Doodle
Scheduling · doodle.com · last read 2026-11-09
At a glance
- Is Doodle GDPR compliant?
- No tool is GDPR compliant on its own: compliance depends on what you process with it and how. What follows is what Doodle itself publishes, each answer linked to its source and the date we read it.
- Does Doodle have a data processing agreement (DPA)?
- Yes. Doodle publishes a data processing agreement at doodle.com. It describes how a new subprocessor is announced but states no notice period. Source and date
- Does Doodle have a SOC 2 report?
- Doodle states SOC 2 Type 2 on its own page, but does not say there how to get a report. In Doodle's words: “Doodle has successfully completed its SOC 2 Type II examination and the MSP Verify Program.” We read this on 2026-11-09. Source and date
- How does Doodle transfer personal data out of the EU?
- Doodle's agreement relies on the EU standard contractual clauses and the UK transfer addendum. Source and date
- Does Doodle offer EU data residency?
- The EU is the default region for this vendor. Source and date
- Who are Doodle's subprocessors?
- Doodle lists 13 third-party subprocessors; 7 of them name at least one processing country outside the EEA. We last read the list on 2026-11-09. Source and date
The same questions for any vendor, and the rule behind each: the vendor due diligence checklist.
Identity
| Legal entity | Doodle AG |
|---|---|
| HQ | CH |
| Parent company | — |
| Ultimate ownership | — |
| EU contracting entity | — |
| LEI | — |
| US CLOUD Act reach | Not determined from the sources read |
| Source | doodle.com · 2026-11-09 |
Doodle data residency
| Region | EU data location | Minimum plan | Source | Observed |
|---|---|---|---|---|
| EU | EU by default | — | doodle.com | 2026-11-09 |
EU: The document says Doodle stores production data in Ireland and pre-production data in Germany. It names no plan, opt-in or cost, so this applies to all customers.
The same question for every vendor: where SaaS vendors store EU data.
Doodle's subprocessor list names AWS for hosting or infrastructure. Which SaaS vendors run on which cloud, and the sovereign offerings of each: sovereign clouds.
Subprocessor chain
13 third parties · 7 with a country outside the EEA · all read 2026-11-09
| Subprocessor | Country | Purpose |
|---|---|---|
| Amazon Web Services, Inc | DE, IE | Cloud Hosting Provider |
| Chargebee | US | Payment Processing |
| Clay (Clay Labs Inc) | US | Sales Intelligence & Prospecting |
| Google Analytics | US | Analytics |
| Growthbook | DE, IE, US | Feature Flagging and A/B Testing |
| HubSpot (HubSpot Germany GmbH) | DE | CRM and Marketing Automation |
| Intercom | IE | Customer Support Conversations and Help Center |
| Iterable (Iterable Ireland Limited) | IE | Lifecycle and Marketing Email Platform |
| Mailgun | US | Email Delivery |
| Microsoft | DE, IE | Behaviour Analytics |
| MongoDB Atlas | DE, IE | Cloud Database |
| Sentry (Functional Software, Inc.) | US | Error Monitoring and Performance Tracking |
| Zapier | US | Customer Support |
The count outside the EEA is arithmetic over the country column, not a judgement about lawfulness. A transfer outside the EEA can be perfectly lawful; whether this one is depends on your use, not on the vendor.
Every subprocessor in the registry, and which vendors name it: subprocessors.
Processing terms
From the vendor's data processing agreement · read 2026-11-09 · doodle.com
| Term | What the agreement says |
|---|---|
| Transfer mechanism | SCC module 4 |
| Transfer mechanism | UK Addendum |
| Notice of new subprocessors | Updates to sub-processor list made available online and notice given to Customer; no advance period stated |
| If you object to one | Object in writing for good cause within 2 weeks of notification; parties negotiate in good faith; if no solution within 2 months, either party may terminate the affected Individual Order |
| Breach notification | promptly upon becoming aware |
| Audit | Most recent third-party audit/certification reports (e.g. SOC 2) within 30 days of written request, no more than once a year; customer may request more information, agreed in good faith; on-site inspections where data protection law requires them |
Terms as the agreement states them. Where it is silent on a term, there is no row; that is not a statement that the vendor does not offer it.
