Klaviyo
Email marketing · klaviyo.com · last read 2026-10-12
Identity
| Legal entity | Klaviyo, Inc. |
|---|---|
| HQ | — |
| Parent company | — |
| Ultimate ownership | — |
| EU contracting entity | — |
| LEI | — |
| US CLOUD Act reach | Not determined from the sources read |
| Source | klaviyo.com · 2026-10-08 |
Data location
| Region | EU data location | Minimum plan | Source | Observed |
|---|---|---|---|---|
| EU | Terms not stated | — | klaviyo.com | 2026-10-08 |
EU: The DPA says that where the Customer has stipulated EU data residency as part of the Services, Klaviyo will store Customer Personal Data within the European Union. It names no plan or price for this, and says Klaviyo and certain Sub-processors may still process data outside the EU.
Subprocessor chain
26 third parties · 7 of the vendor's own group companies · 33 with a country outside the EEA · all read 2026-10-08
| Subprocessor | Country | Purpose |
|---|---|---|
| Ada Support, Inc. | US | Customer Service Automation |
| Amazon Web Services, Inc. | US | Cloud Hosting Provider |
| Anthropic, PBC | AU, EU, US | AI Features and Functionality; Customer Success and Support Services |
| Chronosphere, Inc. | US | Data Analysis |
| ClickHouse, Inc | US, DE | Database and Analytics Service (Real-Time Storage, Querying, and Reporting) |
| Cloudflare, Inc. | EU, US | Web Application Firewall |
| Concentrix Solutions Corporation | CR, PH, PL, US | Customer Support |
| Dropbox, Inc. | US, IN | File Hosting for Professional Services and Enablement |
| Fivetran, Inc. | US | Automated Data Movement |
| Functional Software, Inc. (d/b/a Sentry.io) | US | Error Logging |
| Glean Technologies, Inc. | US | Customer Success and Support Services |
| Infobip, Inc. | BA, BR, CO, HR, IN, ID, MY, MX, PH, TH, GB, US | Communications Services |
| Linear Orbit, Inc. | US | Project Management and Issue Tracking |
| Loom, Inc. (Atlassian) | US | Call Recording Customer Support (Customer Optional) |
| Mailgun Technologies, Inc. (d/b/a Sinch Email) | US | Email Review and Analysis |
| Meta, Inc. | DK, IE, US, SG, SE | WhatsApp Messaging |
| Microsoft Corporation | US | Windows Virtual Desktops Cloud Infrastructure for Customer Support |
| OpenAI, LLC | US | AI Features and functionality; Customer Success and Support Services |
| Sendgrid, Inc. | US | Email Delivery |
| SendSafely, Inc. | US | File Sharing Encryption Platform (Customer Optional) |
| Slack Technologies, LLC | US, AU, BR, CA, FR, DE, IN, JP, SG, KR, SE, CH, AE, GB, IE, ZA | Slack Connect for Customer Success and Support Services; Customer-Facing Notification Integration |
| Snowflake, Inc. | US | Data Analysis |
| Splunk, Inc. | US | Logging Tool |
| Statsig, Inc. | US | Product Feature Management |
| Twilio, Inc. | US | Communications Services |
| Zendesk, Inc. | AR, AU, BR, CA, JP, MX, PH, SG, GB, US | Customer Success and Support Services |
Klaviyo's own group companies listed as subprocessors (7)
| Company | Country | Purpose |
|---|---|---|
| Klaviyo Australia Pty Ltd | AU, US | Services and Support |
| Klaviyo Canada Inc. | CA | Services and Support |
| Klaviyo France SAS | FR, US | Services and Support |
| Klaviyo Germany GmbH | DE, US | Services and Support |
| Klaviyo Ireland Limited | IE, US | Services and Support |
| Klaviyo Ltd. | GB, US | Services and Support |
| Klaviyo Singapore Pte. Ltd. | SG, US | Services and Support |
The count outside the EEA is arithmetic over the country column, not a judgement about lawfulness. A transfer outside the EEA can be perfectly lawful; whether this one is depends on your use, not on the vendor.
