Vendor record · hebbia.com
What Hebbia promises about your data.
Where Hebbia publishes its promises, how long it gives you when it adds a sub-processor, and what has changed.
- Where it publishes
We haven't found a sub-processor list from Hebbia anywhere we've looked.
- What has changed
We've recorded no change to its sub-processor list or data processing agreement between August 31, 2026 and September 15, 2026. Subscribers hear about a change the morning we read it; the public record shows it 30 days later.
- Its window
When it adds a sub-processor, its clause at hebbia.com/dpa (read October 7, 2026) gives you 10 days to object.
- Window
- 10
- Pages
- 4
- Copies
- 18
days to object when it adds a sub-processor
pages we watch
dated copies of all its pages, since August 31, 2026
Hebbia DPA
Hebbia's data processing agreement gives 10 days to object to a new sub-processor. Here is the clause, from our October 7, 2026 copy:
10
days to object
“If Customer does not object to the engagement of a third party in accordance with Section 4.2 within ten (10) days of notice by Hebbia, that third party will be deemed an Authorized Sub-Processor for the purposes of this DPA.”
Found automatically and not yet checked by a person. The quote is exact, and the link goes to the source. Nothing here says whether the term is good or bad, only that Hebbia published it.
hebbia.com/dpa · read 2026-10-07 · fingerprint 2741dec6e5e8ae32…
How it says it sends notice
“Hebbia will provide a mechanism to subscribe to notifications (which may include but are not limited to email notifications) of new Authorized Sub-Processors and Customer, if it wishes, will subscribe to such notifications where available.”
hebbia.com/dpa · read 2026-10-07
Notice windows across every vendor we watch · Silence as consent
Hebbia sub-processors
We have not found a sub-processor list published by Hebbia anywhere we looked.
Every public change we have recorded · Where vendors publish their lists
How long Hebbia keeps your data
We hold no statement about data retention from Hebbia's watched pages. The pages we watch: data processing agreement hebbia.com/dpa; privacy policy hebbia.com/privacy; terms of service hebbia.com/terms-of-service; trust and security page hebbia.com/security. On training with customer data, Hebbia's privacy policy (hebbia.com/privacy, in the copy read October 4, 2026) says: “Vital Interests). - To Provide and Improve the Services Using AI Technologies. We may use Personal Data to operate, support, and improve the functionality of our System to generate outputs and enhance system performance. We do not use Personal Data contained in Customer Data to train or improve generalized or third-party artificial intelligence or machine learning models. To the extent we…”
Training on customer data
“Hebbia meets the requirements of the world's most secure firms. ## Secure, Compliant, and Verifiable - 01 Never trained on your dataYour documents, prompts, and outputs are never used to train Hebbia's models or any model provider we work with.”
hebbia.com/security · read 2026-10-04
Training on customer data
“A complete and current list of these third-party subprocessors, including their functions and locations, is maintained in our Data Processing Agreement (DPA), available at hebbia.com/dpa. We may also gather aggregated data about our services and website visitors for internal analytics, reporting, and improving our Services. ## How We Disclose Or Share Your Personal Data.”
hebbia.com/privacy · read 2026-10-04
Retention windows vendors publish · What vendors say about training
What the pages say
Read automatically from the pages below and shown as printed. A missing row is a gap in our reading, not proof it isn’t there.
Certifications the trust page names · ISO 27001 · ISO 42001 · SOC 2 Type II
Laws the trust page names · GDPR
The pages' own stamps: Last updated 2026-04-27 · Last updated 2026-05-08 · Last updated 2025-12-12
The pages we watch
Every page we read, so you can check it. Each is re-read on a schedule, and we keep a dated copy when it changes.
Where we get nothing
What Hebbia does not publish where we can read it
Of the 4 public pages we watch for Hebbia, these give us nothing right now.
Pricing
the page at that URL is not that document
hebbia.com/pricingSub-processor list
we have not found one published anywhere we looked
Before you conclude anything
This only means we couldn’t read it on a public page. Hebbia may share it in its agreement, a trust portal, or with any customer who asks.
So treat it as a question to ask them: “Can you send your sub-processor list, and tell us when it changes?”
What this page doesn’t tell you
No score.
Nothing here rates Hebbia. A short notice window is a contract term, not a criticism.
Public pages only.
Private notices and negotiated terms are invisible to us. Your agreement may say something different.
Wrong? Tell us.
Corrections are free, always. We reply within 2–3 business days.
How we read a page · The change log
Work at Hebbia? With an email at hebbia.com you can claim this record, suggest pages we should watch, and take a free copy of it. Claiming changes nothing we publish.
Is Hebbia in your product? Hear the morning we read a change.
You get the lines that moved, in Hebbia’s own words, and the date any window closes. No card. Nothing to cancel.