How many subprocessors does StrongDM use?

StrongDM lists 22 subprocessors on its published list, including Amazon Web Services, DataDog, Google Cloud Platform, Honeycomb, and Sentry and 17 more.

Where does StrongDM process customer data?

The subprocessors named by StrongDM are located in United States and Europe (EU), as stated on its list.

How quickly does StrongDM report a personal data breach to customers?

According to its DPA, StrongDM reports a personal data breach to customers without undue delay, with no set deadline: “StrongDM maintains security incident management policies and procedures and shall notify Customer without undue delay and in line with the timelines required by applicable Data Protection Laws”

How much notice does StrongDM give before adding a subprocessor?

StrongDM's DPA gives 30 days' notice of a new subprocessor, the time customers have to object: “StrongDM shall give Customer written notice of the appointment of any new Subprocessor, including details of the Processing to be undertaken by the Subprocessor, at least thirty (30) days before authorizing the Subprocessor to Process Customer Personal Information.”

How does StrongDM transfer personal data outside the EU?

StrongDM's DPA relies on standard contractual clauses and adequacy decisions: “StrongDM and Customer conclude Module 2 (Controller-to-Processor) of the SCCs”

Does StrongDM have a SOC 2 Type II report?

Yes. StrongDM's trust page lists a SOC 2 Type II report: “SOC 2 Type 2”

Which security certifications does StrongDM list?

StrongDM's trust page lists SOC 2 Type II and PCI DSS.

When was StrongDM's subprocessor list last checked?

ClauseTrail last checked StrongDM's subprocessor list on September 28, 2026. Lists are re-checked daily.

How do I find out when StrongDM adds or removes a subprocessor?

ClauseTrail monitors StrongDM's subprocessor list, DPA, privacy policy and terms and emails you the exact change — who was added or removed and what the page said before and after. The first vendors are free.

StrongDM Subprocessors List (September 2026): Changes and History

StrongDM names 22 subprocessors on its published list. Read from the vendor's own page and re-checked daily.

Last checked September 28, 2026 Official source ↗

StrongDM subprocessors (September 2026)

#	Subprocessor	Purpose	Location
1	Amazon Web Services	Platform Hosting	United States, Europe (EU)
2	DataDog	Observability	United States
3	Google Cloud Platform	Platform Hosting	United States, Europe (EU)
4	Honeycomb	Observability	United States
5	Sentry	Observability	United States
6	PostHog, Inc.	Platform and Client Analytics	United States, Europe (EU)
7	Aha!	Product	United States
8	DocuSign	Sales Operations	United States
9	Gong	Sales Operations	United States
10	Google Workspace	Customer Communications, Office Applications	United States
11	HubSpot	Customer Relationship Management	United States
12	SafeBase	Trust, Security, & Compliance Documentation Platform	United States
13	Salesforce	Sales Operations	United States
14	Slack	Customer Communications	United States
15	Zendesk	Customer Support	United States
16	Zoom	Customer Communications	United States
17	Anthropic PBC	Large-language Model data processing	United States
18	OpenAI OpCo, LLC	Large-language Model data processing	United States
19	AWS, Inc. (Bedrock LLM Service)	Large-language Model data processing	United States
20	Cerebras Systems Inc.	Large-language Model data processing	United States
21	Groq, Inc.	Large-language Model data processing	United States
22	Google, Inc. (Gemini API)	Large-language Model data processing	United States

Get an email when StrongDM changes its subprocessors

ClauseTrail re-checks this list every day and tells you exactly who was added or removed — including when a vendor starts sending data to an AI provider. The first vendors are free.

Track StrongDM free

Key DPA terms at StrongDM

What StrongDM's data processing agreement commits to, with the sentence each answer comes from. SCCs or the Data Privacy Framework: what's the difference?

