By a Xither Staff Writer · September 12, 2026
Your AI vendor edited one page. Who has to act, and by when?
By September 11, 2026, Replit’s sub-processor list named a company our September 7 copy didn’t: Firecrawl, for “Web data extraction for AI applications.” Nothing on the page said it had changed. Replit’s customers had a new sub-processor, and so did theirs.
Here’s what the change looked like.
A sub-processor is a company your vendor hands your data to. The list is a table: a name, a purpose, often a country. These rows moved on two lists in September.
- +Replit · Sep 11SideGuide Technologies, Inc. d/b/a Firecrawl“Web data extraction for AI applications”
- +Replit · Sep 17IntouchCX Inc.“Customer support”
- +Replit · Sep 17Persona Identities, Inc.“Identity verification”
- −6sense · Sep 11FingerprintJS, Inc.“Account Fraud/Takeover Prevention”
replit.com/subprocessors and 6sense.com/legal/subprocessors. Each date is our first reading with the change. The copy we held before it (Replit: dated September 7 for Firecrawl, September 11 for the other two; 6sense: August 31) shows the list as it was.
Nothing on the page says it changed.
Three new rows on Replit’s list: web data extraction, customer support, identity verification. This is the ordinary case, and it’s the one that breaks the process.
A dramatic change gets noticed. A few rows appearing in a table between two readings don’t. Nothing on the page says it differs from last week’s.
Additions and removals both matter, to different people. An addition is a new party in the chain. A removal is a party your last answer to a customer still names.
One edit, three companies.
- 01
The AI vendor
Edits its sub-processor list.
Owes Notice, in whatever form its agreement defines. Sometimes the edit is the notice.
- 02
The company that embeds it
Gets new sub-processors it didn't choose.
Owes A complete answer to its own customers, and a decision inside the vendor's window.
- 03
The enterprise at the end
Signed nothing with the AI vendor.
Owes Answers to its own customers and auditors about who handles their data. It has the worst view of the edit.
“We will notify you” isn’t one thing.
Each data processing agreement (DPA) that lets a vendor add sub-processors sets its own terms for telling you. We quote the window from 81 vendors’ clauses, and notice works differently across them.
Some define notice as publication. The list changes, and that is the notice:
Vespa
“At least ten (10) days before enabling any new Sub-Processors the new Sub-Processor will be added to the List. The Customer may object to such an engagement by informing Vespa.ai within this ten (10) day period, provided such objection is in writing and based on reasonable grounds relating to data protection.”
Under a clause like that, the list changing is the notice. The clause promises no email, and the window runs from the edit. The only way to be inside it is to have been reading the page.
Others send an email, but only to an address that subscribed first. AssemblyAI’s DPA promises one at least ten days before a new sub-processor is enabled:
AssemblyAI
“At least ten (10) days before enabling any third party other than existing Authorized Subprocessors to access or participate in the processing of Personal Data, AssemblyAI will add such third party to the List and notify Customer via the email address subscribed to receive notifications of New Subprocessors as described herein. Customer may object to such an engagement by informing AssemblyAI within ten (10) days of receipt of the aforementioned notice to Customer, provided such objection is in writing and based on reasonable grounds relating to data protection.”
A company that never subscribed would see only the page. And a subscription can lapse: the person who signed up leaves, and the notice goes to a mailbox nobody reads.
The company that embeds the vendor
It inherits the change, and the deadline.
Take a company that builds its product on Replit. If its agreements with its own customers promise to disclose who processes their data, and to tell them before that changes, the edit is now its problem too.
By September 11 it had a sub-processor it didn’t choose and didn’t evaluate. The disclosure it gave its own customers was out of date.
Nothing it did caused this. Nothing in its own systems would show it, because the change happened on somebody else’s website.
25
of the 81 windows we quote are ten calendar days or shorter.
32
are thirty days.
5
days to object: the shortest we quote.
Demandbase
“Customer may object in writing to Demandbase’s appointment of a new Sub-processor on reasonable grounds relating to data protection by notifying Demandbase promptly in writing within five (5) calendar days of an update to the Sub-processor List referenced in Section 3.3 and the parties shall discuss Customer concerns in good faith with a view to achieving a commercially reasonable resolution.”
Five calendar days, counted from an update to the list. If the list changes on a Friday, three working days are left.
The window doesn’t begin when you find out. It begins at the vendor’s notice, and under a publication clause, when the page changed. What the clause makes you do.
A missed window isn’t a decision put off. In 10 of the 81 clauses we quote, silence counts as approval:
Wiz
“Failure to object to such Sub-Processor in writing within ten (10) days following Wiz's notice shall be deemed as acceptance of the Sub-Processor.”
A removal makes your last answer wrong.
6sense’s list named FingerprintJS, Inc., for “Account Fraud/Takeover Prevention.” By September 11 the row was gone, and it hasn’t been in any reading since.
An addition creates a review task. A removal creates a correction task, and a process that only looks for new names misses it.
The last disclosure you sent a customer names a company no longer in your chain. It was accurate when you gave it. Now it’s wrong, in writing, in a document a security reviewer keeps.
