Is a spreadsheet enough to track sub-processors?

It can be. The spreadsheet holds the register; the work is reading every vendor's list on a schedule and noticing what moved. If someone owns that job and does it, a spreadsheet is enough.

What should a sub-processor register include?

For each sub-processor: what it does, where it processes, when the vendor added it, your window to object, when you first saw it, and the source URL with its read date. Our free register template has those columns.

How often should I check vendors' sub-processor lists?

Often enough that you'd see a change inside the shortest window you have. Some windows are a few days, so a monthly check can miss one entirely.

Can I keep my spreadsheet and use Xither?

Yes. Xither exports every dated copy as JSON or CSV, so the register can stay where your team already keeps it.

Comparison · doing it by hand

Should you track vendor sub-processor changes in a spreadsheet?

If you have a few vendors and someone who reads every list on a schedule, yes.

The spreadsheet holds the record. The work is the reading. Our free register template gets you started.

The lists do move.

186

vendors we watch

116

of them, vendors whose list page differed from our previous copy

of those, where a company was added or removed

Over the 61 days our record covers. Each change is on what changed 30 days after we read it.

Side by side

Six questions, both answers.

Same job. The difference is who does the reading.

Question

Xither

Spreadsheet

Who reads the pages?

XitherWe do, every day, for the vendors we watch.

SpreadsheetSomeone on your team, on whatever schedule they keep.

How you hear of a change

XitherAn email the morning we read it, with the lines that moved.

SpreadsheetWhen the person checking spots the difference between two readings.

The deadline

XitherWorked out from the vendor’s quoted window, with a drafted notice.

SpreadsheetA formula, once someone enters the date and the window.

Proof of what the page said

XitherA dated copy of every reading, with an RFC 3161 timestamp.

SpreadsheetA note that you looked, unless you also save a copy of the page.

When the owner leaves

XitherNothing changes. The workspace keeps reading.

SpreadsheetThe checks stop until someone picks them up.

Cost

XitherFrom $10 a month, after a 14-day free trial.

SpreadsheetFree, plus the hours it takes.

Pick

When each one is the better pick.

Keep the spreadsheet when

You depend on a handful of vendors, and their windows are long.
One person owns the checks, and does them more often than your shortest window.
Nobody will ask you to prove what a page said on a past date.

Choose Xither when

Your product runs on more AI vendors than anyone has time to read.
Some windows are a few days, so a missed week is a missed deadline.
Customers or auditors ask what a vendor’s page said, and when.

Meeting an objection deadline walks through the three things a deadline needs.

Fit

Is Xither the right tool for you?

Xither is for software teams that build with AI vendors and sell to businesses. It keeps your public sub-processor list current and watches the pages your vendors publish about your data: sub-processor lists, DPAs, privacy and trust pages, and model retirement schedules. When one changes, you get a message in Slack, Teams or email saying whether you need to do anything, with the lines that moved and any date that applies.

It fits when

You build software with AI vendors inside it, and your customers ask who handles their data. Check your code
Your DPA promises customers a current sub-processor list and notice when it changes. What you owe
Your vendors' DPAs give you a fixed window to object to a new sub-processor, and you need to know the day it starts. Meeting the deadline
Security questionnaires ask you to list every AI sub-processor in your product. How to answer
You need proof of what a vendor's page said on a given date.

Use something else when

You want to watch any page on the web, like a competitor's pricing. A general page-change monitor does that. Xither or Visualping
You need a whole vendor risk program: questionnaires, risk scores, SOC 2 report reviews and breach alerts. A third-party risk platform does that. Xither and risk platforms
We don't watch your vendors yet. Run the free scan first, or ask us to add them. Scan your page
You need to know what a clause means for your contract. That's a lawyer's job; we report what a page says.

Price

What Xither costs.

Two plans, paid by card: Essentials at $10 a month and Pro at $49 a month. A one-time due-diligence pack costs $149. The scan, the public record and the MCP server are free.

Essentials: $10 a month or $99 a year: daily watch on every vendor you name; alerts by email, Slack or Teams; your sub-processor page, hosted and kept current; your customers subscribe to it and get each change by email; drafted notices for your customers; dated evidence you can export.
Pro: $49 a month or $490 a year: everything in Essentials; a one-page review of any AI vendor before you adopt it; security-questionnaire answers about your AI vendors, in one export; a monthly vendor-monitoring report for your auditor; up to 5 people.

A 14-day free trial of Pro. No card, so nothing to cancel.

Not sure we watch your vendors? Scan your sub-processor page.

Common questions.

Is a spreadsheet enough to track sub-processors?: It can be. The spreadsheet holds the register; the work is reading every vendor's list on a schedule and noticing what moved. If someone owns that job and does it, a spreadsheet is enough.
What should a sub-processor register include?: For each sub-processor: what it does, where it processes, when the vendor added it, your window to object, when you first saw it, and the source URL with its read date. Our free register template has those columns.
How often should I check vendors' sub-processor lists?: Often enough that you'd see a change inside the shortest window you have. Some windows are a few days, so a monthly check can miss one entirely.
Can I keep my spreadsheet and use Xither?: Yes. Xither exports every dated copy as JSON or CSV, so the register can stay where your team already keeps it.

Not legal advice.

How often you must check, and what you must keep, depends on your own agreements. Ask your counsel.

Xither Staff Writer · reviewed October 31, 2026. Counts are read from the record when the page is served.

Hear the morning we read a change to your vendor’s sub-processor list or DPA.

Name the AI vendors in your product. When a page you watch changes a fact, you get the lines that moved and the date any window runs out.

Try it free for 14 days

No card. Nothing to cancel.