Backblaze
Cloud infrastructure · backblaze.com · last read 2026-11-09
At a glance
- Is Backblaze GDPR compliant?
- No tool is GDPR compliant on its own: compliance depends on what you process with it and how. What follows is what Backblaze itself publishes, each answer linked to its source and the date we read it.
- Does Backblaze have a SOC 2 report?
- Backblaze states SOC 2 Type 2 on its own page, but does not say there how to get a report. In Backblaze's words: “Backblaze has achieved Service Organization Control (SOC) 2 Type 2 compliance by an independent third-party firm.” We read this on 2026-11-09. Source and date
- Who are Backblaze's subprocessors?
- Backblaze lists 31 third-party subprocessors; 30 of them name at least one processing country outside the EEA. We last read the list on 2026-11-09. Source and date
The same questions for any vendor, and the rule behind each: the vendor due diligence checklist.
Identity
| Legal entity | Backblaze, Inc. |
|---|---|
| HQ | US |
| Parent company | — |
| Ultimate ownership | — |
| EU contracting entity | — |
| LEI | 254900LYV2KUQQR4N606 |
| US CLOUD Act reach | Contracting entity incorporated in the US |
| Source | backblaze.com · 2026-11-09 |
Legal entity from the vendor's own terms. LEI, registered country and parent company from the Global LEI Index (GLEIF); ownership is left empty where GLEIF names no parent. The CLOUD Act row is arithmetic over those countries, not an assessment of risk.
Data location
No data-location observation recorded yet.
The same question for every vendor: where SaaS vendors store EU data.
Backblaze's subprocessor list names AWS for hosting or infrastructure. Which SaaS vendors run on which cloud, and the sovereign offerings of each: sovereign clouds.
Subprocessor chain
31 third parties · 30 with a country outside the EEA · all read 2026-11-09
| Subprocessor | Country | Purpose |
|---|---|---|
| 2NDSITE Inc. (dba FreshBooks) | CA | Accounting and manual purchase orders |
| 365 Data Centers Services, LLC (acquired Sungard Availability Services LP) | US | Data center storing Customer Files for US-West region accounts and Customer Account Data for all regions |
| Amazon Web Services, Inc. | US | Internal data storage and backup/archive |
| Anthropic, PBC | US | AI Modeling via Claude Enterprise |
| Chili Piper, Inc. | US | Scheduling |
| Cloudflare, Inc. | US | Content distribution, web application security and DNS services |
| Cologix Canada, Inc. | CA | Data center storing Customer Files for CA-East region accounts |
| CoreSite, LLC | US | Data center storing Customer Files for US-East region accounts and Customer Account Data for all regions |
| CyrusOne, LP | US | Data center storing Customer Files for US-West region accounts and Customer Account Data for all regions |
| Datastax, Inc. | US | Consulting services on Cassandra database |
| Docusign, Inc. | US | Electronic agreement execution |
| Freshworks, Inc. | US | Help desk service platform for customer support |
| Gong Inc. | US | Collect customer insights |
| Google LLC (Google Tag Manager and Google Analytics) | US | Services used to collect analytics |
| HubSpot, Inc. | US | Sending marketing email messages to customers |
| Interxion Netherlands B.V. (acquired by Digital Realty) | NL | Data center storing Customer Files and Customer Account Data for EU-Central region accounts |
| Nautilus Data Technologies, Inc. | US | Data center storing Customer Files for US-West region accounts and Customer Account Data for all regions |
| Oracle America, Inc. NetSuite | US | Accounting and electronic invoicing |
| Outreach Corporation | US | Sending email messages |
| Pendo.io, Inc. | US | Analyzing user experience |
| Plivo, Inc. | US | SMS provider for non-EU customer verification |
| Productboard, Inc. | US | Collect customer feedback |
| Rookout, Inc. | US | Service used to debug the Backblaze production system |
| Salesforce, Inc. | US | Customer relationship management |
| Snowflake, Inc. | US | Cloud data warehouse platform for centralized data storage, transformation, business intelligence, and analytics reporting |
| Stripe, Inc. | US | Processing online payments |
| Tableau Software LLC. (acquired by Salesforce, Inc.) | US | Analyze data |
| Twilio SendGrid | US | Send email messages |
| Twilio, Inc. | US | SMS provider for EU customer verification |
| Zendesk, Inc. | US | Manage customer communications |
| ZoomInfo Technologies LLC | US | Maintain a database of business/professional contacts |
The count outside the EEA is arithmetic over the country column, not a judgement about lawfulness. A transfer outside the EEA can be perfectly lawful; whether this one is depends on your use, not on the vendor.
Every subprocessor in the registry, and which vendors name it: subprocessors.
Processing terms
No data processing agreement read yet.
