DigitalOcean
Cloud infrastructure · digitalocean.com · last read 2026-10-12
Identity
| Legal entity | DigitalOcean, LLC |
|---|---|
| HQ | US |
| Parent company | DIGITALOCEAN HOLDINGS, INC. |
| Ultimate ownership | US |
| EU contracting entity | — |
| LEI | 549300EDRXGWOG3MUL20 |
| US CLOUD Act reach | Contracting entity incorporated in the US |
| Source | digitalocean.com · 2026-10-08 |
Legal entity from the vendor's own terms. LEI, registered country and parent company from the Global LEI Index (GLEIF); ownership is left empty where GLEIF names no parent. The CLOUD Act row is arithmetic over those countries, not an assessment of risk.
Data location
| Region | EU data location | Minimum plan | Source | Observed |
|---|---|---|---|---|
| EU | Terms not stated | — | docs.digitalocean.com | 2026-10-08 |
EU: The document lists EU datacenters, including AMS3 (Amsterdam, the Netherlands) and FRA1 (Frankfurt, Germany), plus a Paperspace AMS1 datacenter. It does not name a plan or a cost for using them.
Subprocessor chain
33 third parties · 1 of the vendor's own group companies · 30 with a country outside the EEA · all read 2026-10-08
| Subprocessor | Country | Purpose |
|---|---|---|
| Aiven | FI | DBaaS related services |
| Amazon Web Services | US | Server back-ups and other infrastructure services |
| BlogVault | IN | Website Migration, Activity logs |
| Brainstormforce Astra | IN | WordPress related services (Theme builder) |
| Cloudflare | US | AppPlatform, Load Balancing, Content Delivery Network (CDN) Services |
| Cloudflare | US | Platform Security Services |
| Cloudflare | US | Security services |
| Data Center Services | — | Infrastructure |
| DNS Made Easy | US | Security services |
| Elastic Email | PL | Email services |
| Elegant Themes | US | WordPress related services (Theme builder) |
| Exa Labs, Inc. (Public Preview) | US | Web based search |
| Google (GCP) | US | DBaaS related services |
| Google Cloud (GCP) | US | Infrastructure |
| Immunify360 | US | Security services |
| Linode | US | Infrastructure |
| LLM Models (refer to DigitalOcean Cloud Console for optional LLM service add-ons available) | — | AI services |
| Mail Chimp | US | Email services |
| MongoDB | US | DBaaS related services |
| Oracle | US | Storage services |
| PayPal | US | Payment processing |
| Percona | US | DBaaS related services |
| Rackspace, Inc | US | Email services |
| Sendgrid | US | Email services |
| Stripe | US | Payment processing |
| Telesign | US | Security services |
| Traversal | US | Customer troubleshooting and support |
| Traversal | US | SRE Incident Features |
| Twilio | US | Security services |
| VAST | US | Storage services |
| Vultr | US | Infrastructure |
| Wasabi | US | Storage services (Cold Storage) |
| WPRemote | US | WordPress related services (QA services) |
DigitalOcean's own group companies listed as subprocessors (1)
| Company | Country | Purpose |
|---|---|---|
| DigitalOcean Droplets, Volumes, Spaces | US | Infrastructure; storage and offsite backup |
The count outside the EEA is arithmetic over the country column, not a judgement about lawfulness. A transfer outside the EEA can be perfectly lawful; whether this one is depends on your use, not on the vendor.
Processing terms
From the vendor's data processing agreement · read 2026-10-09 · digitalocean.com
| Term | What the agreement says |
|---|---|
| Transfer mechanism | EU-U.S. DPF |
| Transfer mechanism | SCC module 1 |
| Transfer mechanism | SCC module 2 |
| Transfer mechanism | SCC module 3 |
| Transfer mechanism | UK Addendum |
| Transfer mechanism | other |
| Notice of new subprocessors | 30 days (SCC Clause 9 Option 2, general written authorisation) |
| Notice of new subprocessors | Notice of new or replacement subprocessors by email or other contact methods; at least 30 days from notice to object |
| If you object to one | On a reasonable objection, DigitalOcean stops using the subprocessor and the parties negotiate in good faith; if not resolved within 15 days (extendable in writing), customer may terminate the Agreement and related agreements. DigitalOcean decides whether an objection is reasonable |
| Breach notification | without undue delay |
| Audit | Documentation and third-party audit reports first; if the customer shows these are insufficient, an audit under SCC Clause 8.9 at the customer's cost, by a mutually agreed third-party auditor, under an agreed audit plan, with results kept confidential |
| Audit | On written request: external ISMS certifications, audit report summaries and other documentation, plus answers to security/audit questionnaires, all confidential; no more than once per year; no on-site audit stated |
Terms as the agreement states them. Where it is silent on a term, there is no row; that is not a statement that the vendor does not offer it.
