EU-US Data Privacy Framework List: which SaaS vendors are certified

A transfer of personal data to a US company on the official Data Privacy Framework List needs no further transfer mechanism. Here is where each of 160 SaaS and cloud vendors stands on that list, checked against it every week, last on 2026-11-09. The list replaced the Privacy Shield list in July 2023. Where the Framework itself stands in the courts, from the court records: legal status.

"Not on the list" includes the European vendors that have no US company to certify; for them the question rarely arises. The ones it matters for are the 6 vendors whose contracting entity is a US company: Airtable, Anthropic, Cursor, Docusign, Lovable and OpenAI. We searched the list for each brand and contracting entity and found no entry. Transfers to them rest on another mechanism, usually the Standard Contractual Clauses, which bring a transfer impact assessment with them.

Vendor by vendor

"Certified since" is the date the list gives; dates before 10 July 2023 are Privacy Shield certifications the organisation carried into the Framework. "Re-certification due" is the date by which the organisation must renew its annual self-certification. "Own page names Privacy Shield" is how the vendor's own pages use the name, explained in the next section.

Vendor pages that still name the Privacy Shield

The Privacy Shield has not covered a transfer since July 2020, but some vendors' own pages still name it. We searched the newest stored copy of every page the registry reads for each vendor (trust centres, data processing agreements, subprocessor lists, residency and transfer pages) for the words "Privacy Shield". 18 vendors' pages name it. On the pages of 7 of them it is named as something that still applies. Each sentence is below as the page writes it, with the page, the day we read it, and the vendor's entry on the list for comparison.

• CrowdStrike Names it as in effect

  “CrowdStrike shall comply with all Privacy and Security Laws, the EU-US Privacy Shield Framework and the Swiss-US Privacy Shield Framework as set forth by the US Department of Commerce regarding the collection, use, and retention of Personal Data from the European Economic Area, Switzerland, and the United Kingdom, as applicable.”

  crowdstrike.com, read 2026-11-02 · EU-U.S. entry on the list: Active

• Vanta Names it as in effect

  “Vanta maintains an active Privacy Shield membership.”

  vanta.com, read 2026-11-02 · EU-U.S. entry on the list: Active

• Bitwarden Names it as another name for the Framework

  “Bitwarden complies with the Data Privacy Framework (DPF), previously called Privacy Shield, which defines the safe transfer of personal data.”

  bitwarden.com, read 2026-11-02 · EU-U.S. entry on the list: Active

• Jotform Names it as another name for the Framework

  “In such cases, the Data Privacy Framework (DPF / Privacy Shield) shall apply and the Standard Contractual Clauses shall not apply.”

  jotform.com, read 2026-11-02 · EU-U.S. entry on the list: Active

• Cisco Webex Says it was invalidated, and the vendor still keeps to it

  “While the Privacy Shield is no longer a valid transfer mechanism, continued participation demonstrates Cisco’s continued commitment to adhere to the Privacy Shield principles and EU/Swiss standard of care.”

  cisco.com, read 2026-11-02 · EU-U.S. entry on the list: Active

• Mailchimp Says it was invalidated, and the vendor still keeps to it

  “We will also continue to honor our obligations to protect EU, UK, and Swiss data in compliance with the Privacy Shield Principles.”

  mailchimp.com, read 2026-11-02 · EU-U.S. entry on the list: Active

• Postmark (ActiveCampaign) Says it was invalidated, and the vendor still keeps to it

  “We started our GDPR journey in 2017 when we also obtained our Privacy Shield certification. And although it's been invalidated, we’re still going to continue to honor the principles of the framework, as it will still provide privacy protection to all our users, globally.”

  postmarkapp.com, read 2026-11-02 · EU-U.S. entry on the list: Active

The pages of 11 more vendors name the Privacy Shield only as invalidated or replaced, most of them in transfer impact assessments written after Schrems II: Amazon Web Services, Amplitude, Cloudflare, Datadog, Elastic Cloud, Google Workspace, Microsoft, Notion, Slack, SurveyMonkey and Xero.

