Resource · Reading a DPA

Sub-processor objection letter

A short letter objecting to a new sub-processor, written to quote the vendor’s own clause back at them. Fill the bracketed fields and send it.

Two things before you send it

Check the window. It runs from the vendor’s notice rather than from the day you read it, so a notice defined as a page update may already have spent some of it. The shortest in the record is 5 business days (Gong).

Find out where to send it, because your agreement may not say. Of the 36 sub-processor notice clauses in the record, 3 name an address — and one more names an address the vendor’s own site obfuscates, so we cannot read it either. The rest give you a right to object and no destination for the objection. Use the notices address in the master agreement, and copy your account manager.

Short on purpose

A long objection reads as an opening position and invites a negotiation. A short one that quotes the clause reads as a party exercising a right.

[Date]

To: [vendor notices address]

cc: [your account manager]

Subject: Objection to new sub-processor — [vendor name], notice dated [date of notice]

We are writing under [clause reference] of the data processing agreement between [your company] and [vendor name] to object to the appointment of [new sub-processor name], notified on [date of notice].

That clause provides:

[paste the vendor's clause here, exactly as published]

Our objection is made on the following grounds, which relate to data protection:

[state the grounds — for example, that the sub-processor processes in a jurisdiction your own customer commitments exclude, that it introduces a category of processing outside the current scope, or that your own customers' agreements require their consent, which you do not hold]

We ask that you confirm within [10] days:

1. that this objection has been received and recorded within the period the clause allows;

2. whether [vendor name] will refrain from using [new sub-processor name] for our data, and if so on what terms;

3. if it will not, the options available to us under the agreement, including any right to terminate the affected service without penalty and any refund of pre-paid fees.

This objection is made without prejudice to our rights under the agreement or under applicable data protection law.

[name]

[title]

[your company]

The clauses that name somewhere to send it

Basetenprivacy@baseten.co15 days
Lovableprivacy@lovable.dev20 business days
Mistral AIprivacy@mistral.ai10 days

Every clause, to paste into the letter

The letter works best with the vendor’s own words in it. Find yours and paste the quote into the marked line.

Gong · 5 business days

Customer may object to the Processing of Customer’s Personal Data by the New Sub-Processor, for reasonable and explained grounds, by providing a written objection to …

https://gong.io/legal/data-processing-addendum · read Aug 31, 2026

Airtable · 10 business days

Airtable will provide notice of updates to that list at least ten (10) business days in advance of any intended additions or replacements of sub-processors, in accordance with Section 5 of this DPA.

https://airtable.com/dpa · read Aug 31, 2026

Lovable · 20 business days

In the event that the Customer does not wish to consent to the use of a new Sub-processor, the Customer may notify Lovable within twenty (20) business days of Lovable notifying the Customer, that the Customer does not consent on reasonable grounds relating to the protection of Personal Data by contacting privacy@lovable.dev.

https://lovable.dev/data-processing-agreement · read Aug 31, 2026

Vercel · 5 days

If, within five (5) calendar days after such notice, Customer notifies Vercel in writing that Customer objects to Vercel's appointment of a new Subprocessor based on reasonable data protection concerns, the parties will discuss such concerns in good faith and whether they can be resolved.

https://vercel.com/legal/dpa · read Aug 31, 2026

Anyscale · 10 days

(c) Anyscale shall notify Customer if it engages a new Subprocessor at least ten (10) days prior to any such change if Customer opts-in to receive such notifications in the manner made available on the Subprocessor List.

https://anyscale.com/dpa · read Aug 31, 2026

AssemblyAI · 10 days

At least ten (10) days before enabling any third party other than existing Authorized Subprocessors to access or participate in the processing of Personal Data, AssemblyAI will add such third party to the List and notify Customer via the email address subscribed to receive notifications of New Subprocessors as described herein.

https://assemblyai.com/legal/data-processing-addendum · read Aug 31, 2026

Braintrust · 10 days

At least ten (10) days before enabling any third party other than existing Authorized Subprocessors to access or participate in the processing of Personal Data, Company will add such third party to the List and notify Customer via email.

https://braintrust.dev/legal/dpa · read Aug 31, 2026

Demandbase · 10 days

Demandbase shall update that Sub-Processor List at least 10 days prior to any addition of a new Sub-Processor.

https://demandbase.com/data-processing-agreement · read Aug 31, 2026

Hebbia · 10 days

If Customer does not object to the engagement of a third party in accordance with Section 4.2 within ten (10) days of notice by Hebbia, that third party will be deemed an Authorized Sub-Processor for the purposes of this DPA.

https://hebbia.com/dpa · read Aug 31, 2026

Langfuse · 10 days

Customer may object in writing to ClickHouse's appointment of a new Sub-Processor by notifying ClickHouse promptly in writing within ten (10) calendar days of notice of the change.

