · read Aug 31, 2026
Airtable
Airtable will provide notice of updates to that list at least ten (10) business days in advance of any intended additions or replacements of sub-processors, in accordance with Section 5 of this DPA.
airtable.com/dpa · read Aug 31, 2026
Lovable
In the event that the Customer does not wish to consent to the use of a new Sub-processor, the Customer may notify Lovable within twenty (20) business days of Lovable notifying the Customer, that the Customer does not consent on reasonable grounds relating to the protection of Personal Data by contacting privacy@lovable.dev.
lovable.dev/data-processing-agreement · read Aug 31, 2026
You can prove what the page said
When a dispute arrives you need the version of the page that was live on the day, and by then the vendor has replaced it.
Ask for
Supplier shall retain, for the term and for two (2) years afterwards, a dated copy of each version of its published Sub-processor list and Data Processing Agreement, and shall provide any such version to Customer within ten (10) days of a written request. Supplier shall not treat the current version of a published document as evidence of its content at an earlier date.
If that is refused
Supplier acknowledges that Customer may retain dated copies of Supplier's published documents, including through a third-party monitoring service, and shall not treat such retention as a breach of any confidentiality or acceptable-use term.
No clause in the 36we hold does this, and the absence is the finding rather than a gap in the search. Almost no agreement grants a customer a right to a dated copy of what a page said, which is why proving it later is somebody else’s job.
How to use it in a redline
Take two or three, not seven. A markup that touches every clause in a sub-processor section reads as a rewrite and goes to the vendor’s legal queue; two changes with a stated reason go to the account team. The ones worth spending the goodwill on are notice that arrives and an outcome other than deemed approval.
And quote their own clause when you ask. A vendor whose sentence appears verbatim in three other agreements has not defended it, and saying so politely tends to move it.
Take it with you
Every entry as a Word document, with the paired clauses and their sources. It is generated when you download it, so it carries the record as it stands that day.
How the pairing works
The model language is written. The paired clauses are quoted from agreements the vendors publish, matched by the same detector behind the red-flag checklist, with each vendor’s URL and the date we read it. A clause whose stored copy cannot be shown cleanly is left out rather than paraphrased.
Common questions
- What should I negotiate in an AI vendor DPA?
- Two things first: notice that arrives at an address you name rather than a page that changes, and an outcome other than deemed approval if you object. The rest follow more easily once those are agreed.
- Can I get a vendor to remove a silence-as-consent clause?
- Sometimes. More often a vendor that will not remove it will agree to a termination right for the affected service, which is the fallback given under that entry and the concession granted most often.
- What is a sub-processor objection period?
- The period your agreement gives you to object to a new sub-processor before it is treated as approved. The clauses in this record run from five business days to thirty, and the period usually starts at the vendor's notice rather than at the moment you read it.
- Should I ask for evidence rights in a DPA?
- Almost no agreement grants them, which is the point of the entry. A right to a dated copy of what a published page said is what makes a later dispute about timing answerable rather than a matter of recollection.
- How many clauses should I mark up?
- Two or three. A markup touching every clause in a sub-processor section reads as a rewrite and goes to the vendor's legal queue; two changes with a stated reason go to the account team.
Reading a DPA
Understand what your agreement actually obliges you to do.
- Sub-processor notice windows, by vendor
The objection window each vendor's own DPA states, quoted with its source and read date.
- What a sub-processor notice clause obliges you to do
The period runs from their notice, not from your discovery. What that means, quoted from the agreements.
- DPA Red-Flag Checklist
Six terms that decide whether an upstream change can reach your customers before you do, each found in a published agreement.
- Sub-processor objection letter
A letter that quotes the vendor's own clause back at them — with all 36 clauses to paste in, and the three that say where to send it.
- Silence as consent
13 agreements where not objecting approves the sub-processor — windows from five days to thirty, and several word-for-word identical.
This is not legal advice and the model language has not been settled by counsel for your situation. The agreements quoted are published documents read on the dates shown; naming one is not an allegation about the vendor, and your negotiated contract may differ from the public template. The record is free to read, and corrections are free to request.