Free resource · Watching AI vendors
What do all these vendor contract words mean?
When an AI vendor changes what it publishes, words like “window to object” and “silence as consent” turn up in the notices, the contracts and the redlines.
Here are 18 of them in plain English, each with a real example from a published agreement where we hold one. Some come from law. 3 are ours, and they say so.
Download the lexiconDefined in law or in the agreements.
Defined in data protection law or in the agreements themselves. These mean the same thing to everyone who reads them.
Sub-processor
A third party your vendor engages to process your data on its behalf.
Your AI vendor may pass your customer data on to a hosting provider, a transcription service or a support tool. Each is a sub-processor. Your obligations to your own customers reach through to them, so a change to the list starts a clock.
We hold 18,568 entries from the sub-processor lists of 128 vendors, 1,680 distinct names among them.
See also sub-processor list, window.
Data processing agreement (DPA)
Also: Data processing addendum, DPA
The contract term setting out how a vendor may process personal data on your behalf.
It names the parties as controller and processor, states what the processor may do, and sets the rules for engaging sub-processors. The sub-processor clause inside it is usually where the window and the right to object live.
We quote the sub-processor notice clause of 81 vendors.
See also window, sub-processor.
Business days
A window counted in working days, which spans more of the calendar than the same number of days.
Both units appear in real agreements. A tracker that stores the number and drops the unit computes the wrong date, and the error runs against you.
See also window.
See it in a real agreement
Airtable “Customer may object to Airtable’s use of a new sub-processor on reasonable grounds relating to the protection of Customer Personal Data by notifying Airtable promptly in writing at [email address on the vendor's page] within ten (10) business days after receipt of Airtable’s notice in accordance with the mechanism set out in Section 5.2.”
airtable.com/dpa · read Oct 22, 2026
Data residency
Where a vendor states that data is stored and processed.
Usually given as a country or region. It matters because a transfer out of a region can require a different legal basis, and because a customer's own commitments may name a region explicitly.
What AI vendors say about where your data is kept
See also sub-processor.
Model deprecation
Also: Model retirement, Sunset
A vendor's notice that a model or API version will stop being available on a stated date.
It creates an engineering deadline rather than a compliance one, and it travels the same chain: a model retired upstream reaches you through whichever product embedded it. Dates move in both directions, so one saved and filed is not one you can rely on.
In common use, no formal definition.
Used the same way across vendor documents, with no formal definition anywhere. Read your own agreement rather than assuming.
Sub-processor list
The page a vendor publishes naming every sub-processor it currently uses.
Almost always a table of name, purpose and country. Where it lives varies: at /subprocessors, inside a trust center, or behind a compliance portal. Some agreements treat a change to this page as the notice they owe you.
See also notice by publication, sub-processor.
Window
The period a sub-processor notice clause gives you, counted from the vendor's notice.
It comes in two kinds, and a clause doesn't always say which: a window to object and a notice period. Both run from the vendor's notice, not from the day you find out.
How sub-processor notice clauses work
See also window to object, notice period.
Window to object
Also: Objection period
How long you have to object to a new sub-processor before the vendor may go ahead.
It runs from the vendor's notice. Where the agreement defines notice as updating a page, it opens when the page changes, whether or not anyone has read it.
See also silence as consent, notice by publication, business days.
See it in a real agreement
Anyscale “(d) Customer may object in writing to Anyscale's appointment of a new Subprocessor based on reasonable data protection concerns by emailing [email address on the vendor's page] within five (5) calendar days of notice of a new Subprocessor from Anyscale and the parties will discuss such concerns in good faith.”
anyscale.com/dpa · read Oct 3, 2026
Notice period
How far ahead a vendor must tell you before a new sub-processor starts processing your data.
It's a different promise from a window to object: it fixes when the notice comes, not how long you have to answer it. Some clauses state both.
See also window to object.
See it in a real agreement
Freshworks “Freshworks shall provide Customer with at least 15 days’ prior notice of any planned changes to the Subprocessor list, through the addition or replacement of Subprocessors.”
www.freshworks.com/data-processing-addendum/ · read Oct 13, 2026
Silence as consent
Also: Deemed approval, Deemed acceptance
A clause stating that if you do not object within the window, the new sub-processor is treated as approved.
Under this term, approval happens by default. Miss the window and you have approved the sub-processor, by not reading a page.
See also window to object.
See it in a real agreement
Monday.com “Where Customer has not objected within such seven (7) day period in the manner described above, the use of the new Sub-Processor shall be deemed accepted by Customer.”
monday.com/l/privacy/dpa/ · read Sep 30, 2026
Notice by publication
An agreement that defines notice as updating a published page rather than sending a message.