For the enterprise, its own list of its suppliers’ sub-processors now overstates. An auditor comparing it with what suppliers publish finds the gap in the enterprise’s own document.
The enterprise at the end of the chain
It carries the larger obligation, and has the worse view.
The enterprise never signed anything with Replit. It signed with the company that builds on it. Its right to know reaches through that contract, and so does its exposure.
Under Article 28(2) of the GDPR, a processor may engage another processor only with the controller’s prior specific or general written authorization. Under general authorization, it must tell the controller of intended changes, so the controller can object.
That obligation passes down the chain. Visibility doesn’t.
A supplier change
Weeks
Procurement, then security review, then whoever owns the risk register.
The window
Days
It runs whether or not the review has started.
Scale makes it worse. A large company has hundreds of suppliers, and each one that embeds AI from somebody else is a chain like this one.
One edit at the top of one chain can touch several internal systems. The enterprise can’t see the edit unless the supplier in the middle tells it.
Without that, it learns about upstream changes at renewal, from a questionnaire, answered by a supplier working from memory. That’s a yearly reconstruction, not a register.
Model retirements
The other clock lands on engineering.
Not every downstream change is a compliance question. Some are engineering deadlines, and they travel the same chain. V7’s changelog carried this, dated September 8, 2026:
“Gemini 2.5 Pro has been retired: It no longer appears as a selectable model, so nothing can be pointed at a model on its way out.”
That’s the chain in one entry. A model was retired upstream, and a company that embedded it told its own customers. Anyone on V7 who had pinned that model found out two links from the decision.
Google Cloud release notes · read September 12, 2026
January 25, 2027
Write permissions removed from the chronicle.readonly OAuth scope, restricting it to reads. Any integration writing through it stops working that day, about four months after we read the note.
The same release notes
January 31, 2027
The deprecation of Looker Mobile (Legacy), postponed to this date. Dates can move, so a date filed once in a spreadsheet can’t be relied on.
We watch 18 retirement pages and have recorded 576 retirement changes from 28 vendors. That’s thin coverage, so these are examples, not a rate.
What they show: the retirement clock and the sub-processor window reach the same company on different pages. They land on teams that don’t read each other’s.
How often this happens.
We watch 1,164 pages from 186 vendors, and can currently read 118 sub-processor lists and 95 DPAs. Between September 2, 2026 and November 2, 2026:
times a sub-processor list or DPA differed from our last dated copy, over 61 days.
vendors whose sub-processor page differed from our last copy. On 44 of them, a name was added or removed.
of those differences changed a stated fact. Most of the rest were a footer date, a reordered row, a cookie banner, and some were a page we could no longer read.
That ratio is why this is hard by hand. Watch the pages without filtering and you get alarms nobody reads, and the change that matters arrives in the same inbox as the noise.
Two limits. The span is 61 days, which is short, and a rate measured over 61 days shouldn’t be projected across a year.
And every date here is the date we read a page, not the date a vendor edited it. We can’t see edit history. We can only say that on one date a page held one thing, and on a later date another.
What a working process looks like.
Re-read
Each page, on a schedule.
Keep
A dated copy of every reading.
Compare
Each reading with the last one.
Quote
The lines that moved and the date, with the vendor's own window, so the deadline is a date, not a worry.
You can run it yourself. How we run it is on our methodology page.
Three things make it harder than it sounds.
No standard address.
Vendors publish these documents wherever they like, so the list of pages to read has to be built by hand and kept up. Ours is published.
Some sites refuse readers.
Some vendors block automated readers. That's their right, and it has to be recorded as a refusal, not as an absence.
Most differences are noise.
Watch the pages without filtering and you get alarms nobody reads. The process gets switched off.
For the company in the middle, that process answers two questions it will be asked anyway: who processes our customers’ data, and how do you know when that changes? Both turn up in security questionnaires.
For the enterprise, ask each supplier three things. Which upstream pages it watches, how often it re-reads them, and what it will send you when one changes.
A supplier that can answer has a process. One that reviews annually finds out at renewal, the same time you do.
Hear the morning we read the change, not at renewal.
Name the AI vendors in your product. When a page you watch changes a fact, you get the lines that moved and the date the window runs out.
Try it free for 14 daysNo card. Nothing to cancel.
What this article rests on.
- Every vendor fact above comes from a dated copy of the page it was read from.
- The three Replit rows are on every reading of its list from the date shown through October 4, 2026. FingerprintJS is on none of 6sense’s from September 11 through October 4.
- Clause quotes and counts are pulled from what we hold when this page is served, so they can’t drift from it.
- The one outside source is the GDPR text on EUR-Lex. No survey, analyst report or third-party statistic appears here.
- This isn’t legal advice. The agreements quoted are published documents, not your contract, and a negotiated addendum governs.
By a Xither Staff Writer. Published September 12, 2026; figures, examples and corrections updated October 4, 2026. Corrections go to contact; a vendor that believes we have its record wrong can correct it for free.