These terms side by side for every vendor: data processing agreements compared. What vendors give you for a transfer impact assessment: transfer impact assessments.
Assurance
Does Backblaze have a SOC 2 report?
Backblaze states SOC 2 Type 2 on its own page, but does not say there how to get a report. We read this on 2026-11-09.
- Claimed “Backblaze has achieved Service Organization Control (SOC) 2 Type 2 compliance by an independent third-party firm.”
Source: backblaze.com, 2026-11-09
Of the 114 vendors in this registry whose own pages mention SOC 2, 57 say the report is available on request, 1 links to the report itself, and 56 state it without saying how to get it. The type is the one the vendor names.
| Scheme | Status | Scope | Source | Observed |
|---|---|---|---|---|
| California Consumer Privacy Act/California Privacy Rights Act (CCPA/CPRA) · CCPA | Claimed | consumer requests, data inventory, and a privacy notice | backblaze.com | 2026-11-09 |
| General Data Protection Regulation (GDPR) · GDPR | Claimed | DPAs for EEA/EU and UK residents are available | backblaze.com | 2026-11-09 |
| GovRAMP Progressing Snapshot · GovRAMP | Claimed | listed as a Progressing Product in the GovRAMP Authorized Product List | backblaze.com | 2026-11-09 |
| Higher Education Community Vendor Assessment Tool (HECVAT) · HECVAT | Available on request | lite and full version 3.06 assessments | backblaze.com | 2026-11-09 |
| HIPAA | Claimed | Business Associate Agreement (BAA) upon request for business customers who are Covered Entities | backblaze.com | 2026-11-09 |
| Internet2 Cloud Scorecard | Claimed | for research and educational institutions | backblaze.com | 2026-11-09 |
| Trusted Partner Network (TPN) Blue Shield | Claimed | aligned with the Motion Picture Association (MPA) Content Security Best Practices (CSBP) framework | backblaze.com | 2026-11-09 |
| PCI-DSS · PCIDSS | Claimed | card information stored and processed by Stripe, combined with internal security controls | backblaze.com | 2026-11-09 |
| SOC 2 Type 2 · SOC2T2 | Claimed | — | backblaze.com | 2026-11-09 |
| TX-RAMP Provisional · TXRAMP | Claimed | listed in the TX-RAMP Certified Cloud Products list | backblaze.com | 2026-11-09 |
| Voluntary Product Accessibility Template (VPAT) · VPAT | Available on request | Section 508 accessibility guidelines | backblaze.com | 2026-11-09 |
Claimed means the vendor asserts the scheme on its own page and offers nothing further. Available on request means the report or certificate exists but sits behind a request, a login or an NDA. Neither is a certificate we have seen. That is a distinction an auditor makes, so we make it too.
SecNumCloud, C5, ENS and HDS for every vendor, with the pages for ISO standards, SOC 2 and TISAX: certifications compared.
Official registers
| Register | Offering, as the register names it | Status | Level | Valid until | Observed |
|---|---|---|---|---|---|
| Global LEI Index (GLEIF) | BACKBLAZE, INC. · BACKBLAZE, INC. | ISSUED | US-DE | 2027-08-18 | 2026-11-09 |
- ACN qualified cloud (Italy): checked 2026-11-09, no entry under Backblaze; Backblaze, Inc.
- DORA critical ICT third-party providers (ESAs): checked 2026-11-09, no entry under Backblaze; Backblaze, Inc.
- ENS certificates of conformity (CCN, Spain): checked 2026-11-09, no entry under Backblaze; Backblaze, Inc.
- EU Cloud Code of Conduct (GDPR Art. 40): checked 2026-11-09, no entry under Backblaze; Backblaze, Inc.
- FedRAMP Marketplace (US): checked 2026-11-09, no entry under Backblaze; Backblaze, Inc.
- SecNumCloud qualified services (ANSSI, France): checked 2026-11-09, no entry under Backblaze; Backblaze, Inc.
What the authority publishes, not what the vendor claims. An entry covers the offering it names and nothing else: a FedRAMP authorisation for a government edition says nothing about the commercial service. No entry is not a finding about security - most vendors never apply - and an entry filed under a name not listed above would not have been found.
Support window
Not yet collected. This row will say not declared only once we have read a lifecycle or security page and found no period stated — see support windows.
Vulnerability reporting: no security.txt at the well-known path (read 2026-11-09)
How other vendors publish theirs: security.txt across the registry.
Documents
| Document | Disclosure | Transcription | HTTP | Observed |
|---|---|---|---|---|
| certifications | Public | full | 200 | 2026-11-09 |
| subprocessors | Public | full | 200 | 2026-11-09 |
History
Nothing has moved since we started watching this vendor on 2026-11-09. Changes appear here only after a human has reviewed them.
Every reviewed change across the registry, newest first: vendor changes.