The clock starts when the page is edited, so the only way to be inside the window is to have been reading the page on a schedule.
See also notice by subscription, window to object.
See it in a real agreement
Vespa “At least ten (10) days before enabling any new Sub-Processors the new Sub-Processor will be added to the List. The Customer may object to such an engagement by informing Vespa.ai within this ten (10) day period, provided such objection is in writing and based on reasonable grounds relating to data protection.”
vespa.ai/data-processing-agreement · read Oct 30, 2026
Notice by subscription
Notice sent only to addresses that signed up for it first.
The obligation to tell you is conditional on an action somebody at your company took once. When that person leaves, the notice keeps going to a mailbox nobody reads, and the agreement has still been honored.
See also notice by publication.
See it in a real agreement
AssemblyAI “At least ten (10) days before enabling any third party other than existing Authorized Subprocessors to access or participate in the processing of Personal Data, AssemblyAI will add such third party to the List and notify Customer via the email address subscribed to receive notifications of New Subprocessors as described herein. Customer may object to such an engagement by informing AssemblyAI within ten (10) days of receipt of the aforementioned notice to Customer, provided such objection is in writing and based on reasonable grounds relating to data protection.”
assemblyai.com/legal/data-processing-addendum · read Oct 29, 2026
Material change
A change that moves a fact: it starts a clock in an agreement, changes what you must tell customers, or sets an engineering deadline.
Most page differences move nothing: a footer date, a reordered row, a cookie banner. Xither sorts the rest into three kinds (obligation, disclosure and operational), and only a change that moves a fact sends an alert.
The three kinds, with the rules
See also the pages we watch.
Retention window
How long a vendor states it keeps your data before deleting it.
Commonly expressed in days or months, and often different for prompts, outputs and logs. A change here can put a vendor outside a commitment you have already made to your own customers.
Trust center
A vendor-hosted page or portal collecting its security and compliance material.
Frequently where the sub-processor list and the DPA now live, often on a subdomain such as trust.example.com. Some are static pages; some are portals that require an account, which makes the documents inside them unreadable to anyone who has not signed in.
What AI vendors say they're certified for
See also the pages we watch.
Xither's own term.
Words we use for how Xither works. They are ours, not industry vocabulary.
The pages we watch
The kinds of page Xither reads on a schedule for each vendor.
The sub-processor list, the DPA, the privacy policy, the terms, the trust page, the changelog, the deprecation schedule and the status page. We track the kind of page apart from its URL, because vendors move the URL and keep the page.
See also evidence pack.
Evidence pack
Xither's name for the dated copies of a page, each with a fingerprint, kept as proof of what it said and when.
Each reading is stored with a fingerprint (SHA-256 hash), and an independent RFC 3161 authority timestamps the list of fingerprints. It settles a dispute about what a page said on a date, which otherwise can't be settled once the page has changed.
See also the pages we watch.
Sub-processor drift
Xither's term for the gap that opens between what you disclosed and what your vendors now publish.
Nobody does anything wrong to cause it. Vendors add and remove sub-processors as routine, your disclosure was accurate when you wrote it, and the two diverge quietly from that point. This is a coinage rather than an industry term.
See also sub-processor list, material change.
Keep the lexicon next to your contracts.
The same 18 terms as a Word document, with the examples current on the day you download it.
Watch vendor pages
More for this job.
- DatasetWhere vendors publish their lists and DPAsThe page to read for each vendor's sub-processor list and DPA.Open it ›
- GuideHow to track sub-processor changesVendor emails, a page monitor or Xither: what each catches and costs.Open it ›
- ComparisonXither or Visualping?A general page monitor next to Xither, and when each is the better pick.Open it ›
- ComparisonXither next to Vanta, OneTrust and WhisticWhat risk platforms say they do, and the narrower job Xither does.Open it ›
- ComparisonA spreadsheet or Xither?When a hand-kept register is enough, and when it stops working.Open it ›
- ToolThe vendor record in your AI assistantA free, read-only MCP server: windows, the pages we watch and model retirements.Open it ›
- GuideWhich vendor pages to watchTen kinds of vendor page, and which ones are worth watching.Open it ›
- DatasetWhat AI vendors have retiredEvery model and API retirement we've read, soonest first, with its source page.Open it ›
We wrote the definitions. The examples under them are quoted from vendors’ published pages, current when this page is served. This is not legal advice, and the agreements quoted are published documents rather than your contract. How we keep the record.