Assurance
| Scheme | Status | Scope | Source | Observed |
|---|---|---|---|---|
| Global Privacy Recognition for Processors (Global PRP) · APECPRP | Claimed | data processing operations | digitalocean.com | 2026-10-08 |
| Cloud Security Alliance (CSA) STAR Level 1 · CSA | Claimed | addresses fundamental security principles across 16 domains | digitalocean.com | 2026-10-08 |
| PCI-DSS SAQ-A · PCIDSS | Available on request | Zero-Footprint data policy; commits to not storing, processing, or transmitting cardholder data within our administrative environment | digitalocean.com | 2026-10-08 |
| SOC 2 Type II · SOC2T2 | Available on request | issued by our independent auditor, Schellman & Company | digitalocean.com | 2026-10-08 |
| SOC 3 Type II · SOC3 | Claimed | issued by our independent auditor, Schellman & Company | digitalocean.com | 2026-10-08 |
Claimed means the vendor asserts the scheme on its own page and offers nothing further. Available on request means the report or certificate exists but sits behind a request, a login or an NDA. Neither is a certificate we have seen. That is a distinction an auditor makes, so we make it too.
Official registers
| Register | Offering, as the register names it | Status | Level | Valid until | Observed |
|---|---|---|---|---|---|
| Data Privacy Framework List (US) | EU-U.S. Data Privacy Framework · DigitalOcean | Active | non-HR data | 2027-03-03 | 2026-10-09 |
| Data Privacy Framework List (US) | Swiss-U.S. Data Privacy Framework · DigitalOcean | Active | non-HR data | 2027-03-03 | 2026-10-09 |
| Data Privacy Framework List (US) | UK Extension to the EU-U.S. DPF · DigitalOcean | Active | non-HR data | 2027-03-03 | 2026-10-09 |
| Global LEI Index (GLEIF) | DigitalOcean, LLC · DigitalOcean, LLC | ISSUED | US-DE | 2027-07-01 | 2026-10-09 |
- ACN qualified cloud (Italy): checked 2026-10-12, no entry under DigitalOcean; DigitalOcean, LLC
- DORA critical ICT third-party providers (ESAs): checked 2026-10-12, no entry under DigitalOcean; DigitalOcean, LLC
- Data Privacy Framework List (US): checked 2026-10-12, 3 entries under DigitalOcean; DigitalOcean, LLC
- EU Cloud Code of Conduct (GDPR Art. 40): checked 2026-10-12, no entry under DigitalOcean; DigitalOcean, LLC
- FedRAMP Marketplace (US): checked 2026-10-12, no entry under DigitalOcean; DigitalOcean, LLC
- SecNumCloud qualified services (ANSSI, France): checked 2026-10-12, no entry under DigitalOcean; DigitalOcean, LLC
What the authority publishes, not what the vendor claims. An entry covers the offering it names and nothing else: a FedRAMP authorisation for a government edition says nothing about the commercial service. No entry is not a finding about security - most vendors never apply - and an entry filed under a name not listed above would not have been found.
Support window
Not yet collected. This row will say not declared only once we have read a lifecycle or security page and found no period stated — see support windows.
Vulnerability reporting: app.intigriti.com, [email protected] (security.txt, expires 2028-04-05; read 2026-10-11)
Documents
| Document | Disclosure | Transcription | HTTP | Observed |
|---|---|---|---|---|
| certifications | Public | full | 200 | 2026-10-08 |
| dpa | Public | full | 200 | 2026-10-09 |
| residency | Public | full | 200 | 2026-10-08 |
| subprocessors | Public | full | 200 | 2026-10-08 |
History
Nothing has moved since we started watching this vendor on 2026-10-08. Changes appear here only after a human has reviewed them.