Mailchimp
Email marketing · mailchimp.com · last read 2026-11-09
At a glance
- Is Mailchimp GDPR compliant?
- No tool is GDPR compliant on its own: compliance depends on what you process with it and how. What follows is what Mailchimp itself publishes, each answer linked to its source and the date we read it.
- Does Mailchimp have a data processing agreement (DPA)?
- Yes. Mailchimp publishes a data processing agreement at mailchimp.com. It gives 10 days' notice before a new subprocessor is added. It promises breach notification "without undue delay", with no number of hours. Source and date
- Which version of the Mailchimp DPA is current?
- On 2026-11-09, Mailchimp's DPA at mailchimp.com printed “Wirksam ab 26. September 2024”. Source and date
- Does Mailchimp have a SOC 2 report?
- Mailchimp says a SOC 2 report is available on request (no type given). In Mailchimp's words (in German): “Unsere SOC-2-Berichte umfassen Kontrollen in Bezug auf Sicherheit, Verfügbarkeit und Prozessintegrität von Kundendaten.” We read this on 2026-10-05. Source and date
- Is Mailchimp ISO 27001 certified?
- Mailchimp states ISO/IEC 27001 certification, and says the certificate or audit report is available on request. We read this on 2026-10-05. Source and date
- How does Mailchimp transfer personal data out of the EU?
- Mailchimp's agreement relies on the EU standard contractual clauses, the EU-U.S. Data Privacy Framework and the UK transfer addendum. Intuit (covered entity: The Rocket Science Group d/b/a Mailchimp) is on the official Data Privacy Framework List (status: Active). Source and date
- Where does Mailchimp store EU customer data?
- We found no statement of an EU data location on a page we could reach. Not the same as none existing. Source and date
- Who are Mailchimp's subprocessors?
- Mailchimp lists 25 third-party subprocessors; 23 of them name at least one processing country outside the EEA. We last read the list on 2026-10-05. Source and date
- How do you report a security vulnerability to Mailchimp?
- Mailchimp publishes a security.txt at mailchimp.com naming https://mailchimp.com/about/security/#Responsible_Disclosure. The file falls short of RFC 9116: no Expires field. Source and date
The same questions for any vendor, and the rule behind each: the vendor due diligence checklist.
Identity
| Legal entity | The Rocket Science Group LLC d/b/a Mailchimp |
|---|---|
| HQ | US |
| Parent company | Intuit Inc. |
| Ultimate ownership | — |
| EU contracting entity | Intuit Ireland Software Limited |
| LEI | — |
| US CLOUD Act reach | Contracting entity incorporated in the US |
| Source | mailchimp.com · 2026-10-08 |
Data location
| Region | EU data location | Minimum plan | Source | Observed |
|---|---|---|---|---|
| EU | Not stated | — | mailchimp.com | 2026-09-18 |
EU: No EU data location is stated. Subprocessor locations are given as US states and cities.
The same question for every vendor: where SaaS vendors store EU data.
Subprocessor chain
25 third parties · 23 with a country outside the EEA · all read 2026-10-05
| Subprocessor | Country | Purpose |
|---|---|---|
| Akamai | US | Improves application speed and security. |
| Amazon | US | Facilitates delivery and temporary storage. |
| Amplitude | US | To better understand how customers use our product. |
| CodeScience | US | Develops and maintains integrations. |
| E-Hawk | US | Detects and prevents abuse. |
| El Camino | US | Detects and prevents abuse. |
| Finc3 | DE | Develops and maintains integrations. |
| Fivetran | US | Data connection, centralization, and organization. |
| US | Bolsters internal operations and advertising, & website analytics. | |
| Infobip | GB | To provide our SMS program. |
| Looker | US | Business analytics software, centralization and organziation tool. |
| Microsoft | US | To provide our AI features through Intuit Assist. |
| OpenAI | US | To provide our AI features through Intuit Assist. |
| Percona | US | To improve our relational database management system. |
| R.R. Donnelley | US | Develops and implements certain Mailchimp multi-channel marketing products. |
| SC Wedis Company SRL | RO | Develops and maintains integrations. |
| Slack | US | Communication and collaboration tool. |
| SmartyStreets | US | Address verification for e-commerce offering. |
| TaskUs | US, GR | To provide some of our customer support. |
| TaxJar | US | Tax service provider for e-commerce offering. |
| Twilio | US | To provide our SMS program. |
| Two Bulls | US | Develops and maintains integrations. |
| Tyrannosaurus Tech | US | Develops and maintains integrations. |
| Vextras LLC | US | Develops and maintains integrations. |
| Zendesk | US | To provide online chat and email support to our customers. |
The count outside the EEA is arithmetic over the country column, not a judgement about lawfulness. A transfer outside the EEA can be perfectly lawful; whether this one is depends on your use, not on the vendor.