Processing terms
From the vendor's data processing agreement · read 2026-10-09 · klaviyo.com
| Term | What the agreement says |
|---|---|
| Transfer mechanism | EU-U.S. DPF |
| Transfer mechanism | SCC module 2 |
| Transfer mechanism | SCC module 3 |
| Transfer mechanism | Swiss FADP clauses |
| Transfer mechanism | UK Addendum |
| Notice of new subprocessors | At least 15 days' notice of proposed additions or replacements, by email to the designated address associated with Customer's account |
| Notice of new subprocessors | General written authorization (SCC clause 9(a) Option 2); notice period set in clause 5.3 of the DPA (not stated in this part) |
| If you object to one | Written objection within 10 days of notice; parties work in good faith to resolve; if no resolution within a reasonable timeframe, either party may terminate the Agreement as sole and exclusive remedy; Klaviyo may suspend the affected Services during the Objection period |
| Breach notification | without undue delay |
| Transfer impact assessment | For onward transfers to sub-processors outside the UK, Klaviyo completes a transfer risk assessment (DUAA 'data protection test') where required |
| Transfer impact assessment | Klaviyo verifies the information it provided for the TIA questionnaire regularly and notifies Customer of any changes without delay |
| Transfer impact assessment | On request, vendor provides information reasonably necessary for customer to complete a TIA (or UK TRA); vendor may charge for TIA assistance |
| Transfer impact assessment | UK: Klaviyo completes a transfer risk assessment (DUAA data protection test) for onward transfers to sub-processors outside the UK where required |
| Transfer impact assessment | UK: the party initiating an Article 46 safeguarded transfer completes and maintains a transfer risk assessment; existing adequate TRAs satisfy the DUAA data protection test |
| Audit | Customer or an independent third-party auditor acceptable to Klaviyo (not a competitor) may audit up to once per year; additional audit after a Security Incident or where required by law or a regulator |
| Audit | Customer or an independent third-party auditor reasonably acceptable to Klaviyo may audit up to once per year, plus after a Security Incident or where required by law or a regulator; at least two weeks' notice with an audit plan; current ISO 27001 or SOC 2 Type 2 reports accepted in lieu; reasonable cooperation at no charge, but disproportionate audits may be charged |
| Audit | Linked account's audit rights under DPA clause 7 extend to Cross-Account Processing involving its data, but not to other accounts' data it does not control; Klaviyo may satisfy overlapping audit requests with a single audit |
Terms as the agreement states them. Where it is silent on a term, there is no row; that is not a statement that the vendor does not offer it.
Assurance
| Scheme | Status | Scope | Source | Observed |
|---|---|---|---|---|
| ISO 27001 · ISO27001 | Available on request | — | klaviyo.com | 2026-10-08 |
| SOC 2 · SOC2 | Available on request | — | klaviyo.com | 2026-10-08 |
Claimed means the vendor asserts the scheme on its own page and offers nothing further. Available on request means the report or certificate exists but sits behind a request, a login or an NDA. Neither is a certificate we have seen. That is a distinction an auditor makes, so we make it too.
Official registers
| Register | Offering, as the register names it | Status | Level | Valid until | Observed |
|---|---|---|---|---|---|
| Data Privacy Framework List (US) | EU-U.S. Data Privacy Framework · Klaviyo | Active - Re-certification under Review | HR data, non-HR data | 2027-02-02 | 2026-10-09 |
| Data Privacy Framework List (US) | Swiss-U.S. Data Privacy Framework · Klaviyo | Active - Re-certification under Review | non-HR data | 2027-02-02 | 2026-10-09 |
| Data Privacy Framework List (US) | UK Extension to the EU-U.S. DPF · Klaviyo | Active - Re-certification under Review | HR data, non-HR data | 2027-02-02 | 2026-10-09 |
- ACN qualified cloud (Italy): checked 2026-10-12, no entry under Klaviyo; Klaviyo, Inc.
- DORA critical ICT third-party providers (ESAs): checked 2026-10-12, no entry under Klaviyo; Klaviyo, Inc.
- Data Privacy Framework List (US): checked 2026-10-12, 3 entries under Klaviyo; Klaviyo, Inc.
- EU Cloud Code of Conduct (GDPR Art. 40): checked 2026-10-12, no entry under Klaviyo; Klaviyo, Inc.
- FedRAMP Marketplace (US): checked 2026-10-12, no entry under Klaviyo; Klaviyo, Inc.
- SecNumCloud qualified services (ANSSI, France): checked 2026-10-12, no entry under Klaviyo; Klaviyo, Inc.
What the authority publishes, not what the vendor claims. An entry covers the offering it names and nothing else: a FedRAMP authorisation for a government edition says nothing about the commercial service. No entry is not a finding about security - most vendors never apply - and an entry filed under a name not listed above would not have been found.
Support window
Not yet collected. This row will say not declared only once we have read a lifecycle or security page and found no period stated — see support windows.
Vulnerability reporting: no security.txt at the well-known path (read 2026-10-11)
Documents
| Document | Disclosure | Transcription | HTTP | Observed |
|---|---|---|---|---|
| certifications | Public | full | 200 | 2026-10-08 |
| dpa | Public | full | 200 | 2026-10-09 |
| residency | Public | full | 200 | 2026-10-08 |
| subprocessors | Public | full | 200 | 2026-10-08 |
History
Nothing has moved since we started watching this vendor on 2026-10-08. Changes appear here only after a human has reviewed them.