Amplitude
Analytics · amplitude.com · last read 2026-10-12
Identity
| Legal entity | Amplitude, Inc. |
|---|---|
| HQ | US |
| Parent company | — |
| Ultimate ownership | US |
| EU contracting entity | — |
| LEI | 984500EZ87C703978858 |
| US CLOUD Act reach | Contracting entity incorporated in the US |
| Source | amplitude.com · 2026-10-08 |
Legal entity from the vendor's own terms. LEI, registered country and parent company from the Global LEI Index (GLEIF); ownership is left empty where GLEIF names no parent. The CLOUD Act row is arithmetic over those countries, not an assessment of risk.
Data location
| Region | EU data location | Minimum plan | Source | Observed |
|---|---|---|---|---|
| EU | Terms not stated | — | amplitude.com | 2026-10-08 |
Subprocessor chain
11 third parties · 8 of the vendor's own group companies · 10 with a country outside the EEA · all read 2026-10-08
| Subprocessor | Country | If hosted in the EU | Purpose |
|---|---|---|---|
| Amazon Web Services | DE | DE | Cloud hosting and infrastructure provider; generative AI technology used to enhance Amplitude's AI features (AWS Bedrock) |
| Datadog, Inc. | US | — | Logging and operational monitoring |
| Fivetran Inc. | DE | DE | Cloud-based data movement platform |
| Google, LLC | EU | EU | Generative AI technology, delivered via Google Vertex AI, used to enhance Amplitude’s AI features |
| Google, LLC | US | — | Generative AI technology, delivered via Google Vertex AI, used to enhance Amplitude’s AI features; Cloud hosting and infrastructure provider for the Statsig-branded Amplitude Services (US only) |
| Microsoft Azure | US | — | Cloud service Provider for the Statsig-branded Amplitude Services |
| MongoDB, Inc. | US | — | Database provider for the Statsig-branded Amplitude Services |
| OpenAI, LLC | EU | EU | Generative AI technology used to enhance Amplitude and Statsig’s AI features |
| Snowflake Computing, Inc. | US | — | Data warehousing services (if Customer has purchased an applicable add-on service or is using AI Feedback) |
| Snowflake Computing, Inc. | DE | DE | Data warehousing services (if Customer has purchased an applicable add-on service or is using AI Feedback); EU for AI Feedback only |
| Wiz, Inc. | DE | DE | Security vulnerability management and detection |
Amplitude's own group companies listed as subprocessors (8)
| Company | Country | Purpose |
|---|---|---|
| Amplitude Analytics Australia Pty Ltd. | AU | Remote access for backup support, security and debugging |
| Amplitude Analytics G.K. | JP | Remote access for backup support, security and debugging |
| Amplitude Analytics GmbH | DE | Remote access for backup support, security and debugging |
| Amplitude Analytics Ltd. | GB | Remote access for backup support, security and debugging |
| Amplitude Analytics Pte. Ltd. | SG | Remote access for backup support, security and debugging |
| Amplitude Analytics SAS | FR | Remote access for backup support, security and debugging |
| Amplitude Analytics, B.V. | NL | Remote access for backup support, security and debugging |
| Amplitude Canada Limited | CA | Remote access for backup support, security and debugging |
The count outside the EEA is arithmetic over the country column, not a judgement about lawfulness. A transfer outside the EEA can be perfectly lawful; whether this one is depends on your use, not on the vendor.
Processing terms
From the vendor's data processing agreement · read 2026-10-09 · amplitude.com
| Term | What the agreement says |
|---|---|
| Transfer mechanism | EU-U.S. DPF |
| Transfer mechanism | SCC module 2 |
| Transfer mechanism | Swiss FADP clauses |
| Transfer mechanism | UK Addendum |
| Notice of new subprocessors | At least 10 business days in advance, by updating the subprocessor list (Schedule B) |
| Notice of new subprocessors | Schedule B (Subprocessor List) updated at least 10 business days before the new subprocessor gets access to Personal Data; email notification available by subscribing via [email protected] |
| If you object to one | Customer may object in writing within 10 business days of notice; its sole remedy is to stop using the Amplitude Services |
| Breach notification | notify impacted customers in accordance with the terms of the TOS DPA (no timeframe stated in this part) |
| Breach notification | without undue delay |
| Audit | Annual third-party audit against industry standards; customer audit (incl. on-site inspection) on written request at customer's expense, only if required by a supervisory authority, under confidentiality, with mutually agreed scope |
| Audit | Audit rights under the DPA do not extend to Subprocessors' facilities |
Terms as the agreement states them. Where it is silent on a term, there is no row; that is not a statement that the vendor does not offer it.
