Do I have to tell my customers when my vendor adds a sub-processor?

It depends on your agreements with them, not on your agreement with the vendor. A sub-processor notice obligation usually sits in individual customer contracts rather than in standard terms, so the answer is often yes for some customers and no for others.

What should a sub-processor change notice say?

What changed, on whose page, on what date, and what your agreement with that customer provides. Quoting the added and removed lines lets the recipient see the change rather than take your word for it.

How long do I have to pass on a sub-processor notice?

Whatever your own customer agreements say, and the windows differ between them. The clock usually starts at your vendor's notice rather than at the moment you read it, so the day you find out is often not day zero.

How do I prove I sent notice in time?

Keep a dated copy of the vendor's page before and after the change, with a hash of each. Most notice disputes are not about whether the change happened but about when you knew and when you passed it on.

Notice

Resource · Telling your customers

Telling your customers a sub-processor changed

When a vendor adds a sub-processor, your own customers may need to hear about it. This is the notice, drafted by the same code that drafts it inside the product.

Why generated

Not written down twice

Xither drafts this notice beside every sub-processor change it records. If the template on this page were typed out separately, the two would drift and the version you take away would stop matching the one the product produces. So the text below is the product’s output: the same function, called against a real recorded change.

The notice

A real one, unedited

On 2026-09-11, Replit changed its published sub-processor list. This is what the product drafted, with nothing filled in about your own agreements:

Subject: Sub-processor change at Replit

On 2026-09-11, Replit updated its published list of sub-processors at https://replit.com/subprocessors.

Lines added to the published list:
  + SideGuide Technologies, Inc. d/b/a Firecrawl |
  + USA |
  + Web data extraction for AI applications |
  + 
  + [About](/about)[News](/news)[Careers](/careers)[Brand Center](/brand)[Contact Us](/enterprise)
  + [X / Twitter](https://x.com/replit)[YouTube](https://www.youtube.com/@replit)[Linkedin](https://www.linkedin.com/company/repl-it/)[Instagram](https://www.instagram.com/replit)[Facebook](https://www.facebook.com/replit/)[TikTok](https://www.tiktok.com/@replit)

Lines removed from the published list:
  - [About Us](/about)[News](/news)[Careers](/careers)[Brand Center](/brand)[Contact Us](/enterprise)
  - [Twitter/X](https://x.com/replit)[YouTube](https://www.youtube.com/@replit)[Linkedin](https://www.linkedin.com/company/repl-it/)[Instagram](https://www.instagram.com/replit)[Facebook](https://www.facebook.com/replit/)[Tiktok](https://www.tiktok.com/@replit)

[Your company] uses Replit as a sub-processor for [describe the processing]. We are notifying you of this change under [section] of our agreement. [If your agreement provides an objection window, state it and the date it closes.]

A dated copy of the page before and after the change is held on our behalf by Xither (sha256 2e765024b689… → 8e2d22c01043…) and is available on request.

With clauses

The same notice once your obligations are recorded

Tell Xither what your own customer agreements require and the notice names the counterparties and the date each window closes. The two counterparties below are invented for this page; yours come from clauses you enter.

To: Northwind Health (MSA §11.4); Blackwell Bank (DPA Annex 3)
Subject: Sub-processor change at Replit

On 2026-09-11, Replit updated its published list of sub-processors at https://replit.com/subprocessors.

Lines added to the published list:
  + SideGuide Technologies, Inc. d/b/a Firecrawl |
  + USA |
  + Web data extraction for AI applications |
  + 
  + [About](/about)[News](/news)[Careers](/careers)[Brand Center](/brand)[Contact Us](/enterprise)
  + [X / Twitter](https://x.com/replit)[YouTube](https://www.youtube.com/@replit)[Linkedin](https://www.linkedin.com/company/repl-it/)[Instagram](https://www.instagram.com/replit)[Facebook](https://www.facebook.com/replit/)[TikTok](https://www.tiktok.com/@replit)

