Use case · objection deadlines
How do you meet a sub-processor objection deadline?
Know the day the list changed, the window in the vendor’s DPA, and how to count it.
The first is the hard part. A vendor can start your clock by editing a page you weren’t looking at.
What a deadline needs
Three things, in this order.
Miss any one of them and the date is wrong, or you never knew there was one.
The day the list changed.
This is the one that gets missed. The change is often an edit to a web page, and nobody is told.
XitherWe read each vendor's list every day and email you the morning we read a change.
The window in that vendor's DPA.
Every vendor picks its own number, and some count notice before the change rather than time to object.
XitherWe quote the clause from the agreement we hold, with the page and the date we read it.
The count.
Business days or calendar days, and from which day. Get either wrong and the date moves.
XitherWe work out the date and put it in the alert, with a drafted notice to your own customers.
Vendors don't agree on the number.
vendors whose window we quote from their DPA
give you a set time to object once told
promise notice before the change instead
count in business days, not calendar days
Every window we quote is listed with the vendor’s own sentence and the date we read it.
In their words
The shortest, a business-day clock, and a notice period.
Three clauses from agreements we hold. Each counts something different.
Anyscale
5days to object
(d) Customer may object in writing to Anyscale's appointment of a new Subprocessor based on reasonable data protection concerns by emailing [email address on the vendor's page] within five (5) calendar days of notice of a new Subprocessor from Anyscale and the parties will discuss such concerns in good faith.
read October 3, 2026 · fingerprint c1f0601eae82
Gong
5business days to object
Customer may object to the Processing of Customer’s Personal Data by the New Sub-Processor, for reasonable and explained grounds, by providing a written objection to [email address on the vendor's page] within 5 business days following Gong’s written notice to Customer of the intended engagement with the New Sub-Processor.
read August 31, 2026 · fingerprint cab59af09f81
Redis
5days' notice before a change
Amendments to the SCC Modules Module 2 and Module 3 are hereby amended as follows, to the extent allowed by applicable law: Section Reference | Concept | Selection by the Parties | Section 1, Clause 7 | Docking Clause | Any Clause purporting to allow the admission of contracting parties without mutually executed signed writings shall not apply (including but not limited to any optional docking clauses). | Section II, Clause 9 | Approval of Subprocessor | The language of Option 2 shall apply, with General Written Authorisation in accordance with a notification period of five (5) days in advance.
read October 28, 2026 · fingerprint 5b7750c5fd05
The alert
The date, worked out for you.
If we read a change to that list today, the alert would carry this sentence, word for word.
Anyscale's agreement gives 5 days to object to a new sub-processor. Counted from the day we observed this change, that window closes on 2026-11-07. If the vendor's notice to you is dated earlier, it closes earlier.
Under it: the lines that moved, the vendor’s clause, and a notice drafted for your own customers. What you owe them has its own page.
By hand
Doing it without Xither.
You can. Keep a register, read every list on a schedule, and count from the day you saw the change.
Our free register template and objection letter are a start. A spreadsheet or Xither? weighs the two.
Fit
Is Xither the right tool for you?
Xither is for software teams that build with AI vendors and sell to businesses. It keeps your public sub-processor list current and watches the pages your vendors publish about your data: sub-processor lists, DPAs, privacy and trust pages, and model retirement schedules. When one changes, you get a message in Slack, Teams or email saying whether you need to do anything, with the lines that moved and any date that applies.
It fits when
- You build software with AI vendors inside it, and your customers ask who handles their data. Check your code
- Your DPA promises customers a current sub-processor list and notice when it changes. What you owe
- Your vendors' DPAs give you a fixed window to object to a new sub-processor, and you need to know the day it starts. Meeting the deadline
- Security questionnaires ask you to list every AI sub-processor in your product. How to answer
- You need proof of what a vendor's page said on a given date.
Use something else when
- You want to watch any page on the web, like a competitor's pricing. A general page-change monitor does that. Xither or Visualping
- You need a whole vendor risk program: questionnaires, risk scores, SOC 2 report reviews and breach alerts. A third-party risk platform does that. Xither and risk platforms
- We don't watch your vendors yet. Run the free scan first, or ask us to add them. Scan your page
- You need to know what a clause means for your contract. That's a lawyer's job; we report what a page says.
Price
What Xither costs.
Two plans, paid by card: Essentials at $10 a month and Pro at $49 a month. A one-time due-diligence pack costs $149. The scan, the public record and the MCP server are free.
- Essentials: $10 a month or $99 a year: daily watch on every vendor you name; alerts by email, Slack or Teams; your sub-processor page, hosted and kept current; your customers subscribe to it and get each change by email; drafted notices for your customers; dated evidence you can export.
- Pro: $49 a month or $490 a year: everything in Essentials; a one-page review of any AI vendor before you adopt it; security-questionnaire answers about your AI vendors, in one export; a monthly vendor-monitoring report for your auditor; up to 5 people.
A 14-day free trial of Pro. No card, so nothing to cancel.
Common questions.
- When does the window to object to a new sub-processor start?
- When the vendor gives notice, as its DPA defines notice. Some send an email; some say the updated web page is the notice. Read the clause: it says which.
- Are business days and calendar days the same?
- No. Ten business days is two weeks; ten calendar days is ten days. Vendors use both. Xither skips weekends when counting business days but doesn't know public holidays.
- What happens if I miss the deadline?
- That depends on your agreement. Some clauses say no objection in time counts as approval. Our resource on silence as consent quotes them.
- How does Xither work out the date?
- It counts from the day we read the change, using the window quoted from that vendor's DPA. If the vendor's notice to you is dated earlier, your window closes earlier, and the alert says so.
Not legal advice.
This page quotes published agreements on the dates shown. A negotiated contract may say something else, and it governs.
Xither Staff Writer · reviewed October 31, 2026. Clauses and counts are read from the record when the page is served; the worked date is today's.
Hear the morning we read a change to your vendor’s sub-processor list or DPA.
Name the AI vendors in your product. When a page you watch changes a fact, you get the lines that moved and the date any window runs out.
Try it free for 14 daysNo card. Nothing to cancel.