Which vendor pages should I monitor for changes?

Start with the sub-processor list and the data processing agreement. The first carries the most facts by a wide margin; the second turns any change into an obligation. Then the trust page, the privacy policy and the changelog.

What should I record when I keep a copy of a vendor page?

The URL, the date you read it, a fingerprint (SHA-256 hash) of what you read, and the copy itself. The date and the fingerprint make the copy evidence later. Without them you have a screenshot of a page that has since changed.

Is it worth monitoring a vendor's pricing page?

For contractual facts, no. We watch 143 of them. They change among the most of any page we watch, and have given 16 facts, all of them date stamps. Watch one for commercial reasons if you need to, not for compliance.

Where do vendors announce model deprecations?

Usually a changelog or release-notes page, occasionally a dedicated deprecations page, and sometimes a model card. Some vendors also email active users; whether you get that email depends on your account.

How many pages does a vendor typically publish?

Across the vendors we watch, a handful: a privacy policy and terms almost always, a trust page usually, a sub-processor list and DPA often, a changelog if the product has an API. Absence is worth recording too.

Resource · Watching AI vendors

Which of your AI vendors' pages should you keep an eye on?

Every vendor publishes a handful of pages that matter: a privacy policy, terms, a data processing agreement (DPA), a trust page. Any of them can change with an edit.

Here’s which ones carry the facts you’ll be asked about, and which change a lot and say little.

kinds of vendor page, and what each one tells you.

46%

of the facts on 1,164 vendor pages we watch come from one kind: the sub-processor list.

709

edits to 142 vendors' pricing pages, for 16 facts, every one a date stamp.

A low number means we get little from that kind of page, not that it carries nothing. Model cards hold a lot you'd want; we currently read dates and end-of-life notes off them and little else.

Start with these three.

The sub-processor list carries the most, by a wide margin. The data processing agreement is the one that turns any of it into an obligation. Keep a copy of both before anything else.

01
Sub-processor list
The companies your vendor passes data to. Additions are the change most data processing agreements actually cover, and the one that starts the window to object.
153 vendors · 19,295 facts
02
Deprecation page
The same announcements where a vendor keeps them separately. Rarer than a changelog and easier to read when it exists.
16 vendors · 8,334 facts
03
Changelog or release notes
Where a retirement is announced. Some vendors also email active users; the page is where anyone can read it.
77 vendors · 5,268 facts

Every kind of page, and what’s on it.

“Facts per edit” is the number to read if you’re deciding what to watch. A page that changes often and yields nothing takes your attention and gives nothing back.