Lines removed from the published list:
  - [About Us](/about)[News](/news)[Careers](/careers)[Brand Center](/brand)[Contact Us](/enterprise)
  - [Twitter/X](https://x.com/replit)[YouTube](https://www.youtube.com/@replit)[Linkedin](https://www.linkedin.com/company/repl-it/)[Instagram](https://www.instagram.com/replit)[Facebook](https://www.facebook.com/replit/)[Tiktok](https://www.tiktok.com/@replit)

[Your company] uses Replit as a sub-processor for [describe the processing]. We are notifying you of this change under [section] of our agreement. Our agreement with you provides Northwind Health (MSA §11.4): 10 business days (by 2026-09-21); Blackwell Bank (DPA Annex 3): 30 days (by 2026-10-11).

A dated copy of the page before and after the change is held on our behalf by Xither (sha256 2e765024b689… → 8e2d22c01043…) and is available on request.

Before sending

Trim it

The notice includes the added and removed lines exactly as they appeared, and a vendor page usually changes its navigation at the same time as its table. In the example above the footer links moved as well as the sub-processor row. Cut what is not a sub-processor — the point of quoting the lines is that the recipient can see the change, not that they read the whole diff.

This is a draft in the product too, marked as one, and it never goes out from us. Replit is the example because a sub-processor row actually moved on that reading; 8 changes in the record qualify.

Evidence

What makes it defensible

The last line is the part worth keeping. A dated copy of the page before and after the change, with both hashes, is what turns “we told you” into something you can show. Most notice disputes are not about whether the change happened; they are about when you knew and when you passed it on.

Check first

Two things before you send

Which customers this reaches. A sub-processor notice obligation usually sits in individual agreements rather than in your standard terms, so the list is not everyone — and the windows differ per contract, which is why the notice names them separately rather than stating one date.

Whether your window has already started. It usually runs from your vendor’s notice rather than from the day you read it, so the day you find out is often not day zero.

Download

Take it with you

Both versions as a Word document. It is generated when you download it, so it carries the product’s current wording rather than a copy of it.

Method

How this was produced

The notice text comes from the product’s own drafting function against a change stored in the record, not transcribed from it. The example is chosen from changes where a sub-processor fact actually moved rather than from changes to a sub-processor page — the first selector picked a trust page whose only difference was a tracking parameter inside a footer link, which is a real page change and a notice about nothing. The same test the alerting rule applies.

Questions

Common questions

Do I have to tell my customers when my vendor adds a sub-processor?: It depends on your agreements with them, not on your agreement with the vendor. A sub-processor notice obligation usually sits in individual customer contracts rather than in standard terms, so the answer is often yes for some customers and no for others.
What should a sub-processor change notice say?: What changed, on whose page, on what date, and what your agreement with that customer provides. Quoting the added and removed lines lets the recipient see the change rather than take your word for it.
How long do I have to pass on a sub-processor notice?: Whatever your own customer agreements say, and the windows differ between them. The clock usually starts at your vendor's notice rather than at the moment you read it, so the day you find out is often not day zero.
How do I prove I sent notice in time?: Keep a dated copy of the vendor's page before and after the change, with a hash of each. Most notice disputes are not about whether the change happened but about when you knew and when you passed it on.

Telling your customers

Work out who you owe notice, and by when.

What happens downstream when an AI vendor changes a page
One edit, three contracts: the vendor, the company that embeds it, and that company's enterprise customer.
What counts as a material change, and why
Our own alerting ruleset, published in full — a change is material when a fact moved, which suppresses 96% of page diffs.
Customer notice obligation worksheet
Who you owe notice and by when — against the finding that every published vendor window is 30 days or fewer, and the median is 15.
Do you have to tell your customers?
Six questions in the order worth asking them — and the first is not what your contract says, because 96% of vendor page changes move no fact at all.

Everything in the resources section

Caveat

This is not legal advice, and the notice is a draft rather than a form of words anyone has approved for your situation. Whether you owe notice at all is a question about your agreements with your customers. The vendor change quoted is a published page read on the date shown; the record is free to read, and corrections are free to request.