Breach notification: Without undue delay, with no set deadline

“StrongDM maintains security incident management policies and procedures and shall notify Customer without undue delay and in line with the timelines required by applicable Data Protection Laws”
DPA, www.strongdm.com ↗
Notice of a new subprocessor: 30 days ahead

“StrongDM shall give Customer written notice of the appointment of any new Subprocessor, including details of the Processing to be undertaken by the Subprocessor, at least thirty (30) days before authorizing the Subprocessor to Process Customer Personal Information.”
DPA, www.strongdm.com ↗
Transfers outside the EU: Standard contractual clauses and adequacy decisions

“StrongDM and Customer conclude Module 2 (Controller-to-Processor) of the SCCs”

“any country deemed to have an adequate level of data protection by the European Commission or the competent authorities”
DPA, www.strongdm.com ↗
Customer data after the contract ends: Deleted or returned when the contract ends

“StrongDM shall, on the written request of Customer and solely to the extent required by Data Protection Laws, return all Customer Personal Information to Customer and/or at Customer's request delete the same from its systems”
DPA, www.strongdm.com ↗
Audit rights: Once a year

“Audits shall take place no more than once in any calendar year unless otherwise required by a Supervisory Authority.”
DPA, www.strongdm.com ↗

Certifications at StrongDM

What StrongDM's trust page lists, with the text each one comes from. SOC 2 Type I or Type II: what's the difference?

SOC 2 Type II: Active

“SOC 2 Type 2”
Trust page, security.strongdm.com ↗
PCI DSS: Active

“PCI DSS v4.0.0”
Trust page, security.strongdm.com ↗

Documents we track for StrongDM

DPA: checked September 28, 2026 www.strongdm.com ↗
Privacy policy: checked September 28, 2026 www.strongdm.com ↗
Subprocessor list: checked September 28, 2026 security.strongdm.com ↗
Terms of service: checked September 28, 2026 www.strongdm.com ↗
Trust page: checked September 28, 2026 security.strongdm.com ↗

Change history

Tracking since September 28, 2026. No change has been published since; additions, removals and document changes will appear here as they're published.

StrongDM subprocessors FAQ

How many subprocessors does StrongDM use?: StrongDM lists 22 subprocessors on its published list, including Amazon Web Services, DataDog, Google Cloud Platform, Honeycomb, and Sentry and 17 more.
Where does StrongDM process customer data?: The subprocessors named by StrongDM are located in United States and Europe (EU), as stated on its list.
How quickly does StrongDM report a personal data breach to customers?: According to its DPA, StrongDM reports a personal data breach to customers without undue delay, with no set deadline: “StrongDM maintains security incident management policies and procedures and shall notify Customer without undue delay and in line with the timelines required by applicable Data Protection Laws”
How much notice does StrongDM give before adding a subprocessor?: StrongDM's DPA gives 30 days' notice of a new subprocessor, the time customers have to object: “StrongDM shall give Customer written notice of the appointment of any new Subprocessor, including details of the Processing to be undertaken by the Subprocessor, at least thirty (30) days before authorizing the Subprocessor to Process Customer Personal Information.”
How does StrongDM transfer personal data outside the EU?: StrongDM's DPA relies on standard contractual clauses and adequacy decisions: “StrongDM and Customer conclude Module 2 (Controller-to-Processor) of the SCCs”
Does StrongDM have a SOC 2 Type II report?: Yes. StrongDM's trust page lists a SOC 2 Type II report: “SOC 2 Type 2”
Which security certifications does StrongDM list?: StrongDM's trust page lists SOC 2 Type II and PCI DSS.
When was StrongDM's subprocessor list last checked?: ClauseTrail last checked StrongDM's subprocessor list on September 28, 2026. Lists are re-checked daily.
How do I find out when StrongDM adds or removes a subprocessor?: ClauseTrail monitors StrongDM's subprocessor list, DPA, privacy policy and terms and emails you the exact change — who was added or removed and what the page said before and after. The first vendors are free.