Which version applies
We found no version number or date in the agreement as we read it.
These terms side by side for every vendor: data processing agreements compared. What vendors give you for a transfer impact assessment: transfer impact assessments.
Assurance
Does Doodle have a SOC 2 report?
Doodle states SOC 2 Type 2 on its own page, but does not say there how to get a report. We read this on 2026-11-09.
- Claimed “Doodle has successfully completed its SOC 2 Type II examination and the MSP Verify Program.”
Source: doodle.com, 2026-11-09
Of the 114 vendors in this registry whose own pages mention SOC 2, 57 say the report is available on request, 1 links to the report itself, and 56 state it without saying how to get it. The type is the one the vendor names.
| Scheme | Status | Scope | Source | Observed |
|---|---|---|---|---|
| CCPA | Claimed | California residents' control over their personal data, including the right to access, delete, or opt out of the sale of their information | doodle.com | 2026-11-09 |
| GDPR | Claimed | — | doodle.com | 2026-11-09 |
| Cyber Verify Level 3 | Claimed | Critical areas of our cloud service operations, including data privacy, network security, availability and uptime, disaster recovery plans, scalability and compliance | doodle.com | 2026-11-09 |
| MSP Verify Program | Claimed | — | doodle.com | 2026-11-09 |
| SOC 2 Type II · SOC2T2 | Claimed | controls relevant to the AICPA's Trust Services Criteria for security, availability, processing integrity, confidentiality, and privacy | doodle.com | 2026-11-09 |
Claimed means the vendor asserts the scheme on its own page and offers nothing further. Available on request means the report or certificate exists but sits behind a request, a login or an NDA. Neither is a certificate we have seen. That is a distinction an auditor makes, so we make it too.
SecNumCloud, C5, ENS and HDS for every vendor, with the pages for ISO standards, SOC 2 and TISAX: certifications compared.
Official registers
- ACN qualified cloud (Italy): checked 2026-11-09, no entry under Doodle; Doodle AG
- DORA critical ICT third-party providers (ESAs): checked 2026-11-09, no entry under Doodle; Doodle AG
- ENS certificates of conformity (CCN, Spain): checked 2026-11-09, no entry under Doodle; Doodle AG
- EU Cloud Code of Conduct (GDPR Art. 40): checked 2026-11-09, no entry under Doodle; Doodle AG
- FedRAMP Marketplace (US): checked 2026-11-09, no entry under Doodle; Doodle AG
- SecNumCloud qualified services (ANSSI, France): checked 2026-11-09, no entry under Doodle; Doodle AG
What the authority publishes, not what the vendor claims. An entry covers the offering it names and nothing else: a FedRAMP authorisation for a government edition says nothing about the commercial service. No entry is not a finding about security - most vendors never apply - and an entry filed under a name not listed above would not have been found.
Support window
Not yet collected. This row will say not declared only once we have read a lifecycle or security page and found no period stated — see support windows.
Vulnerability reporting: no security.txt at the well-known path (read 2026-11-09)
How other vendors publish theirs: security.txt across the registry.
Documents
| Document | Disclosure | Transcription | HTTP | Observed |
|---|---|---|---|---|
| certifications | Public | full | 200 | 2026-11-09 |
| dpa | Public | full | 200 | 2026-11-09 |
| residency | Public | full | 200 | 2026-11-09 |
| subprocessors | Public | full | 200 | 2026-11-09 |
History
Nothing has moved since we started watching this vendor on 2026-11-09. Changes appear here only after a human has reviewed them.
Every reviewed change across the registry, newest first: vendor changes.