Resource · Reading a DPA
Silence as consent
13 agreements in the record say that if you do not object in time, the new sub-processor is approved. Each is quoted here with the page it came from.
It converts inaction into agreement
A vendor adds a sub-processor, a period runs, and at the end of it the addition is approved — not because anyone approved it, but because nobody wrote back.
On its own that is ordinary drafting: a vendor cannot leave an addition in limbo indefinitely. It becomes a problem when it meets a notice clause that defines notice as updating a published page, because then the thing you had to react to never arrived and the clock ran anyway.
The shortest period stated inside one of these clauses is 5 days (HiddenLayer); the longest is 30 (Dataiku). 7 of the 13 state the consequence without stating a period at all, which puts the window somewhere else in the agreement.
Some of these are the same sentence
Word for word, across vendors with no relationship to each other:
AssemblyAI · Braintrust · Poolside
If Customer does not object during this period, that third party will be deemed an Authorized Subprocessor.
Clari · Salesloft
If no objection is provided within such period, the Sub-Processor is deemed approved by Customer.
That is a template. It matters because a template is a starting position rather than a considered one, and the vendor asking you to accept it has very likely never been asked to change it.
Shortest window first
HiddenLayer · 5 days
If Subscriber does not provide written objection within such five (5) calendar day period, the Subprocessor shall be deemed approved by Subscriber. - Obligations. HiddenLayer will remain responsible for such Subprocessors compliance with the obligations of this DPA and for any acts or omissions that cause HiddenLayer to breach any of its obligations under this DPA.
https://hiddenlayer.com/dpa · read Sep 7, 2026
Hebbia · 10 days
If Customer does not object to the engagement of a third party in accordance with Section 4.2 within ten (10) days of notice by Hebbia, that third party will be deemed an Authorized Sub-Processor for the purposes of this DPA.
https://hebbia.com/dpa · read Sep 13, 2026
LiveKit · 10 days
If no objection has been raised within the ten (10) day period mentioned in Section 6.2, LiveKit will deem Customer to have authorized the new Sub-processor. 7.
https://livekit.io/legal/data-processing-addendum · read Sep 13, 2026
Wiz · 10 days
Failure to object to such Sub-Processor in writing within ten (10) days following Wiz's notice shall be deemed as acceptance of the Sub-Processor.
https://wiz.io/data-processing-agreement · read Sep 13, 2026
Cognition · 15 days
If Customer does not object within fifteen (15) days of receiving notice, Customer shall be deemed to have accepted the updated Subprocessor list.
https://cognition.ai/dpa · read Aug 31, 2026
Dataiku · 30 days
If Customer does not object within the said period of thirty (30) days, Customer is deemed to have accepted the new Subprocessor.
https://dataiku.com/legal/data-processing-addendum · read Sep 13, 2026
AssemblyAI · window not stated · same wording as Braintrust, Poolside
If Customer does not object during this period, that third party will be deemed an Authorized Subprocessor.
https://assemblyai.com/legal/data-processing-addendum · read Sep 11, 2026
Baseten · window not stated
If Customer does not object to Baseten’s appointment of a Sub-Processor during the objection period referred to in Section 6.4, Customer shall be deemed to have approved the engagement and ongoing use of that Sub-Processor. DATA SUBJECT RIGHTS Baseten, taking into account the nature of the Processing of Customer Personal Data, shall provide Customer with such assistance as may be reason…
https://www.baseten.co/terms-and-conditions/ · read Sep 11, 2026
Braintrust · window not stated · same wording as AssemblyAI, Poolside
If Customer does not object during this period, that third party will be deemed an Authorized Subprocessor.
https://braintrust.dev/legal/dpa · read Sep 7, 2026
Clari · window not stated · same wording as Salesloft
If no objection is provided within such period, the Sub-Processor is deemed approved by Customer.
https://clari.com/dpa · read Sep 9, 2026
LogicMonitor · window not stated
If the Customer does not so object, the engagement of the New Sub-processor shall be deemed accepted by the Customer. - **8.4.
