What's the best way to track vendor sub-processor changes?

Read each vendor's list on a schedule, keep a dated copy, and check every change against the window in that vendor's DPA. You can do it by hand, with a page-change monitor, or with Xither, which does all three for the AI vendors it watches.

Do vendors email you when they add a sub-processor?

Some do, to whoever subscribed. Some agreements make the updated web page itself the notice, so no email is promised. Our notice windows page quotes each vendor's clause.

Can I use Visualping to watch sub-processor lists?

Yes. Visualping watches any page you give it, and its pricing page says the free plan covers 5 pages. You find each URL yourself, and you work out each deadline from the vendor's DPA.

Do Vanta, OneTrust or Whistic track sub-processor changes?

Their pages describe monitoring vendors for changes as part of a wider risk program, and Vanta's says it pulls findings from vendors' DPAs. Xither does one narrower job. The comparison page quotes each of them.

Yes. Every vendor's record page, the notice windows, the change feed (30 days after each change), the scan and the MCP server are free. Same-morning alerts for your own vendors are the paid part.

Buying guide · sub-processor changes

How do you find out when a vendor changes its sub-processor list?

Three ways: the vendor’s emails, a page monitor, or a service that reads the pages for you.

Each one catches something the others miss. Here’s what, and what each costs, so you can pick.

The catch

Sometimes the only notice is the page itself.

Some agreements treat an edit to the vendor’s list page as the notice. Nothing lands in anyone’s inbox, and the window starts anyway.

Vespa

10days (see the clause)

At least ten (10) days before enabling any new Sub-Processors the new Sub-Processor will be added to the List. The Customer may object to such an engagement by informing Vespa.ai within this ten (10) day period, provided such objection is in writing and based on reasonable grounds relating to data protection.

vespa.ai/data-processing-agreement
read October 30, 2026 · fingerprint 47c7d6d9538f

Every window we quote shows how long each vendor gives you, in its own words.

Your options

What each way catches, and what it misses.

Same job, three ways to do it.

Costs: Free.
Catches: Vendors that send an email, to the person who signed up.
Misses: Vendors whose notice is the web page itself. And the inbox leaves when that person does.

Point a page-change monitor at each list.

Costs: Free for a few pages, more for many.
Catches: Any edit to the pages you point it at.
Misses: It knows the page, not your agreement. Finding each URL, matching a change to the vendor's window and working out the date are yours.

Xither or Visualping →

Have Xither read them for you.

Costs: From $10 a month, after a 14-day free trial.
Catches: Changes to the lists, DPAs, privacy and trust pages of the AI vendors we watch, with your window's closing date.
Misses: Vendors we don't watch yet. Ask us, or run the free scan to see which of yours we cover.

See pricing →

Running a whole vendor risk program, with questionnaires and risk scores? That’s a different tool. Xither next to Vanta, OneTrust and Whistic.

What we read for you.

186

vendors we watch

118

sub-processor lists we can read

vendors whose window to object or notice period we quote

Not sure we cover yours? Scan your own sub-processor page and see right away.

Fit

Is Xither the right tool for you?

Xither is for software teams that build with AI vendors and sell to businesses. It keeps your public sub-processor list current and watches the pages your vendors publish about your data: sub-processor lists, DPAs, privacy and trust pages, and model retirement schedules. When one changes, you get a message in Slack, Teams or email saying whether you need to do anything, with the lines that moved and any date that applies.

It fits when

You build software with AI vendors inside it, and your customers ask who handles their data. Check your code
Your DPA promises customers a current sub-processor list and notice when it changes. What you owe
Your vendors' DPAs give you a fixed window to object to a new sub-processor, and you need to know the day it starts. Meeting the deadline
Security questionnaires ask you to list every AI sub-processor in your product. How to answer
You need proof of what a vendor's page said on a given date.

Use something else when

You want to watch any page on the web, like a competitor's pricing. A general page-change monitor does that. Xither or Visualping
You need a whole vendor risk program: questionnaires, risk scores, SOC 2 report reviews and breach alerts. A third-party risk platform does that. Xither and risk platforms
We don't watch your vendors yet. Run the free scan first, or ask us to add them. Scan your page
You need to know what a clause means for your contract. That's a lawyer's job; we report what a page says.

Price

What it costs.

Two plans, paid by card: Essentials at $10 a month and Pro at $49 a month. A one-time due-diligence pack costs $149. The scan, the public record and the MCP server are free.

Essentials: $10 a month or $99 a year: daily watch on every vendor you name; alerts by email, Slack or Teams; your sub-processor page, hosted and kept current; your customers subscribe to it and get each change by email; drafted notices for your customers; dated evidence you can export.
Pro: $49 a month or $490 a year: everything in Essentials; a one-page review of any AI vendor before you adopt it; security-questionnaire answers about your AI vendors, in one export; a monthly vendor-monitoring report for your auditor; up to 5 people.

A 14-day free trial of Pro. No card, so nothing to cancel.

Common questions.

What's the best way to track vendor sub-processor changes?: Read each vendor's list on a schedule, keep a dated copy, and check every change against the window in that vendor's DPA. You can do it by hand, with a page-change monitor, or with Xither, which does all three for the AI vendors it watches.
Do vendors email you when they add a sub-processor?: Some do, to whoever subscribed. Some agreements make the updated web page itself the notice, so no email is promised. Our notice windows page quotes each vendor's clause.
Can I use Visualping to watch sub-processor lists?: Yes. Visualping watches any page you give it, and its pricing page says the free plan covers 5 pages. You find each URL yourself, and you work out each deadline from the vendor's DPA.
Do Vanta, OneTrust or Whistic track sub-processor changes?: Their pages describe monitoring vendors for changes as part of a wider risk program, and Vanta's says it pulls findings from vendors' DPAs. Xither does one narrower job. The comparison page quotes each of them.
How much does Xither cost?: Two plans, paid by card: Essentials at $10 a month and Pro at $49 a month. A one-time due-diligence pack costs $149. The scan, the public record and the MCP server are free. A 14-day free trial of Pro. No card, so nothing to cancel.
Is any of it free?: Yes. Every vendor's record page, the notice windows, the change feed (30 days after each change), the scan and the MCP server are free. Same-morning alerts for your own vendors are the paid part.

Not legal advice.

This page compares ways of doing a job. Whether a change affects your own contracts is a question for your counsel.

Xither Staff Writer · reviewed October 31, 2026. Counts and the clause are read from the record when the page is served; prices from our price list.

Hear the morning we read a change to your vendor’s sub-processor list or DPA.

Name the AI vendors in your product. When a page you watch changes a fact, you get the lines that moved and the date any window runs out.

Try it free for 14 days

No card. Nothing to cancel.