The label above each sentence is how we read it. Names it as in effect: a certification, membership or commitment, stated without saying the Shield was invalidated.Names it as another name for the Framework: "DPF / Privacy Shield", "previously called Privacy Shield". Says it was invalidated, and the vendor still keeps to it: the page says the Shield was struck down, and that the vendor keeps to its principles or stays certified. Only pages the registry reads were searched, so a vendor not named here may still name the Shield elsewhere. What a page says is not how the vendor transfers data: for that, see its entry on the list and its data processing agreement.

European vendors on the list

8 vendors headquartered outside the US are on the list, through a US company of their own: Atlassian (Atlassian, Inc.), Brevo (Brevo, Inc.), Canva (Canva US, Inc.), Contentsquare (Contentsquare), Jotform (Jotform Inc.), monday.com (monday.com Inc.), OVHcloud (OVHcloud), Wix (Wix.com Inc.). The certification covers transfers to that US company, not the vendor's processing elsewhere.

What the Data Privacy Framework is

The EU-U.S. Data Privacy Framework replaced the Privacy Shield, which the Court of Justice struck down in Schrems II (C-311/18, 16 July 2020). The European Commission's adequacy decision of 10 July 2023 found that the US ensures an adequate level of protection for personal data transferred to organisations on the Data Privacy Framework List. US organisations join by self-certifying to the Framework's principles with the Department of Commerce and must renew every year. The Swiss-U.S. Framework and the UK Extension are separate certifications on the same list.

If the adequacy decision were annulled, transfers to organisations on the list would need another mechanism. Which mechanisms each vendor's data processing agreement relies on is on the EU–US transfers page.

Questions

What is the Data Privacy Framework List?

The public list, kept by the U.S. Department of Commerce, of US organisations that have self-certified to the EU-U.S. Data Privacy Framework. The European Commission's adequacy decision of 10 July 2023 covers transfers to the organisations on it, and only those. Certification is renewed every year; an organisation that does not renew is shown as inactive.

Which SaaS vendors are on the Data Privacy Framework List?

Of the 160 vendors in this registry, 73 have an active EU-U.S. entry, 4 of them with re-certification under review. 6 have an inactive entry, and 6 vendors that contract through a US company have none. The table lists each, checked weekly against the official list.

Is the Privacy Shield list still valid?

No. The Court of Justice struck down the EU-U.S. Privacy Shield in Schrems II on 16 July 2020, and a Privacy Shield certification has not covered transfers from the EU since. The Data Privacy Framework List took its place with the adequacy decision of 10 July 2023. 67 of the listed vendors here carried a Privacy Shield certification over, which is why the list dates their entry before July 2023. The own pages of 4 vendors here still name the Privacy Shield as in effect or as another name for the Framework (Bitwarden, CrowdStrike, Jotform, Vanta); the sentence each page uses, and the day we read it, is in the section on vendor pages that still name the Privacy Shield.

Is the Data Privacy Framework still valid after the Latombe case?

As of 2026-11-09, EUR-Lex lists the adequacy decision as in force. The General Court dismissed the action to annul it (Latombe v Commission, T-553/23) on 3 September 2025; the appeal to the Court of Justice, C-703/25 P, lodged on 31 October 2025, is pending in the court's register. The PCLOB, which the decision relies on to review the redress mechanism every year, lists one current Board Member; its five seats are a Chair and four Members. Court records only; the dated record behind each statement is in the legal status section of this page.

Does a vendor's DPF certification cover HR data?

Only if its entry says so: organisations certify for HR data (about their own employees) and non-HR data separately. 38 of the listed vendors here cover HR data.

Download the data (CSV): every row with its source and the date it was read.Cite as: eucsoft, “SaaS vendors on the Data Privacy Framework List”, https://eucsoft.com/en/data-privacy-framework/, data read up to 2026-11-09.

How this was checked

Each week the registry searches the official list's public data for every vendor's brand, its parent and the legal entity it contracts through, and stores the list's own record of each match. A vendor is shown as listed only where the list's organisation is the vendor or a company the vendor's own terms name; "not on the list" means no search found one. Full method on the methodology page.