https://langfuse.com/dpa · read Aug 31, 2026

LiveKit · 10 days

With respect to LiveKit's Sub-processors, LiveKit will give written notice no less than ten (10) days prior to any such change. 6.3 Objection Right for new Sub-processors.

https://livekit.io/legal/data-processing-addendum · read Aug 31, 2026

LogicMonitor · 10 days

Customer may object to the engagement of such New Sub-processor by notifying LogicMonitor within ten (10) days of LogicMonitor's notification, provided that such objection must be on reasonable, substantial grounds, directly related to such New Sub-processor's ability to comply with substantially similar obligations to those set out in this Addendum (an "Objection").

https://logicmonitor.com/legal/data-processing-addendum · read Aug 31, 2026

Mistral AI · 10 days

The Customer may only object in writing to Mistral AI's appointment of a new Subprocessor within ten (10) days of such notice by providing a written objection to privacy@mistral.ai, provided that such objection is based on reasonable grounds relating to the Applicable Data Protection Law, otherwise such new Subprocessor will be deemed approved.

https://legal.mistral.ai/terms/data-processing-addendum · read Aug 31, 2026

Poolside · 10 days

At least ten (10) days before enabling any third party other than existing Authorized Subprocessors to access or participate in the processing of Personal Data, Company will add such third party to the List and provide a mechanism for Customer to receive notice of that update.

https://poolside.ai/legal/dpa · read Aug 31, 2026

Vespa · 10 days

At least ten (10) days before enabling any new Sub-Processors the new Sub-Processor will be added to the List.

https://vespa.ai/data-processing-agreement · read Aug 31, 2026

Zapier · 14 days

In the event that Zapier updates the Subprocessor List, Zapier will provide fourteen (14) days’ advance written notice (which may be via email, a posting, notification on an online portal for our services, or other reasonable means). 9.5.

https://zapier.com/dpa · read Aug 31, 2026

Baseten · 15 days

Baseten shall notify Customer at least fifteen (15) days prior to engaging a new Sub-Processor by updating the Sub-Processor List or sending notification. - Objection Right for New Subprocessors. Customer may object in writing to a new Sub-Processor based on reasonable data protection concerns by emailing privacy@baseten.co within ten (10) calendar days of notice.

https://baseten.co/dpa · read Aug 31, 2026

Cognition · 15 days

If Customer does not object within fifteen (15) days of receiving notice, Customer shall be deemed to have accepted the updated Subprocessor list.

https://cognition.ai/dpa · read Aug 31, 2026

PolyAI · 15 days

You must notify us if you object to the proposed change to the Authorised Sub-processors by providing us with written notice of the objection within fifteen (15) days after PolyAI has provided notice to you of such proposed change (an “ Objection “). 8.4 In the event of an Objection, the parties shall work together in good faith to find a mutually acceptable resolution to address such Objection.

https://poly.ai/dpa · read Aug 31, 2026

Smartsheet · 15 days

Customer's failure to provide written notice of objection within such fifteen (15) day period shall constitute Customer's approval and authorization of the new Subprocessor's appointment.

https://smartsheet.com/legal/dpa · read Aug 31, 2026

xAI · 15 days

You may object on reasonable grounds relating to data protection to our engagement of any new or replacement Subprocessor by informing us in writing within fifteen (15) days after receiving notice.

https://x.ai/legal/data-processing-addendum · read Aug 31, 2026

Intercom · 20 days

Intercom will notify Customer if it intends to add or replace Sub-processors from the Sub-Processor Page at least twenty (20) days prior to any such changes.

https://intercom.com/data-processing-agreement · read Aug 31, 2026

Atlassian · 30 days

Atlassian will provide such notice, to those emails subscribed, at least thirty (30) days before allowing any new Sub-processor to Process Customer Personal Data (the “Sub-processor Notice Period”). 4.3 Objection to New Sub-processors.

https://atlassian.com/legal/data-processing-addendum · read Aug 31, 2026

Automation Anywhere · 30 days

At least 30 days before any new Subprocessor Processes any Customer Personal Data, AAI will add such Subprocessor to the Subprocessor List and notify Customer through email and the support portal.

https://automationanywhere.com/legal/dpa · read Aug 31, 2026

Dataiku · 30 days

If Customer does not object within the said period of thirty (30) days, Customer is deemed to have accepted the new Subprocessor.

https://dataiku.com/legal/data-processing-addendum · read Aug 31, 2026

Eightfold AI · 30 days

Eightfold will provide a notice, to those emails subscribed, at least thirty (30) days before allowing any new Subprocessor to process Customer Personal Data.

https://eightfold.ai/dpa · read Aug 31, 2026

ElevenLabs · 30 days

ElevenLabs will notify Customer at least thirty (30) days prior to appointing any new or replacement Subprocessor (“Notice Period”) by updating the Subprocessor List.