https://logicmonitor.com/legal/data-processing-addendum · read Sep 13, 2026
Poolside · window not stated · same wording as AssemblyAI, Braintrust
If Customer does not object during this period, that third party will be deemed an Authorized Subprocessor.
https://poolside.ai/legal/dpa · read Aug 31, 2026
Salesloft · window not stated · same wording as Clari
If no objection is provided within such period, the Sub-Processor is deemed approved by Customer.
https://salesloft.com/legal/data-processing-addendum · read Sep 13, 2026
A different limit, shown separately
One clause the same search found does not say what silence means. It restricts the grounds on which an objection can be made at all, which is a different term and belongs under its own heading rather than this one.
Mistral AI
The Customer may only object in writing to Mistral AI’s appointment of a new Subprocessor within ten (10) days of such notice by providing a written objection to privacy@mistral.ai, provided that such objection is based on reasonable grounds relating to the Applicable Data Protection Law, otherwise such new Subprocessor will be deemed approved.
https://legal.mistral.ai/terms/data-processing-addendum · read Sep 10, 2026
What to ask for instead
Three changes, in the order they are usually granted. Notice that arrives — an email to a named address, not a page that changes. A window that runs from delivery rather than from publication, so a notice you did not receive does not spend it. And an outcome other than deemed approval: the right to terminate the affected service without penalty is a far more common concession than a veto, and it is the one worth asking for first.
Where the clause is one of the templates above, say so. A term that three unrelated vendors publish identically is not a position any of them defended.
Take it with you
Every clause as a Word document, with windows, sources and read dates. It is generated when you download it, so it carries the record as it stands that day.
How these were read
Each clause is quoted from an agreement the vendor publishes, with its URL and the date we read it. The window shown is the one named inside the quoted clause; where the clause names none, the row says so rather than reaching into another section for a number we did not read.
Shared wording is found by comparing the clauses’ first sentences with party names normalized. Nothing else about the agreements is compared, and identical wording is a fact about two documents rather than a claim about the companies. How the record is kept.
Common questions
- What is a silence-as-consent clause?
- A term stating that if you do not object to a new sub-processor within a set period, it is treated as approved. It converts inaction into agreement, and the period usually runs from the vendor's notice rather than from the day you read it.
- Is silence as consent normal in a DPA?
- It is common drafting, and on its own it is reasonable — a vendor cannot leave an addition unresolved forever. It becomes a problem when the same agreement defines notice as updating a published page, because then nothing arrives and the clock runs anyway.
- How long do I have to object to a new sub-processor?
- It depends on the agreement, and the range is wide. In the clauses collected here the shortest stated period is five calendar days and the longest is thirty, and several clauses state the consequence without naming a period at all.
- Can I refuse a new sub-processor?
- Most agreements let you object but do not let you veto. The common outcome of a sustained objection is a right to terminate the affected service rather than to block the addition, so a sustained objection usually ends in an exit rather than a block.
- What should I ask for instead?
- Notice that arrives at a named address, a window that runs from delivery rather than publication, and an outcome other than deemed approval — a termination right for the affected service is the concession vendors grant most often.
Reading a DPA
Understand what your agreement actually obliges you to do.
- Sub-processor notice windows, by vendor
The objection window each vendor's own DPA states, quoted with its source and read date.
- What a sub-processor notice clause obliges you to do
The period runs from their notice, not from your discovery. What that means, quoted from the agreements.
- DPA Red-Flag Checklist
Six terms that decide whether an upstream change can reach your customers before you do, each found in a published agreement.
- AI addendum clause bank
Seven terms to ask for, each with the smaller version that tends to be granted — paired with the published clauses they fix.
- Sub-processor objection letter
A letter that quotes the vendor's own clause back at them — with all 36 clauses to paste in, and the three that say where to send it.
This is not legal advice. The agreements quoted are published documents read on the dates shown; your negotiated contract governs over anything here, and a clause on a public template may not be the one you signed. The record is free to read, and corrections are free to request.