Notice of New AI Sub-processors for Arist AI / Arist AI Diagnostic (07-14-26)
Dear Arist Client,
We are writing to provide notice that Arist Holdings Inc. (“Arist”) intends to add the following new sub-processors in connection with Arist AI, including any standalone offering identified as Arist AI Diagnostic:
Anthropic, PBC, using the Claude API;
OpenAI, LLC, using the OpenAI API Platform;
ElevenLabs, Inc., using ElevenLabs conversational voice and speech-processing services;
Braintrust Data, Inc., for AI evaluations and related output-quality testing;
Intercom, for customer support ticketing, help center functionality and product tours; and
Tray.ai, Inc., for enterprise integration and automation functionality.
This notice is provided under the sub-processor notice provisions of your agreement and/or applicable data processing addendum with Arist, including the 30-day prior notice period for new sub-processors, where applicable. Unless otherwise agreed in writing with your organization, Arist will not begin using these new sub-processors to process your Personal Data for Arist AI / Arist AI Diagnostic until at least 30 days after this notice.
Background on Arist AI / Arist AI Diagnostic
Arist AI is an AI-enabled feature within the Arist platform designed to help customers understand workforce feedback, training needs, capability gaps, organizational themes, employee comments and related opportunities. Depending on how your organization enables and configures Arist AI / Arist AI Diagnostic, the functionality may support AI-led interviews or interactions, analysis of uploaded materials, generation of interview transcripts, summaries, themes, gap analyses, recommended interventions, reports and related outputs.
Arist AI is admin-driven and intended to support organizational workforce planning, training prioritization and enablement use cases. It is not intended to replace your organization's human resources, legal, compliance, workplace safety, investigation, reporting or other professional functions. Your organization remains responsible for configuring Arist AI / Arist AI Diagnostic, providing required notices and lawful bases, designating users and output recipients, and determining whether and how to review, investigate, act on or report any information provided through Arist AI / Arist AI Diagnostic.
New Data Sub-processors
Anthropic, PBC
Anthropic, PBC (“Anthropic”) provides large language model services through the Claude API. Arist expects to use Anthropic to support language-model inference for Arist AI, which may include analyzing Arist AI inputs, transcripts, uploaded materials and project context, and generating draft themes, summaries, recommendations or other Arist AI outputs.
Anthropic may process the limited data necessary to provide this functionality, which may include prompts, instructions, source materials, interview transcripts, uploaded documents, related context and generated outputs. Anthropic is configured by Arist for United States data residency to the extent supported by Anthropic’s applicable settings and terms. Arist will use Anthropic to process this data only to provide Arist AI to Arist customers. Arist has declined to provide data to Anthropic for model improvement. Under Anthropic’s applicable API terms and data-use materials, Anthropic does not use customer prompts or responses submitted through its commercial products, including the Anthropic API, to train its models unless the customer chooses to provide that data for model improvement.
OpenAI, LLC
OpenAI, LLC (“OpenAI”) provides large language model and related AI services through the OpenAI API Platform. Arist expects to use OpenAI to support Arist AI functionality, which may include language-model inference, analysis, summarization, classification, gap analysis and recommendations.
OpenAI may process the limited data necessary to provide this functionality, which may include prompts, instructions, source materials, interview transcripts, uploaded documents, related context and generated outputs. OpenAI is configured by Arist for United States data residency to the extent supported by OpenAI’s applicable settings and terms. Arist will use OpenAI to process this data only to provide Arist AI to Arist customers. Arist has not opted in to share this data with OpenAI for model training or improvement. Under OpenAI’s applicable API Platform terms and data-use materials, OpenAI does not use customer inputs or outputs submitted through the API Platform to train or improve OpenAI models unless the customer explicitly opts in to share that data.
ElevenLabs, Inc.
ElevenLabs, Inc. (“ElevenLabs”) provides conversational voice and speech-processing services. Arist expects to use ElevenLabs to support optional voice interview functionality for Arist AI, including AI-led voice interactions, speech processing and transcription.
Where voice functionality is enabled, audio may be transmitted to ElevenLabs on a transient basis to conduct the voice interaction and/or generate a transcript. ElevenLabs processes audio on a transient basis in the United States and globally, as applicable to ElevenLabs’ services, data processing terms and sub-processing arrangements. Transcripts and related call metadata are returned to Arist by signed webhook for use in Arist AI. Arist does not use voiceprints, speaker recognition templates or other biometric identifiers through Arist AI, and Arist does not retain raw voice audio beyond the processing interval necessary to produce the transcript. Arist will use ElevenLabs to process this data only to provide Arist AI to Arist customers. Arist has not agreed to provide this data to ElevenLabs for model training or improvement. Arist will not authorize ElevenLabs to use customer Personal Data, Arist AI inputs or Arist AI outputs for model training or improvement except as expressly permitted under the applicable agreement with the customer.
Braintrust Data, Inc.
Braintrust Data, Inc. (“Braintrust”) provides AI evaluation tooling. Arist expects to use Braintrust to support structured testing and evaluation of Arist AI outputs, prompts, workflows and related functionality, including assessments intended to improve output quality, reliability and consistency.
