The change

Ramp updated its Platform Agreement (“Last Updated: October 8, 2026”) and its Data Processing Addendum (“Last Updated: October 9, 2026”). On October 14, its Trust Center posted an “AI Provider Subprocessor Update Notification” adding xAI and Fireworks AI.

Most of the new terms deal with AI. Ramp is no longer only a corporate card and spend platform. Its DPA now describes products called Token Spend Management, Router, and Stack, which “Transmit requests to the applicable AI providers and return responses.” The contract has caught up with that.

What changed

In the Platform Agreement:

• Generated Content. “As between Company and Ramp, Company owns any output generated by a SaaS Service specifically for Company.”

• No infringement cover for it. Ramp’s indemnity for its Subscription Services now excludes “any claims related to actual or alleged intellectual property infringement by or from Generated Content.”

• AI responsibility. “Company is responsible for appropriately configuring all automated features, reviewing and validating outputs and actions before relying on or implementing them, maintaining human oversight proportionate to the nature and risk of its use, and for all decisions Company makes based on use of the Services.”

• Ramp Data. The definition now reads “all data, including metadata and usage data, generated, collected, or logged by Ramp through the development or provision of Services or Cards.”

• Your indemnity. What you cover for Ramp now expressly includes “fees, charges, penalties” on top of losses and damages.

• Domain claims. A company that verifies control of an email domain can see and take over accounts on Ramp’s SaaS Services registered with that domain.

In the DPA:

• Transfers. “By using the Services, Company agrees to the transfer of Personal Data to and within the United States and other jurisdictions where Ramp operates.” The old sentence ended at “the United States.”

• Settings as instructions. Your instructions now include “instructions submitted through the Services by Company or its Authorized Users within their applicable permissions, including enabled integrations, workflows, and available data-handling settings.”

• AI providers you connect. “Where Company independently engages an AI provider or connected service and directs Ramp to transmit Personal Data to it, that recipient’s Processing is governed by its agreement with Company.”

• Data subject requests. Ramp removed the word “promptly” from its promise to tell you when someone asks to exercise their privacy rights.

You own it, and you answer for it

Owning AI output sounds like a win, and in one sense it is: “Generated Content itself is not Ramp Data.” The same clause adds the limits. Your rights “are subject to applicable provider terms, may not qualify for intellectual-property protection, and may be the same as or similar to content generated for others.” And “Company is responsible for reviewing Generated Content for accuracy, infringement, confidentiality, privacy, publicity, attribution, open-source, and other third-party-rights issues before use or publication.”

Put that next to the indemnity change. Ramp still defends you if its Subscription Services infringe someone’s patent or copyright. It does not defend you when the claim is about what its AI generated for you. If a report, email, or document that Ramp’s AI drafted copies someone else’s work, that claim is yours to handle.

Your data can travel further

The DPA’s transfer consent used to cover only the United States. It now covers “other jurisdictions where Ramp operates,” with transfers still run under the DPA and standard contractual clauses. If you have promised your own customers or auditors that finance data stays in the US, this is the line to check.

The other DPA changes move responsibility toward the settings you choose. Turning on an integration or workflow is now an instruction to Ramp. And if you connect your own AI provider, that provider sits outside Ramp’s DPA. Insightly’s new AI connector works the same way.

Ramp’s own AI providers are listed. xAI and Fireworks AI join Modal, added March 10, 2026, and Cerebras, added January 7, 2026. Each new entry is marked “Purpose: AI Provider” and “DPA Signed: Yes.” RingCentral added the same two providers earlier this year.

What did not change

• The ban on using Ramp to train AI was already there: “Without prior written consent from Ramp, Company shall not use the Services or any other Ramp Property to develop or train machine learning models or other types of artificial intelligence (AI).” Only its letter in the list changed.

• Ramp may still use De-Identified Data “for Ramp’s own business purposes, including to develop and improve Ramp products, services, and marketing efforts.”

• Ramp still promises to tell you about a security incident “promptly and without undue delay.”

Why this matters

Finance vendors are shipping AI and writing the risk into their terms. Stripe’s terms make AI agent actions legally binding on users, and Walmart, Google, and Stripe put AI agent mistakes on you this month. Ramp adds a different version of the same idea: the output is yours, so the problems with it are yours too.

Each new AI provider also means one more company that may see your spend data. Keeping track of that is part of monitoring the AI vendors in your stack.

Potential impact

If your team uses Ramp, the update raises five practical questions:

• Which Ramp AI features does your team use, and who reviews what they produce before it goes out?

• Would anything else cover you if AI output from Ramp drew an infringement claim?

• Have you promised customers or auditors that your finance data stays in the United States?

• Which integrations and workflows are turned on, now that they count as instructions under the DPA?

• Are xAI and Fireworks AI acceptable to your own customers and security reviews?

How Venpo detected it

Venpo monitors Ramp’s legal pages and Trust Center and flagged all three updates, with every inserted and deleted line marked. The records are on the Ramp change pages for the Platform Agreement, the DPA, and the subprocessor list. Every quote in this article was checked against the redlines.

Business outcome

A team that sees these changes can set a review step for AI output, confirm where its finance data may go, and decide on the new AI providers before they show up in a customer’s security questionnaire. That is the point of monitoring vendor terms of service.

Key takeaway

Since October 8, 2026, Ramp gives you ownership of what its AI generates but no infringement protection for it, and its DPA lets data move beyond the US, so put a human review on Ramp’s AI output before it leaves your company.