Vendor record · weaviate.io
What Weaviate promises about your data.
Where Weaviate publishes its promises, how long it gives you when it adds a sub-processor, and what has changed.
- Where it publishes
Weaviate lists its sub-processors at weaviate.io/subprocessors. We last read it on October 15, 2026.
- What has changed
We've recorded no change to its sub-processor list or data processing agreement between August 31, 2026 and September 15, 2026. Subscribers hear about a change the morning we read it; the public record shows it 30 days later.
- Its window
When it adds a sub-processor, its clause at weaviate.io/dpa (read October 15, 2026) gives you 30 days to object.
- Window
- 30
- Sub-processors
- 21
- Pages
- 4
- Copies
- 16
days to object when it adds a sub-processor
sub-processors named
pages we watch
dated copies of all its pages, since August 31, 2026
Weaviate DPA
Weaviate's data processing agreement gives 30 days to object to a new sub-processor. Here is the clause, from our October 15, 2026 copy:
30
days to object
“The Customer, upon being informed, may object to the appointment of that Subprocessor within 30 days on reasonable data protection grounds.”
Found automatically and not yet checked by a person. The quote is exact, and the link goes to the source. Nothing here says whether the term is good or bad, only that Weaviate published it.
weaviate.io/dpa · read 2026-10-15 · fingerprint f3540c464b988279…
Weaviate sub-processors
Weaviate publishes a sub-processor list at weaviate.io/subprocessors; we last read it on October 15, 2026. It names 21 entries. The first 15, as the list prints them: Amazon Web Services; Dash0; Descope; Fivetran; Google Cloud Platform; Google Workspace; HubSpot; Microsoft Azure; Modal; MongoDB; Omni; OpenAI; Orb; Pylon; Slack; and 6 more in the full table below. The public record holds no change to the list read before September 15, 2026. A change we read after September 15, 2026 is published 30 days after we read it.
21 named · full table
Every public change we have recorded · Where vendors publish their lists
How long Weaviate keeps your data
Weaviate's privacy policy (weaviate.io/privacy, in the copy read September 20, 2026) says: “We retain your personal data for a period of 5 years or as long as required to realize the objectives as described in this privacy policy.”
Training on customer data
“The terms "Controller", "Data Subject", "Member State", "Personal Data", "Personal Data Breach" and "Processing" shall have the same meaning as in the GDPR, and their cognate terms shall be construed accordingly. ### 2. Processing of Company Personal Data Data Processor shall: - comply with all applicable Data Protection Laws in the Processing of Com…”
weaviate.io/dpa · read 2026-10-15
Training on customer data
“This includes IP-addresses, device attributes and connection information. | To supply our service, to supply our support, to improve our products and services, to ensure the security of our services, and to deal with possible complaints and disputes. | Information about your use of Weaviate.”
weaviate.io/privacy · read 2026-09-20
Retention windows vendors publish · What vendors say about training
What the pages say
Read automatically from the pages below and shown as printed. A missing row is a gap in our reading, not proof it isn’t there.
Sub-processors named · 21 · 3 name an AI provider we list
Amazon Web Services
Infrastructure
Dash0
Infrastructure
Descope
Authentication
Fivetran
Infrastructure
Google Cloud Platform
Infrastructure
Google Workspace
Communications
HubSpot
Communications
Microsoft Azure
Infrastructure
Modal
Infrastructure
MongoDB
Infrastructure
Omni
Support
OpenAIAI · OpenAI
Infrastructure
Orb
Support
Pylon
Support
Slack
Support
Sphere
Support
Stripe
Support
Temporal Cloud
Infrastructure
Twilio
Communications
Voyage AIAI · Voyage AI
Infrastructure
Weaviate B.V.AI · Weaviate
Affiliate
Amsterdam, The Netherlands
The pages' own stamps: Last Updated 2026-09 · last updated 2024-02
The pages we watch
Every page we read, so you can check it. Each is re-read on a schedule, and we keep a dated copy when it changes.
Where we get nothing
What Weaviate does not publish where we can read it
Of the 4 public pages we watch for Weaviate, these give us nothing right now.
Trust and security
the page at that URL is not that document
weaviate.io/securityBefore you conclude anything
This only means we couldn’t read it on a public page. Weaviate may share it in its agreement, a trust portal, or with any customer who asks.
So treat it as a question to ask them: “Can you send your sub-processor list, and tell us when it changes?”
What this page doesn’t tell you
No score.
Nothing here rates Weaviate. A short notice window is a contract term, not a criticism.
Public pages only.
Private notices and negotiated terms are invisible to us. Your agreement may say something different.
Wrong? Tell us.
Corrections are free, always. We reply within 2–3 business days.
How we read a page · The change log
Work at Weaviate? With an email at weaviate.io you can claim this record, suggest pages we should watch, and take a free copy of it. Claiming changes nothing we publish.
Is Weaviate in your product? Hear the morning we read a change.
You get the lines that moved, in Weaviate’s own words, and the date any window closes. No card. Nothing to cancel.