How to track vendor ToS, subprocessor, and pricing changes (without reading legal pages weekly)
The question
Your vendors' terms of service, subprocessor lists, and pricing pages all changed at some point in the last year — you just don't know when, or what changed. How do you catch these quiet edits, and how do you reconstruct the ones you already missed?
What's actually true
Three things make this problem worth solving deliberately rather than by vibes:
- These pages change without ceremony. Unlike API deprecations, which at least sometimes ship with a changelog entry and a date (OpenAI's Assistants API shutdown is scheduled for August 2026, announced ahead of time), legal and pricing pages are typically edited in place. There is no feed to subscribe to.
- The changes carry real obligations. If your own privacy policy promises customers a current subprocessor list, a vendor adding a subprocessor is a compliance event on your side. If your margins price in a vendor's current tier, a pricing restructure is a business event. Both arrive silently.
- The tooling market treats these as separate problems. API-change monitors (FlareCanary $19/mo, API Drift Alert $149/mo, and other entrants) watch specs. Enterprise TPRM (UpGuard, from around $1,750/mo) covers vendor risk broadly at enterprise prices. Below that price line, no product we could find bundles API + legal + pricing changes per vendor into one feed. The existing Vendor.Watch site is a static database; topics.watch is a newsletter.
How to check it yourself
The good news: for the past, you don't need to have been watching. The Wayback Machine's public API archives many vendors' legal and pricing pages.
- List the URLs that matter per vendor: terms of service, privacy policy, subprocessor list, pricing page.
- Pull historical snapshots. Query the Wayback Machine for each URL's captures over the last 12 months. Take the oldest capture in your window and the newest.
- Diff them. A plain text diff of the extracted page text surfaces most substantive edits: new subprocessor entries, changed liability language, moved price points.
- Going forward, snapshot on a schedule. A monthly cron that saves each page (or requests a fresh Wayback capture) gives you your own baseline to diff against.
- Record findings with the archive links. "Subprocessor X appears in the March capture and not the September one" is a verifiable statement — the kind you can put in a compliance review.
The honest caveat: not every page is archived, and archives can lag. Where there's no capture, say so rather than guessing — an evidence gap is a finding too.
The bundled version
VendorWatch does this as part of one $29 audit per vendor stack: 12 months of legal and pricing-page changes (via public archives) plus API deprecations classified against the endpoints you declared — every finding linked to the page or spec state we observed.