Assurance
| Scheme | Status | Scope | Source | Observed |
|---|---|---|---|---|
| Data Privacy Framework · DPF | Claimed | — | amplitude.com | 2026-10-08 |
| EU-US Data Privacy Framework (DPF) · DPF | Claimed | self-certified; transfer of personal data from the United Kingdom, EU, and EEA to our US-West-based AWS environment | amplitude.com | 2026-10-08 |
| UK Extension to the EU-US DPF · DPF | Claimed | self-certified; transfer of personal data from the United Kingdom, EU, and EEA to our US-West-based AWS environment | amplitude.com | 2026-10-08 |
| GDPR | Claimed | platform | amplitude.com | 2026-10-08 |
Claimed means the vendor asserts the scheme on its own page and offers nothing further. Available on request means the report or certificate exists but sits behind a request, a login or an NDA. Neither is a certificate we have seen. That is a distinction an auditor makes, so we make it too.
Official registers
| Register | Offering, as the register names it | Status | Level | Valid until | Observed |
|---|---|---|---|---|---|
| Data Privacy Framework List (US) | EU-U.S. Data Privacy Framework · Amplitude | Active | non-HR data | 2027-09-09 | 2026-10-09 |
| Data Privacy Framework List (US) | Swiss-U.S. Data Privacy Framework · Amplitude | Active | non-HR data | 2027-09-09 | 2026-10-09 |
| Data Privacy Framework List (US) | UK Extension to the EU-U.S. DPF · Amplitude | Active | non-HR data | 2027-09-09 | 2026-10-09 |
| Global LEI Index (GLEIF) | Amplitude, Inc. · Amplitude, Inc. | ISSUED | US-DE | 2027-03-27 | 2026-10-09 |
- ACN qualified cloud (Italy): checked 2026-10-12, no entry under Amplitude; Amplitude, Inc.
- DORA critical ICT third-party providers (ESAs): checked 2026-10-12, no entry under Amplitude; Amplitude, Inc.
- Data Privacy Framework List (US): checked 2026-10-12, 3 entries under Amplitude; Amplitude, Inc.
- EU Cloud Code of Conduct (GDPR Art. 40): checked 2026-10-12, no entry under Amplitude; Amplitude, Inc.
- FedRAMP Marketplace (US): checked 2026-10-12, no entry under Amplitude; Amplitude, Inc.
- SecNumCloud qualified services (ANSSI, France): checked 2026-10-12, no entry under Amplitude; Amplitude, Inc.
What the authority publishes, not what the vendor claims. An entry covers the offering it names and nothing else: a FedRAMP authorisation for a government edition says nothing about the commercial service. No entry is not a finding about security - most vendors never apply - and an entry filed under a name not listed above would not have been found.
Support window
| Product | Support period | State | SBOM | Source | Observed |
|---|---|---|---|---|---|
| Amplitude (service) | — | Service only | unknown | amplitude.com | 2026-10-11 |
Vulnerability reporting: tracker.bugcrowd.com, [email protected] (security.txt, expires 2028-12-31; read 2026-10-11)
Documents
| Document | Disclosure | Transcription | HTTP | Observed |
|---|---|---|---|---|
| certifications | Public | full | 200 | 2026-10-08 |
| dpa | Public | full | 200 | 2026-10-09 |
| residency | Public | full | 200 | 2026-10-08 |
| subprocessors | Public | full | 200 | 2026-10-08 |
History
Nothing has moved since we started watching this vendor on 2026-10-08. Changes appear here only after a human has reviewed them.