eucsoft

Airtable

work-management · airtable.com · last read 2026-10-05

Identity

No identity observation recorded yet.

Data location

No data-location observation recorded yet.

Subprocessor chain

24 third parties · 3 of the vendor's own group companies · 25 with a country outside the EEA · all read 2026-10-05

SubprocessorCountryIf hosted in the EUPurpose
Amazon Web Services, Inc——AI model provider
Amazon Web Services, IncUS, DE, IE, AUDE, IECloud infrastructure, transactional email
Anthropic, PBCUS—AI model provider
Bright Data Ltd.US—Internet search and browse functionality
Castle Global Inc.US—AI content moderation (Enterprise and Business plan customers only)
Forethought Technologies, Inc.US—Customer support services
Gong.io, Inc.US, DE—Video conferencing, call recording
Google LLC——AI model provider
International Business Machines Corporation (IBM)US—AI model provider
Mailgun Technologies, IncUS, DE, BEDE, BETransactional email
Mapbox, Inc.US—Map and location data generation
OpenAI, LLCUS—AI model provider
Parallel Web Systems Inc.US—AI-powered internet search and browsing
PartnerHero, Inc.US, DE, HN, RO, PH—Customer support services
Pylon Labs, Inc.US—Customer support services
Reducto, Inc.US—AI-powered data extraction
Salesforce.com, Inc.US—Customer support services
SendSafely Inc.US—Data security services
Sierra Technologies, Inc.US—Customer support services
Twilio, IncUS—Two-factor authentication
Vercel Inc.US—AI-powered web prototype generation
Workato Inc.US—Premium Support services
Zight, Inc. (formerly CloudPlus, Inc.)US—Customer support, professional services
Zoom Video Communications, Inc.US—Video conferencing, call recording
Airtable's own group companies listed as subprocessors (3)
CompanyCountryPurpose
Formagrid Australia Pty LtdAUAirtable subsidiary
Formagrid Canada Ltd.CAAirtable subsidiary
Formagrid UK Ltd.GBAirtable subsidiary

The count outside the EEA is arithmetic over the country column, not a judgement about lawfulness. A transfer outside the EEA can be perfectly lawful; whether this one is depends on your use, not on the vendor.

Assurance

SchemeStatusScopeSourceObserved
CAIQAvailable on request—airtable.com2026-10-05
CCPA/CPRA · CCPAClaimedAirtable’s privacy program is designed for complianceairtable.com2026-10-05
General Data Protection Regulation (GDPR) · GDPRClaimedAirtable’s privacy program is designed for complianceairtable.com2026-10-05
United Kingdom GDPR · GDPRClaimedAirtable’s privacy program is designed for complianceairtable.com2026-10-05
HECVATAvailable on request—airtable.com2026-10-05
HIPAAClaimed—airtable.com2026-10-05
ISO/IEC 27001:2022 · ISO27001Claimed—airtable.com2026-10-05
ISO/IEC 27701:2019 · ISO27701Claimed—airtable.com2026-10-05
SIG Lite · SIGAvailable on request—airtable.com2026-10-05
SOC 2 Type 2 · SOC2T2Available on request—airtable.com2026-10-05
TX-RAMP Level 2 · TXRAMPClaimedLevel 2airtable.com2026-10-05

Claimed means the vendor asserts the scheme on its own page and offers nothing further. Available on request means the report or certificate exists but sits behind a request, a login or an NDA. Neither is a certificate we have seen. That is a distinction an auditor makes, so we make it too.

Official registers

Not yet checked against official registers (ACN qualified cloud (Italy), FedRAMP Marketplace (US), Data Privacy Framework List (US)).

Support window

Not yet collected. This row will say not declared only once we have read a lifecycle or security page and found no period stated — see support windows.

Documents

What we read, how it was disclosed, and when.
DocumentDisclosureTranscriptionHTTPObserved
certificationsPublicfull2002026-10-05
subprocessorsPublicfull2002026-10-05

History

Nothing has moved since we started watching this vendor on 2026-10-05. Changes appear here only after a human has reviewed them.