Anthropic Subprocessor Changes

[flagged]

Worth noting the distinction between subprocessors that handle customer data vs. those that handle operational/business data. The ones in the "Customer Data" category are where the compliance implications are most significant for enterprise customers under GDPR, HIPAA, or similar frameworks.

For anyone evaluating this for a procurement decision: the relevant questions are (1) which subprocessors have access to content you send in API requests, (2) what data processing agreements are in place with each, and (3) what is the notification window for new subprocessor additions. The 30-day notice for customer data subprocessors is fairly standard for enterprise SaaS at this point.

Publishing this list proactively rather than only on request is a positive signal, even if the list itself is fairly short.

The more they share, the easier it is to exploit the system.

Unless you're not.

Look, if you make an LLM and you don't want people using it in a particular way then communicate with them. And if you can detect what you think is such behavior, then communicate. Out in real life you don't threaten people with end of relationship with every issue that comes up.

It's such childish business to always pull out and threaten the ban hammer any time there's any possible issue with how they want their system used.

With respect to my private data, it seems all roads eventually lead to California.