Discord
Messaging · discord.com · last read 2026-11-09
At a glance
- Is Discord GDPR compliant?
- No tool is GDPR compliant on its own: compliance depends on what you process with it and how. What follows is what Discord itself publishes, each answer linked to its source and the date we read it.
- Where does Discord store EU customer data?
- We found no statement of an EU data location on a page we could reach. Not the same as none existing. Source and date
- How do you report a security vulnerability to Discord?
- Discord publishes a security.txt at discord.com naming https://discord.com/security or [email protected] or [email protected]. Source and date
The same questions for any vendor, and the rule behind each: the vendor due diligence checklist.
Identity
| Legal entity | Discord Inc. |
|---|---|
| HQ | US |
| Parent company | — |
| Ultimate ownership | — |
| EU contracting entity | Discord Netherlands BV |
| LEI | — |
| US CLOUD Act reach | Contracting entity incorporated in the US |
| Source | discord.com · 2026-11-09 |
Data location
| Region | EU data location | Minimum plan | Source | Observed |
|---|---|---|---|---|
| EU | Not stated | — | discord.com | 2026-11-09 |
The same question for every vendor: where SaaS vendors store EU data.
Subprocessor chain
Processing terms
No data processing agreement read yet.
These terms side by side for every vendor: data processing agreements compared. What vendors give you for a transfer impact assessment: transfer impact assessments.
Assurance
No certification claims transcribed yet.
SecNumCloud, C5, ENS and HDS for every vendor, with the pages for ISO standards, SOC 2 and TISAX: certifications compared.
Official registers
- ACN qualified cloud (Italy): checked 2026-11-09, no entry under Discord; Discord Inc.; Discord Netherlands BV
- DORA critical ICT third-party providers (ESAs): checked 2026-11-09, no entry under Discord; Discord Inc.; Discord Netherlands BV
- ENS certificates of conformity (CCN, Spain): checked 2026-11-09, no entry under Discord; Discord Inc.; Discord Netherlands BV
- EU Cloud Code of Conduct (GDPR Art. 40): checked 2026-11-09, no entry under Discord; Discord Inc.; Discord Netherlands BV
- FedRAMP Marketplace (US): checked 2026-11-09, no entry under Discord; Discord Inc.; Discord Netherlands BV
- SecNumCloud qualified services (ANSSI, France): checked 2026-11-09, no entry under Discord; Discord Inc.; Discord Netherlands BV
What the authority publishes, not what the vendor claims. An entry covers the offering it names and nothing else: a FedRAMP authorisation for a government edition says nothing about the commercial service. No entry is not a finding about security - most vendors never apply - and an entry filed under a name not listed above would not have been found.
Support window
Not yet collected. This row will say not declared only once we have read a lifecycle or security page and found no period stated — see support windows.
Vulnerability reporting: discord.com, [email protected], [email protected] (security.txt, expires 2029-08-12; read 2026-11-09)
How other vendors publish theirs: security.txt across the registry.
Documents
| Document | Disclosure | Transcription | HTTP | Observed |
|---|---|---|---|---|
| residency | Public | full | 200 | 2026-11-09 |
History
Nothing has moved since we started watching this vendor on 2026-11-09. Changes appear here only after a human has reviewed them.
Every reviewed change across the registry, newest first: vendor changes.