eucsoft

ClickUp

Work management · clickup.com · last read 2026-10-12

Identity

Legal entityMango Technologies, Inc. DBA ClickUp
HQUS
Parent company—
Ultimate ownership—
EU contracting entity—
LEI—
US CLOUD Act reachContracting entity incorporated in the US
Sourceclickup.com · 2026-10-08

Data location

RegionEU data locationMinimum planSourceObserved
EUEnterprise onlyEnterprise Planclickup.com2026-10-08

EU: Customers on the Enterprise Plan can choose to host their core Workspace data in ClickUp's European data centers at no additional cost. The document places this on the Enterprise Plan only.

Subprocessor chain

53 third parties · 53 with a country outside the EEA · all read 2026-10-08

SubprocessorCountryPurpose
Amazon Web ServicesUS, IE, DE, AU, SGInfrastructure (Cloud Service Provider)
AmplitudeUSAnalytics on product use
AnthropicUSApplication AI Functionality
APILayerUSIP Address Geolocation
ArtieUSData Replication
AssemblyAIUSApplication AI Functionality
AvalaraUSSales tax reporting
BasetenUSApplication AI Functionality
BraintreeUSCredit card payments
BraveUSApplication AI Functionality
BrowserbaseUSApplication AI Functionality
CannyUSProduct feedback
CensusUSData warehouse integration
ChameleonUSAnalytics on product use
DailyUSAudio/Video Streaming, Transcription and Recording services
DatadogUSLogging and Monitoring
EXAUSApplication and infrastructure monitoring
FlatfileUSData imports
Foundry Labs, IncUSApplication AI Functionality - Code Interpreter
Functional Software, Inc. - SentryUSMobile application monitoring
Google Firebase, Google Analytics, Google GeminiUSMobile app notifications, analytics, Application AI Functionality
IterableUSCustomer engagement
Kling 3.0CNGen AI
Maven AGIUSChatbot
Memori LabsUSApplication AI Functionality
Microsoft Azure AI FoundryUSApplication AI Functionality
NodedataUSEmail Deliverability Checking
NylasUSEmail, calendar, and contact integrations
OpenAIUSApplication AI Functionality
Oracle NetsuiteUSSubscription management
PDF.coUSDocument Processing and Conversion
ReadmeUSAPI docs and development
RecallUSTranscription Services
Relyance AIUSData Governance
Replit IncUSApplication hosting and compute infrastructure
SalesforceUSCustomer relationship management (CRM)
Seedance 2.0CNGen AI
SegmentUSData warehouse, customer data platform
SimilarwebUSBusiness Intelligence (BI) Analytics
Singular Lab, IncUSAnalytics on product use
Skilljar for ClickUp UniversityUSLearning management system
SlashNextUSApplication Security defense functionality
SnowflakeUSData warehouse
StripeUSCredit card payments
strongDMUSInfrastructure access platform
TableauUSData visualization
TwilioUSTwo-factor authentication codes
UpwindUSApplication and infrastructure monitoring
VercelUSApplication AI Functionality
VertexUSTax Calculation
Wistia, Inc.USVideo Content Delivery Network
Workato for ClickUp Professional ServicesUSEnterprise integration platform
ZendeskUSCustomer support communication (chat and email)

The count outside the EEA is arithmetic over the country column, not a judgement about lawfulness. A transfer outside the EEA can be perfectly lawful; whether this one is depends on your use, not on the vendor.

Processing terms

From the vendor's data processing agreement · read 2026-10-09 · clickup.com

TermWhat the agreement says
Transfer mechanismSCC module 2
Transfer mechanismSCC module 3
Transfer mechanismSwiss FADP clauses
Transfer mechanismUK Addendum
Notice of new subprocessorsAt least 30 days before the new subprocessor processes data, by email (customers register via portal at https://clickup.com/dpa/subprocessors)
If you object to oneCustomer may object by written notice within 10 business days of being informed; parties work in good faith toward a resolution; if none is reached within a reasonable timeframe, customer may terminate the Agreement by written notice as its sole and exclusive remedy
If you object to oneWritten objection within 10 business days; parties work in good faith on a resolution; if none within a reasonable time, customer may terminate the Agreement as sole and exclusive remedy
Breach notificationwithout undue delay
AuditAudits held during business hours under an agreed audit plan, at customer's expense; customer also pays ClickUp's time at its professional services rates
AuditCustomer may audit once per year (more often where required by law or its supervisory authority); detailed audit plan due at least two weeks in advance; qualifying third-party audit reports (SOC 2, ISO, etc.) from the last 12 months are accepted instead of an audit of the controls they cover; audit held during business hours

Terms as the agreement states them. Where it is silent on a term, there is no row; that is not a statement that the vendor does not offer it.

Assurance

SchemeStatusScopeSourceObserved
GDPRClaimed—clickup.com2026-10-08
HIPAAClaimed—clickup.com2026-10-08
ISO 27001 · ISO27001Claimed—clickup.com2026-10-08
ISO 27001:2022 · ISO27001Available on request—clickup.com2026-10-08
ISO 27017:2015 · ISO27017Available on request—clickup.com2026-10-08
ISO 27018:2019 · ISO27018Available on request—clickup.com2026-10-08
ISO 27701:2019 · ISO27701Available on request—clickup.com2026-10-08
ISO 42001 · ISO42001Claimedsecure, transparent, and ethical AI practices across all our solutionsclickup.com2026-10-08
PCI · PCIDSSClaimedstoring, processing and transmitting credit card information onlineclickup.com2026-10-08
SOC 1 Type 2 · SOC1Available on requestService Organization Controls (SOC) Trust Services Principles, focused on finance and securityclickup.com2026-10-08
SOC 2 · SOC2Claimed—clickup.com2026-10-08
SOC 2 Type 2 · SOC2T2Available on requestService Organization Controls (SOC) Trust Services Principles, focused on finance and securityclickup.com2026-10-08
SOC 3 · SOC3Available on requestService Organization Controls (SOC) Trust Services Principles, focused on finance and securityclickup.com2026-10-08

Claimed means the vendor asserts the scheme on its own page and offers nothing further. Available on request means the report or certificate exists but sits behind a request, a login or an NDA. Neither is a certificate we have seen. That is a distinction an auditor makes, so we make it too.

Official registers

RegisterOffering, as the register names itStatusLevelValid untilObserved
Data Privacy Framework List (US)EU-U.S. Data Privacy Framework · Mango Technologies, Inc. (DBA ClickUp)Inactive - Lapsenon-HR data2024-01-262026-10-09

What the authority publishes, not what the vendor claims. An entry covers the offering it names and nothing else: a FedRAMP authorisation for a government edition says nothing about the commercial service. No entry is not a finding about security - most vendors never apply - and an entry filed under a name not listed above would not have been found.

Support window

Not yet collected. This row will say not declared only once we have read a lifecycle or security page and found no period stated — see support windows.

Vulnerability reporting: [email protected], [email protected], help.clickup.com (security.txt, expires 2027-09-01; read 2026-10-11)

Documents

What we read, how it was disclosed, and when.
DocumentDisclosureTranscriptionHTTPObserved
certificationsPublicfull2002026-10-08
dpaPublicfull2002026-10-09
residencyPublicfull2002026-10-08
subprocessorsPublicfull2002026-10-08

History

Nothing has moved since we started watching this vendor on 2026-10-08. Changes appear here only after a human has reviewed them.