Resource · Watching AI vendors
The AI Vendor Change Lexicon
16 terms that come up when an AI vendor changes what it publishes. Each definition carries a real example from a published agreement where the record holds one, with the page it came from and the date we read it.
Grouped by where the term comes from rather than alphabetically. Some of these are defined in law. Three of them we made up, and those say so.
Defined in law or in the agreements
Defined in data protection law or in the agreements themselves. These mean the same thing to everyone who reads them.
Sub-processor
A third party your vendor engages to process your data on its behalf.
If you send customer data to an AI vendor, and that vendor sends it to a hosting provider, a transcription service or a support tool, each of those is a sub-processor. Your obligations to your own customers reach through your vendor to them, which is why the list matters and why a change to it starts a clock.
In the record: 3,433 named sub-processors across 95 vendors.
See also sub-processor list, objection window.
Data processing agreement (DPA)
Also: Data processing addendum, DPA
The contract term setting out how a vendor may process personal data on your behalf.
It names the parties as controller and processor, states what the processor may do, and sets the rules for engaging sub-processors. The sub-processor clause inside it is usually where the notice period and the objection right live.
In the record: 36 quoted notice clauses across 36 vendors.
See also objection window, sub-processor.
Business days
A window counted in working days, which spans more of the calendar than the same number of days.
Both units appear in real agreements. A tracker that stores the number and drops the unit computes the wrong date, and the error runs against you.
Customer may object to the Processing of Customer’s Personal Data by the New Sub-Processor, for reasonable and explained grounds, by providing a written objection to …
Gong — https://gong.io/legal/data-processing-addendum · read Aug 31, 2026
See also objection window.
Data residency
Where a vendor states that data is stored and processed.
Usually given as a country or region. It matters because a transfer out of a region can require a different legal basis, and because a customer's own commitments may name a region explicitly.
In the record: 129 data-location statements across 56 vendors.
See also sub-processor.
Model deprecation
Also: Model retirement, Sunset
A vendor's notice that a model or API version will stop being available on a stated date.
It creates an engineering deadline rather than a compliance one, and it travels the same chain: a model retired upstream reaches you through whichever product embedded it. Dates move in both directions, so one captured and filed is not one you can rely on.
In the record: 1,059 retirement notices across 26 vendors.
In common use, no formal definition
Used consistently across vendor documents without a formal definition anywhere. Read the specific agreement rather than assuming.
Sub-processor list
The page a vendor publishes naming every sub-processor it currently uses.
Almost always a table of name, purpose and country. There is no convention for where it lives: some vendors publish at /subprocessors, some inside a trust center, some behind a compliance portal. Most agreements treat a change to this page as the notice they owe you.
See also notice by publication, sub-processor.
Objection window
Also: Objection period, Notice period
The fixed period after a vendor's notice in which you may object to a new sub-processor.
The period runs from the vendor's notice, not from the day you find out. Where the agreement defines notice as publishing to a page, the window opens when the page changes and nothing arrives to tell you.
Customer may object to the Processing of Customer’s Personal Data by the New Sub-Processor, for reasonable and explained grounds, by providing a written objection to …
Gong — https://gong.io/legal/data-processing-addendum · read Aug 31, 2026
See also silence as consent, notice by publication, business days.
Silence as consent
Also: Deemed approval, Deemed acceptance
A clause stating that if you do not object within the window, the new sub-processor is treated as approved.
A missed window is not a decision deferred. Under this term the approval happens by default, and the thing you did to give it was not read a page.
The Customer may only object in writing to Mistral AI's appointment of a new Subprocessor within ten (10) days of such notice by providing a written objection to privacy@mistral.ai, provided that such objection is based on reasonable grounds relating to the Applicable Data Protection Law, otherwise such new Subprocessor will be deemed approved.
Mistral AI — https://legal.mistral.ai/terms/data-processing-addendum · read Aug 31, 2026
See also objection window.
Notice by publication
An agreement that defines notice as updating a published page rather than sending a message.
No email is owed and none is sent. The clock starts when the page is edited, so the only way to be inside the window is to have been reading the page on a schedule.
At least ten (10) days before enabling any third party other than existing Authorized Subprocessors to access or participate in the processing of Personal Data, AssemblyAI will add such third party to the List and notify Customer via the email address subscribed to receive notifications of New Subprocessors as described herein.
AssemblyAI — https://assemblyai.com/legal/data-processing-addendum · read Aug 31, 2026
See also notice by subscription, objection window.
Notice by subscription
Notice sent only to addresses that signed up for it first.
The obligation to tell you is conditional on an action somebody at your company took once. When that person leaves, the notice keeps going to a mailbox nobody reads, and the agreement has still been honored.
(c) Anyscale shall notify Customer if it engages a new Subprocessor at least ten (10) days prior to any such change if Customer opts-in to receive such notifications in the manner made available on the Subprocessor List.
Anyscale — https://anyscale.com/dpa · read Aug 31, 2026
See also notice by publication.
Material change
A change to a published statement that bears on an obligation somebody signed, as opposed to an edit to the page.
Most page differences are not material: a footer date, a reordered row, a cookie banner. The distinction decides whether an alert is worth sending, and treating every difference as material is how a monitoring process produces alarms nobody reads.
See also watch surface.
Retention window
How long a vendor states it keeps your data before deleting it.
Commonly expressed in days or months, and often different for prompts, outputs and logs. A change here can put a vendor outside a commitment you have already made to your own customers.
In the record: 57 retention windows across 23 vendors.
Trust center
A vendor-hosted page or portal collecting its security and compliance material.
Frequently where the sub-processor list and the DPA now live, often on a subdomain such as trust.example.com. Some are static pages; some are portals that require an account, which makes the documents inside them unreadable to anyone who has not signed in.
In the record: 1,124 certification claims across 120 vendors.
See also watch surface.
Xither's own term
Xither’s own names for Xither’s mechanics. Useful, and ours — not industry vocabulary.
Watch surface
One kind of page Xither reads on a schedule for a given vendor.
The sub-processor list, the DPA, the privacy policy, the terms, the trust page, the changelog, the deprecation schedule and the status page are each a surface. The word exists to separate the KIND of page from the URL it happens to sit at, because vendors move the URL and keep the page.
See also evidence pack.
Evidence pack
Xither's name for the dated, hashed copies of a page assembled as proof of what it said and when.
Each reading is stored with its SHA-256 hash, and a manifest of hashes is timestamped by an independent RFC 3161 authority. The point is a dispute about what a page said on a date, which is otherwise unresolvable once the page has changed.
See also watch surface.
Sub-processor drift
Xither's term for the gap that opens between what you disclosed and what your vendors now publish.
Nobody does anything wrong to cause it. Vendors add and remove sub-processors as routine, your disclosure was accurate when you wrote it, and the two diverge quietly from that point. This is a coinage rather than an industry term.
See also sub-processor list, material change.
Take it with you
The same 16 terms as a Word document, generated when you download it so the examples are the ones in the record that day.
Watching AI vendors
Know which pages to read and how often.
- Where AI vendors publish their sub-processor lists and DPAs
The URL for each document we read, the date each was last read, and what happened where a page could not be read.
- Which vendor pages to capture, and what each one is worth
Ten page types ranked by measured yield across 1,071 watched pages — including the one we watch 141 times for five date stamps.
- What AI vendors have retired, and where they announced it
235 retirement announcements from 26 vendors, quoted with the page each appeared on — because a retirement is published, not sent.
Definitions are written; the examples under them are read from the record when this page is served. This is not legal advice, and the agreements quoted are published documents rather than your contract. How the record is kept.