https://elevenlabs.io/dpa · read Aug 31, 2026

H2O.ai · 30 days

Customer may object to a new Subprocessor within thirty (30) days of such notice on reasonable data protection grounds.

https://h2o.ai/legal/dpa · read Aug 31, 2026

Harvey · 30 days

If You subscribe to receive email notifications at the Subprocessor List, then Harvey will notify You if Harvey intends to add one or more Subprocessors to the Subprocessor List at least 30 days before the change takes effect.

https://harvey.ai/legal/data-processing-addendum · read Aug 31, 2026

HireVue · 30 days

The data importer shall specifically inform the data exporter in writing of any intended changes to that list through the addition or replacement of sub-processors at least 30 days in advance, thereby giving the data exporter sufficient time to be able to object to such changes prior to the engagement of the sub-processor(s).

https://hirevue.com/legal/dpa · read Aug 31, 2026

Insider · 30 days

If Insider One is unable to make available such change within a reasonable period of time, which shall not exceed thirty (30) days, Customer may terminate the applicable Order Form(s) with respect only to those Services which cannot be provided by Insider One without the use of the objected-to new Sub-processor, by providing written notice to Insider One.

https://useinsider.com/legal/dpa · read Aug 31, 2026

Lucidworks · 30 days

We will give you the opportunity to object to the engagement of new Subprocessors on reasonable grounds relating to the protection of Personal Data within 30 days of notifying you.

https://lucidworks.com/legal/dpa · read Aug 31, 2026

MongoDB · 30 days

We maintain a current list of our Subprocessors at: https://www.mongodb.com/products/platform/trust/subprocessors which we will update at least 30 days before the addition or replacement of any Subprocessor.

https://mongodb.com/legal/dpa · read Aug 31, 2026

Rev · 30 days

On at least 30 days’ notice to Customer, Rev may engage new Subprocessors subject to requirements of Privacy Laws.

https://rev.com/legal/data-processing-addendum · read Aug 31, 2026

Salesloft · 30 days

Customer will have thirty (30) days from such notice to object to the newly proposed Sub-Processor.

https://salesloft.com/legal/data-processing-addendum · read Aug 31, 2026

Weaviate · 30 days

The Customer, upon being informed, may object to the appointment of that Subprocessor within 30 days on reasonable data protection grounds.

https://weaviate.io/dpa · read Aug 31, 2026

What usually happens next

Most agreements let you object and do not let you veto. The common outcome of a sustained objection is a right to terminate the affected service rather than a blocked addition, which is why the letter asks for the options in the agreement rather than demanding the sub-processor be dropped. Asking for something the clause cannot give you is the fastest way to get a reply that says no and stops there.

If your agreement treats silence as approval, sending something inside the window matters more than what it says.

Take it with you

The letter and every clause as a Word document. It is generated when you download it, so it carries the clauses as they stand that day.

Get the checklist

A Word document, generated from the record when you download it. Every clause carries the page it came from and the date we read it.

How this was assembled

The letter is written. The clauses under it are quoted from agreements the vendors publish, with the URL and the date we read each one. A clause whose stored copy carries converter machinery is truncated at the machinery rather than repaired, so a quote ending in an ellipsis is one where the vendor’s page hid something from us. How the record is kept.

Common questions

How do I object to a new sub-processor?
In writing, within the window your data processing agreement states, on grounds that relate to data protection. Quote the clause you are relying on so the recipient does not have to go and check that you have the right.
Where do I send a sub-processor objection?
Your agreement may not say. Of the 36 notice clauses collected here, three name an address. For the rest, use the notices address in the master agreement and copy your account manager, so it is not sitting only in a mailbox nobody reads.
What are reasonable grounds to object to a sub-processor?
Grounds that relate to data protection rather than to preference: processing in a jurisdiction your own customer commitments exclude, a category of processing outside the current scope, or a requirement in your own customers' agreements for consent you do not hold.
Can I block a vendor from adding a sub-processor?
Rarely. Most agreements give you a right to object and not a veto, and the usual outcome of a sustained objection is a right to terminate the affected service without penalty. Asking for something the clause cannot give you tends to produce a reply that says no and stops.
How long do I have to object?
The clauses here range from five business days to thirty. The window runs from the vendor's notice rather than from the day you read it, so a notice defined as a page update may already have spent part of it.

Reading a DPA

Understand what your agreement actually obliges you to do.

Everything in the resources section

This is not legal advice and the letter is a starting point rather than a form of words anyone has approved for your situation. The agreements quoted are published documents read on the dates shown; your negotiated contract governs, and the clause you signed may differ from the one on the public template. The record is free to read, and corrections are free to request.