Every subprocessor in the registry, and which vendors name it: subprocessors.
Processing terms
From the vendor's data processing agreement · read 2026-10-09 · mailchimp.com
| Term | What the agreement says |
|---|---|
| Transfer mechanism | EU-U.S. DPF |
| Transfer mechanism | SCC module 2 |
| Transfer mechanism | SCC module 3 |
| Transfer mechanism | Swiss FADP clauses |
| Transfer mechanism | UK Addendum |
| Notice of new subprocessors | At least 10 days before adding or removing a subprocessor, by email to customers who subscribe via a link |
| If you object to one | Customer may object in writing within 5 calendar days of the notice, on reasonable data protection grounds. The parties then discuss in good faith. If no solution is reached, Mailchimp either does not appoint the subprocessor or lets the customer suspend or terminate the affected service without liability. |
| Obligations passed to subprocessors | Written agreement with each subprocessor including data protection obligations providing at least the same level of protection for Customer Data as this DPA; Mailchimp remains responsible for subprocessor compliance |
| Breach notification | without undue delay |
| Deletion when the service ends | On termination or expiry, Mailchimp provides tools so the customer can delete all customer data (including copies). This does not apply where law or industry rules require retention, or to data archived on backup systems; that data is isolated, protected from further processing and eventually deleted under Mailchimp's deletion policies. A deletion certificate is provided only on written request. |
| Getting your data back | On termination or expiry, Mailchimp provides tools so the customer can, at its choice, have all customer data (including copies) returned to it, subject to legal retention and backup exceptions. |
| Requests from data subjects | Self-service tools at no extra cost plus reasonable additional assistance. Mailchimp will not answer requests sent to it directly without the customer's prior authorisation, unless appropriate (e.g. to tell the person to contact the customer) or legally required. If it must respond, it notifies the customer promptly and sends a copy of the request. |
| Audit | Audit rights exercised via security reports: summary of most recent audit report on written request (confidential); additional security information on request, no more than once per calendar year |
| Audit | In addition to the report, additional information on the security program on written request; no more than once per calendar year |
| Processing on your instructions | Processes Customer Data only on Customer's documented lawful instructions, as described in Annex A, per this DPA, as required by applicable law, or as otherwise agreed in writing |
| Confidentiality of staff | Authorised processors (employees, agents, subcontractors) subject to an appropriate contractual or statutory duty of confidentiality |
| Security measures | Appropriate technical and organisational security measures per Mailchimp's security standards described in Annex B ("Security Measures") |
Terms as the agreement states them. Where it is silent on a term, there is no row; that is not a statement that the vendor does not offer it.
Which version applies
On 2026-11-09, the agreement printed: Wirksam ab 26. September 2024
at mailchimp.com
In effect from 2024-09-26
This version is in our copies from 2026-10-09.
These terms side by side for every vendor: data processing agreements compared. What vendors give you for a transfer impact assessment: transfer impact assessments.
Assurance
Does Mailchimp have a SOC 2 report?
Mailchimp says a SOC 2 report is available on request (no type given). We read this on 2026-10-05.
- Available on request “Unsere SOC-2-Berichte umfassen Kontrollen in Bezug auf Sicherheit, Verfügbarkeit und Prozessintegrität von Kundendaten.” (in German)
Source: mailchimp.com, 2026-10-05
Of the 114 vendors in this registry whose own pages mention SOC 2, 57 say the report is available on request, 1 links to the report itself, and 56 state it without saying how to get it. The type is the one the vendor names.
Is Mailchimp ISO 27001 certified?
Mailchimp states ISO/IEC 27001 certification, and says the certificate or audit report is available on request. We read this on 2026-10-05.
