How many subprocessors does Fal use?

Fal lists 15 subprocessors on its published list, including Google LLC: Google Cloud Platform (GCP), Google LLC: G-Suite, Raintank Inc (Grafana Labs), Datadog, Inc., and Stripe, Inc and 10 more.

Where does Fal process customer data?

The subprocessors named by Fal are located in United States and Local, as stated on its list.

How quickly does Fal report a personal data breach to customers?

According to its DPA, Fal reports a personal data breach to customers without undue delay, with no set deadline: “Company will notify Client without undue delay after becoming aware of a Security Incident.”

How much notice does Fal give before adding a subprocessor?

Fal's DPA gives 15 days' notice of a new subprocessor, the time customers have to object: “Company will notify Client of its intent to update the Subprocessor List at least 15 days prior to engaging a new Subprocessor.”

How does Fal transfer personal data outside the EU?

Fal's DPA relies on standard contractual clauses, the EU–US Data Privacy Framework, and adequacy decisions: “The parties will conduct any transfers of European Economic Area, the United Kingdom, and Swiss residents' Client Personal Data to a country not subject to an adequacy decision (a "Data Transfer") pursuant to the SCCs, which are incorporated and deemed executed by this reference.”

Does Fal have a SOC 2 Type II report?

Yes. Fal's trust page lists a SOC 2 Type II report: “Fal's Latest SOC 2 Type II Report is Available”

Which security certifications does Fal list?

Fal's trust page lists SOC 2 Type II.

When was Fal's subprocessor list last checked?

ClauseTrail last checked Fal's subprocessor list on November 3, 2026 and last saw it change on October 28, 2026. Lists are re-checked daily.

How do I find out when Fal adds or removes a subprocessor?

ClauseTrail monitors Fal's subprocessor list, DPA, privacy policy and terms and emails you the exact change — who was added or removed and what the page said before and after. The first vendors are free.

Fal Subprocessors List (November 2026): Changes and History

Fal names 15 subprocessors on its published list. Read from the vendor's own page and re-checked daily.

Last checked November 3, 2026 Last change October 28, 2026 Official source ↗

Fal subprocessors (November 2026)

#	Subprocessor	Purpose	Location
1	Google LLC: Google Cloud Platform (GCP)	Cloud Infrastructure	United States
2	Google LLC: G-Suite	Email communication & Cloud Collaboration	United States
3	Raintank Inc (Grafana Labs)	Connectivity monitoring, logging and analytics.	United States
4	Datadog, Inc.	Ingesting, parsing, querying and performing analytics on Service application and infrastructure logs.	United States
5	Stripe, Inc	Billing and payment processor	United States
6	Amazon Web Services, Inc.	Cloud Service Provider & Hosting	United States
7	Slack Technologies, LLC	Internal communication tool used by Engineering	United States
8	Pylon Labs, Inc.	Tool used to process inbound support requests.	United States
9	Cloudflare, Inc.	Content distribution, security, abuse prevention and DNS services for web traffic transmitted to and from the Services.	United States, Local
10	Linear Orbit, Inc.	Project management and product & engineering related activity tracking, product quality documentation.	United States
11	Lambda, Inc.	GPU Hosting and Infrastructure Provider	United States
12	Twilio, Inc.	Marketing Email/SMS Communications	United States
13	Crusoe Energy System LLC	GPU Hosting and Infrastructure Provider	United States
14	Salesforce, Inc.	Sales CRM	United States
15	Tigris Data	Data storage and processing	United States

Get an email when Fal changes its subprocessors

ClauseTrail re-checks this list every day and tells you exactly who was added or removed — including when a vendor starts sending data to an AI provider. The first vendors are free.

Track Fal free

Key DPA terms at Fal

What Fal's data processing agreement commits to, with the sentence each answer comes from. SCCs or the Data Privacy Framework: what's the difference?

Breach notification: Without undue delay, with no set deadline

“Company will notify Client without undue delay after becoming aware of a Security Incident.”
DPA, fal.ai ↗
Notice of a new subprocessor: 15 days ahead

“Company will notify Client of its intent to update the Subprocessor List at least 15 days prior to engaging a new Subprocessor.”
DPA, fal.ai ↗
Transfers outside the EU: Standard contractual clauses, the EU–US Data Privacy Framework, and adequacy decisions

“The parties will conduct any transfers of European Economic Area, the United Kingdom, and Swiss residents' Client Personal Data to a country not subject to an adequacy decision (a "Data Transfer") pursuant to the SCCs, which are incorporated and deemed executed by this reference.”

