Free resource · Telling your customers
Which vendor changes are worth an email?
Your vendors’ privacy policies, terms and sub-processor lists change all the time. Most edits are formatting. A few move something your contracts count.
Here is the exact rule Xither uses to tell them apart, in full, so you can check it instead of trusting it.
Download the criteriaThe rule
A change matters when a fact moved, not when only the wording did.
A privacy policy can change by a line of formatting every week. What counts is whether a sub-processor, a retention window or where data sits is different from what it was.
None
No facts moved with the page.
The wording changed and nothing we can name did. No alert.
Revision
Only a date moved.
The vendor edited the document and we can't say what changed. It goes in a digest, not an alert.
Material
A fact from the table below moved.
You get an alert at the highest tier present, leading with the facts that decided it.
What the rule does to the noise.
6,937
page changes we hold
7.4%
reach an inbox: 513 material
92.6%
don’t: 264 revisions, 6,160 where nothing we can name moved
A person who has learned to ignore an alert stream misses the one that mattered.
These counts come from running every change we hold back through the same rule the alerts use.
A change that matters lands in one of three tiers.
- 01
obligation
It starts a clock in an agreement you have signed.
133 changes so far
- 02
disclosure
It changes what you must tell your own customers, with no clause counting days.
36 changes so far
- 03
operational
It sets a deadline from engineering reality rather than from a contract.
344 changes so far
When several facts move at once, the change takes the highest tier. An alert never averages.
Every fact we track, and its tier.
| Fact | Tier | Why it matters | Changes so far |
|---|---|---|---|
| subprocessor | obligation | A new company is processing your customers' data, or one stopped. | 413 |
| residency | obligation | Your data moves country. | 32 |
| training use | obligation | Your data becomes training data, or stops being it. | 22 |
| retention | obligation | How long they keep it changed. | 13 |
| silence consent | obligation | A clock that runs against your silence appeared or moved. | 4 |
| certification | disclosure | What you can claim on your own trust page changed. | 38 |
| notice channel | disclosure | How you are supposed to hear about any of the above changed. | 20 |
| deprecation | operational | A model or API you depend on is being retired. | 576 |
| incident | operational | A dated outage a breach-notice clause may count from. | 289 |
What we keep but never email you about.
page date · 409 recorded
A “Last Updated” line moving backs up a change we can name. On its own, it means the vendor edited the document in a way we couldn't read. That's a blind spot to report in a digest, not a reason to email you at 05:00.
What the rule doesn’t do.
It doesn’t judge.
It never says whether a change is good, bad, risky or acceptable. Nothing is scored or weighted, no model is in the loop, and the alert shows the vendor’s own quote so you decide.
It can’t rank what it can’t read.
A change on a page we don’t parse arrives as a revision at best. The digest reports those separately, so they don’t look like quiet. How we keep the record.
Writing your own criteria, or asking a vendor for theirs?
Start from ours. The full rule as a Word document, current on the day you download it.
Common questions.
What is a material change to a vendor's terms?
For monitoring, one where a stated fact moved: a sub-processor added or removed, a retention window changed, data residency changed, a training-on-data position changed. A page whose wording changed without any of those moving is not material, however large the difference.
How do you avoid alert fatigue when monitoring vendor pages?
By alerting on facts rather than on page differences. Most page changes are formatting or boilerplate, and those never reach an inbox. The live share is counted on this page.
Why is a changed 'Last Updated' date not material?
Alone, it means the vendor edited a document in a way we couldn't read. That's a blind spot for a digest, not a reason to email you at five in the morning. We record it as a revision and never alert on it.
Does Xither use AI to decide what is material?
No. Every classification is a lookup against the published table on this page, applied to facts already stored. Nothing is scored or weighted, there is no model in the loop, and anyone can work any verdict out again from the stored facts.
Does the rule say whether a change is bad?
No, and it can't. It says which facts moved and which contract question each one answers. The alert shows the vendor's own quote, and you decide what it means.
Tell your customers
More for this job.
- GuideWhen you owe customers noticeThe three notice clauses to look for, and which a vendor's edit starts.Open it ›
- ExplainerWhat happens downstream when a vendor edits a pageOne edit, three contracts: the vendor, you, and your enterprise customer.Open it ›
- TemplateCustomer notice templateThe notice to send your customers when a sub-processor changes.Open it ›
- TemplateCustomer notice worksheetWork out which customers you owe notice, and by when.Open it ›
- GuideDo you have to tell your customers?Six questions, in order, that decide whether you owe your customers notice.Open it ›
This is how Xither sorts changes for alerts. It is not a legal definition of materiality, and your own agreements may define the term differently; where they do, theirs governs. The record is free to read, and corrections are free to request.