Braintrust may process the limited data necessary to provide this functionality, which may include prompts, model inputs, model outputs, evaluation datasets, traces, scoring criteria, annotations and related metadata submitted by Arist. Arist expects to use Braintrust to process this data only to support and evaluate Arist AI functionality for Arist customers. Braintrust's DPA indicates that its service may store customer AI evaluation data, prompts, model outputs, datasets and traces generated by customer applications, and Arist’s current configuration for Braintrust is United States data residency.
Intercom
Intercom, Inc. and its affiliates (collectively “Intercom”) provide customer support ticketing, help center and product-tour functionality. Arist expects to use Intercom to support customer support operations and user guidance in connection with Arist’s services, including Arist AI / Arist AI Diagnostic.
Intercom may process the limited data necessary to provide this functionality, which may include names, business contact details, account data, support communications, service usage information and other support-related content submitted to or through Intercom. Arist expects to use Intercom to process this data only to provide support, help-center and product-tour functionality for Arist customers. Intercom may process this data in the United States and globally, as applicable to Intercom’s services, data processing terms and sub-processing arrangements.
Tray.ai, Inc.
Tray.ai, Inc. (“Tray”) provides an enterprise integration and automation platform. Arist expects to use Tray to support integrations, workflow automation and connected-system functionality for Arist’s services, including future Arist AI / Arist AI Diagnostic workflows where applicable.
Tray may process the limited data necessary to provide this functionality, which may include identifiers, business contact details, workflow payload data, connected-application data and other Personal Data passed through or processed by integration workflows configured by Arist. Arist expects to use Tray to process this data only to provide integration and automation functionality for Arist customers. Tray's privacy materials state that Tray uses cloud-based services to store and process data in the United States, and Arist’s current configuration for Tray is United States data residency.
Categories of Personal Data
Depending on your organization's configuration and use of Arist AI / Arist AI Diagnostic, these new sub-processors may process limited Personal Data contained in Arist AI inputs, outputs, support records and/or workflow data, such as:
• identifiers and contact details, such as name, email address, phone number or employee ID;
• organizational and employment-related context, such as role, manager, department, work location, audience segment, training history or business context;
• prompts, instructions, uploaded materials, interview questions, responses, transcripts, messages, support tickets, workflow payloads, call metadata and other user-generated content;
• AI-generated summaries, themes, gap analyses, recommendations, reports and related outputs; and
• other Personal Data submitted by or on behalf of your organization or users through Arist AI / Arist AI Diagnostic.
Arist AI / Arist AI Diagnostic is not intended to solicit protected health information, biometric information, children's data, special categories of personal data, sensitive personal information or other regulated data unless expressly agreed in writing. Because Arist AI / Arist AI Diagnostic may support open-ended responses, uploads, support inquiries or connected-system workflows, users may incidentally submit sensitive information, including information relating to health, disability, mental health, self-harm, harassment, discrimination, retaliation, workplace violence, misconduct, labor matters or similar topics. Your organization remains responsible for configuring or approving, as applicable, the project objectives, audience, interview plan, source materials, enabled features and participant guidance for Arist AI / Arist AI Diagnostic, including participant instructions, and for ensuring that any such processing is lawful, properly noticed and properly instructed.
Data Protection Commitments
Arist will require these new sub-processors to process Personal Data only to provide the applicable services to Arist and subject to written data protection terms. Arist will remain responsible for the performance of its sub-processors as provided in the applicable agreement and Data Processing Addendum.
Arist will not use customer Personal Data, customer content, Arist AI inputs, prompts or outputs to train, retrain, fine-tune or improve artificial intelligence, machine learning, large language model or similar systems, except that Arist may generate permitted usage metadata in accordance with the applicable agreement. For AI sub-processors, Arist will use applicable contractual commitments, account settings and technical controls designed to prevent such providers from using customer Personal Data, customer content, Arist AI inputs, prompts or outputs for model training or improvement, except as expressly permitted under the applicable agreement with the customer.
Where Personal Data is transferred outside the European Economic Area, United Kingdom or Switzerland, Arist will use appropriate safeguards as required under applicable Data Protection Laws, which may include the EU Standard Contractual Clauses and UK Addendum, as applicable. Where Arist AI uses AI-generated or AI-conducted interactions, Arist AI will disclose to participants that they are interacting with an AI system, consistent with applicable transparency requirements including those under EU AI Act Article 50 (effective August 2, 2026).
Additional Information
Arist's updated sub-processor list is available at Arist's legal sub-processors page, located at https://arist.com/legal/sub-processors or any successor URL. The new sub-processors described above are listed there with information regarding their role in providing Arist AI / Arist AI Diagnostic.
If you object to any of these new sub-processors on reasonable data protection grounds, please email privacy@arist.co with the subject line “Sub-processor Objection” within 30 days after receipt of this notice and include the grounds for your objection. If we receive a timely objection, we will work with you in good faith as provided in your applicable agreement and Data Processing Addendum. Please note that an unresolved objection may limit or prevent your organization's ability to use Arist AI / Arist AI Diagnostic or the affected functionality.
All other terms of your agreement with Arist remain unchanged.
Thank you,
Arist Holdings Inc.