“to a country not subject to an adequacy decision”

“If Company notifies Client that Data Transfers can be conducted in compliance with Data Protection Law pursuant to an alternative transfer mechanism such as the Data Privacy Framework, the parties will rely on the alternative mechanism to legitimize Data Transfers instead of the provisions that follow.”
DPA, fal.ai ↗
Customer data after the contract ends: Deleted or returned when the contract ends

“Company will retain the Client Personal Data until the termination of the Agreement, unless otherwise agreed to by the parties.”
DPA, fal.ai ↗
Audit rights: Through certifications and audit reports only

“Client agrees to exercise its audit rights by first requesting the Reports as described in Section 3.1 (Company Audits).”
DPA, fal.ai ↗

Certifications at Fal

What Fal's trust page lists, with the text each one comes from. SOC 2 Type I or Type II: what's the difference?

SOC 2 Type II: Active

“Fal's Latest SOC 2 Type II Report is Available”
Trust page, trust.fal.ai ↗

Documents we track for Fal

DPA: checked November 3, 2026 fal.ai ↗
Privacy policy: checked November 3, 2026 changed October 6, 2026 fal.ai ↗
Subprocessor list: checked November 3, 2026 changed October 28, 2026 trust.fal.ai ↗
Terms of service: checked November 3, 2026 fal.ai ↗
Trust page: checked November 3, 2026 trust.fal.ai ↗

Change history

October 28, 2026

Subprocessor added

Fal added Google LLC: G-Suite (United States) as a subprocessor.
October 28, 2026

Subprocessor added

Fal added Google LLC: Google Cloud Platform (GCP) (United States) as a subprocessor.
October 20, 2026

Subprocessor removed

Fal removed Google LLC: G-Suite from its subprocessor list.
October 20, 2026

Subprocessor removed

Fal removed Google LLC: Google Cloud Platform (GCP) from its subprocessor list.
October 6, 2026

Privacy policy changed

The Data Subject Requests section now directs individuals to use fal.ai's Privacy Center instead of emailing support@fal.ai to exercise their access, erasure, correction, objection or restriction rights.

Tracking since October 12, 2026. Every change links to the two versions of the document it came from. All vendors' changes →

Fal subprocessors FAQ

How many subprocessors does Fal use?: Fal lists 15 subprocessors on its published list, including Google LLC: Google Cloud Platform (GCP), Google LLC: G-Suite, Raintank Inc (Grafana Labs), Datadog, Inc., and Stripe, Inc and 10 more.
Where does Fal process customer data?: The subprocessors named by Fal are located in United States and Local, as stated on its list.
How quickly does Fal report a personal data breach to customers?: According to its DPA, Fal reports a personal data breach to customers without undue delay, with no set deadline: “Company will notify Client without undue delay after becoming aware of a Security Incident.”
How much notice does Fal give before adding a subprocessor?: Fal's DPA gives 15 days' notice of a new subprocessor, the time customers have to object: “Company will notify Client of its intent to update the Subprocessor List at least 15 days prior to engaging a new Subprocessor.”
How does Fal transfer personal data outside the EU?: Fal's DPA relies on standard contractual clauses, the EU–US Data Privacy Framework, and adequacy decisions: “The parties will conduct any transfers of European Economic Area, the United Kingdom, and Swiss residents' Client Personal Data to a country not subject to an adequacy decision (a "Data Transfer") pursuant to the SCCs, which are incorporated and deemed executed by this reference.”
Does Fal have a SOC 2 Type II report?: Yes. Fal's trust page lists a SOC 2 Type II report: “Fal's Latest SOC 2 Type II Report is Available”
Which security certifications does Fal list?: Fal's trust page lists SOC 2 Type II.
When was Fal's subprocessor list last checked?: ClauseTrail last checked Fal's subprocessor list on November 3, 2026 and last saw it change on October 28, 2026. Lists are re-checked daily.
How do I find out when Fal adds or removes a subprocessor?: ClauseTrail monitors Fal's subprocessor list, DPA, privacy policy and terms and emails you the exact change — who was added or removed and what the page said before and after. The first vendors are free.