Sub-processor list153 vendors publish one21.56 facts per edit
The companies your vendor passes data to. Additions are the change most data processing agreements actually cover, and the one that starts the window to object.
153 vendors · 19,295 facts · 895 recorded edits
sub-processors named 18,568dates the page was updated 435how notice is given 134training statements 108where data is kept 23retention periods 15silence-as-consent clauses 12
Deprecation page16 vendors publish one40.07 facts per edit
The same announcements where a vendor keeps them separately. Rarer than a changelog and easier to read when it exists.
16 vendors · 8,334 facts · 208 recorded edits
retirements 8,225dates the page was updated 109
Changelog or release notes77 vendors publish one3.73 facts per edit
Where a retirement is announced. Some vendors also email active users; the page is where anyone can read it.
77 vendors · 5,268 facts · 1,413 recorded edits
retirements 4,807dates the page was updated 461
Trust or security page167 vendors publish one6.79 facts per edit
Certifications, and what you are allowed to repeat to your own customers about them.
167 vendors · 3,676 facts · 541 recorded edits
certifications 3,306training statements 213dates the page was updated 86where data is kept 44retention periods 16how notice is given 11
Privacy policy181 vendors publish one2.65 facts per edit
Training use, retention and residency, usually stated more plainly here than in the agreement.
181 vendors · 2,053 facts · 775 recorded edits
training statements 916dates the page was updated 791where data is kept 214retention periods 128how notice is given 4
Data processing agreement115 vendors publish one2.01 facts per edit
The clause that decides how you find out and how long you have to object. Everything else on this list is a fact; this is the obligation.
115 vendors · 1,234 facts · 614 recorded edits
dates the page was updated 513how notice is given 221training statements 204where data is kept 136silence-as-consent clauses 86retention periods 74
Status page32 vendors publish one1.43 facts per edit
Dated incidents, which a breach-notification clause may count from.
32 vendors · 1,183 facts · 826 recorded edits
incidents 1,101dates the page was updated 82
Terms of service156 vendors publish one1.76 facts per edit
The license you grant over your inputs and outputs, which is where a training position is often really settled.
156 vendors · 1,077 facts · 612 recorded edits
dates the page was updated 527training statements 498retention periods 28where data is kept 21silence-as-consent clauses 3
Model card51 vendors publish one0.35 facts per edit
Model-level detail and end-of-life notes for the specific model you call.
51 vendors · 121 facts · 344 recorded edits
retirements 73dates the page was updated 48
Pricing page142 vendors publish one0.02 facts per edit
Commercial terms. It changes often and says almost nothing a contract counts, so see what it yields before you add it to your own list.
142 vendors · 16 facts · 709 recorded edits
dates the page was updated 16

A page that changes often and says little.

We watch 143 pricing pages. They’ve had 709 recorded edits, among the most of any kind of page, and given 16 facts, every one a date stamp.

A page like that is what an alert has to survive. It’s why a rule that alerts on every edit, instead of on a moved fact, is unusable.

What to keep from each page.

The date and the fingerprint make the copy evidence later. Without them you have a screenshot of a page that has since changed.

The address.
The exact URL you read.
The date.
When you read it. A page can say something else tomorrow.
A fingerprint.
A fingerprint (SHA-256 hash) of what you read. It changes if one character does.
The copy itself.
A dated copy of the page, so you can show when it said what.

Then check whether the page, or your agreement, says how changes are announced. Some vendors email subscribers; the page is the copy anyone can check.

Download the page list.

The full table as a Word document, a starting point for your own checklist. It’s generated when you download it, so the numbers are current that day.

Where the numbers come from.

The pages we watch, the facts read off them, and the edits we recorded. Each fact counts toward the kind of page it was read from.

A page we can’t fetch gives no facts and no edits. So a low row can mean a kind of page that resists reading as easily as one that says little. The two aren’t separated here.

How Xither reads a page.

Common questions.

Which vendor pages should I monitor for changes?
Start with the sub-processor list and the data processing agreement. The first carries the most facts by a wide margin; the second turns any change into an obligation. Then the trust page, the privacy policy and the changelog.
What should I record when I keep a copy of a vendor page?
The URL, the date you read it, a fingerprint (SHA-256 hash) of what you read, and the copy itself. The date and the fingerprint make the copy evidence later. Without them you have a screenshot of a page that has since changed.
Is it worth monitoring a vendor's pricing page?
For contractual facts, no. We watch 143 of them. They change among the most of any page we watch, and have given 16 facts, all of them date stamps. Watch one for commercial reasons if you need to, not for compliance.
Where do vendors announce model deprecations?
Usually a changelog or release-notes page, occasionally a dedicated deprecations page, and sometimes a model card. Some vendors also email active users; whether you get that email depends on your account.
How many pages does a vendor typically publish?
Across the vendors we watch, a handful: a privacy policy and terms almost always, a trust page usually, a sub-processor list and DPA often, a changelog if the product has an API. Absence is worth recording too.

Watch vendor pages

More for this job.

See every resource

This is not legal advice. The numbers describe the pages Xither watches; your own vendors may publish more or fewer, and your agreements decide which of them matter. Everything on this page is free to read, and corrections are free to request.