Netlify

netlify.com · facts updated 7 hours ago

Privacy facts at a glance

Retention: No specific retention period is stated in the excerpted documents.
Breach notification: The DPA defines 'Personal Data Breach' but does not state a specific notification timeframe in the excerpted text.
Transfer mechanism: EU Standard Contractual Clauses (EU SCC 2021/914) and UK IDTA; also EU-US DPF and Swiss-US DPF
DPA available: Yes
Certifications: SOC 2 Type 2 · ISO/IEC 27001 · ISO/IEC 27018:2019 · PCI DSS · PCI DSS v4.0.0 · HIPAA · CCPA · GDPR · DORA · EU-US DPF · Swiss-US DPF · VPAT
GDPR addressed: Yes
CCPA addressed: Yes

Tracked documents

https://www.netlify.com/privacy/ checked 16 hours ago

https://www.netlify.com/legal/terms-of-use/ checked 10 hours ago

Data processing agreement

https://www.netlify.com/pdf/netlify-dpa.pdf checked 9 hours ago

Subprocessor list

https://www.netlify.com/subprocessors checked 7 hours ago

Security / trust page

https://www.netlify.com/security/ checked 7 hours ago

Recent changes

Subprocessor list 7 hours ago

Document updated.

major Subprocessor list 2 days ago

Netlify's subprocessor list added 19 new subprocessors (MATTEL, Meta, The RealReal, Nestle Purina Petcare, BabyBjörn, Adyen, Autodesk, Zscaler, Stack Overflow, Vodafone, Danone, Finish Line, Hinge Health, University of Wisconsin Health, Confluent, London Business School, Axos Bank, Ethos, and one unlabeled) and removed 10 subprocessors (Okta, Peloton Interactive, Twilio, Google, Mailchimp, Nike, Dannon, Riot Games, VMware, Citrix, RVO Health).

Document updated.

Security / trust page 1 week ago

Document updated.

Security / trust page 1 week ago

Document updated.

Public summary; per-account review history visible to subscribers tracking this vendor.

Track Netlify in your workspace.

Get notified when Netlify adds a subprocessor, changes retention, updates their DPA, or quietly amends their privacy posture.

Start tracking — 14-day trial

No card required.