- Available on request “Norm 27001 der Internationalen Organisation für Normung (ISO 27001) ist eine Norm für die Informationssicherheit, die gewährleistet, dass Büros sowie Entwicklungs-, Support- und Rechenzentren sicher verwaltet werden.” (in German)
Source: mailchimp.com, 2026-10-05
Of the 122 vendors in this registry whose own pages state ISO/IEC 27001, 16 link to the certificate, 43 say it is available on request, and 63 state it without saying how to get it. A certificate names the certification body, the scope and the expiry date: those are the three things to check.
| Scheme | Status | Scope | Source | Observed |
|---|---|---|---|---|
| EU-US Data Privacy Framework (EU-US DPF) · DPF | Claimed | jährliche Überprüfung durch einen in den USA ansässigen externen Compliance-Prüfer; Intuit und Mailchimp stützen sich bei der Datenübermittlung auf die EU-US-DPF | mailchimp.com | 2026-10-05 |
| Swiss-US Data Privacy Framework (Swiss-US DPF) · DPF | Claimed | jährliche Überprüfung durch einen in den USA ansässigen externen Compliance-Prüfer; werden sich darauf stützen, sobald diese von den zuständigen Behörden genehmigt wurde | mailchimp.com | 2026-10-05 |
| UK Extension zum EU-US DPF · DPF | Claimed | jährliche Überprüfung durch einen in den USA ansässigen externen Compliance-Prüfer; werden sich darauf stützen, sobald diese von den zuständigen Behörden genehmigt wurde | mailchimp.com | 2026-10-05 |
| DSGVO · GDPR | Claimed | — | mailchimp.com | 2026-10-05 |
| ISO 27001 · ISO27001 | Available on request | Büros sowie Entwicklungs-, Support- und Rechenzentren; drei Jahre gültig (Verlängerungsaudit), jährlich überprüft (Überwachungsaudit) | mailchimp.com | 2026-10-05 |
| SOC-2 · SOC2 | Available on request | Kontrollen in Bezug auf Sicherheit, Verfügbarkeit und Prozessintegrität von Kundendaten | mailchimp.com | 2026-10-05 |
| Voluntary Product Accessibility Template (VPAT®) · VPAT | Available on request | die überarbeiteten 508 Standards für IT-Zugänglichkeit | mailchimp.com | 2026-10-05 |
Claimed means the vendor asserts the scheme on its own page and offers nothing further. Available on request means the report or certificate exists but sits behind a request, a login or an NDA. Neither is a certificate we have seen. That is a distinction an auditor makes, so we make it too.
SecNumCloud, C5, ENS and HDS for every vendor, with the pages for ISO standards, SOC 2 and TISAX: certifications compared.
Official registers
| Register | Offering, as the register names it | Status | Level | Valid until | Observed |
|---|---|---|---|---|---|
| Data Privacy Framework List (US) | EU-U.S. Data Privacy Framework · Intuit (covered entity: The Rocket Science Group d/b/a Mailchimp) | Active | HR data, non-HR data | 2026-12-11 | 2026-10-05 |
| Data Privacy Framework List (US) | Swiss-U.S. Data Privacy Framework · Intuit (covered entity: The Rocket Science Group d/b/a Mailchimp) | Active | HR data, non-HR data | 2026-12-11 | 2026-10-05 |
| Data Privacy Framework List (US) | UK Extension to the EU-U.S. DPF · Intuit (covered entity: The Rocket Science Group d/b/a Mailchimp) | Active | HR data, non-HR data | 2026-12-11 | 2026-10-05 |
| Global LEI Index (GLEIF) | INTUIT IRELAND SOFTWARE LIMITED · INTUIT IRELAND SOFTWARE LIMITED | ISSUED | IE | 2026-10-12 | 2026-10-08 |
- ACN qualified cloud (Italy): checked 2026-11-02, no entry under Intuit Ireland Software Limited; Mailchimp; The Rocket Science Group LLC d/b/a Mailchimp; The Rocket Science Group LLC dba Mailchimp
- ISO 27001 on the basis of IT-Grundschutz (BSI, Germany): checked 2026-11-09, no entry under Intuit Ireland Software Limited; Mailchimp; The Rocket Science Group LLC d/b/a Mailchimp; The Rocket Science Group LLC dba Mailchimp
- CISPE Data Protection Code of Conduct (GDPR Art. 40): checked 2026-11-09, no entry under Intuit Ireland Software Limited; Mailchimp; The Rocket Science Group LLC d/b/a Mailchimp; The Rocket Science Group LLC dba Mailchimp
- DORA critical ICT third-party providers (ESAs): checked 2026-10-26, no entry under Intuit Ireland Software Limited; Mailchimp; The Rocket Science Group LLC d/b/a Mailchimp; The Rocket Science Group LLC dba Mailchimp
- Data Privacy Framework List (US): checked 2026-11-02, 3 entries under Intuit Ireland Software Limited; Mailchimp; The Rocket Science Group LLC d/b/a Mailchimp; The Rocket Science Group LLC dba Mailchimp
- ENS certificates of conformity (CCN, Spain): checked 2026-11-02, no entry under Intuit Ireland Software Limited; Mailchimp; The Rocket Science Group LLC d/b/a Mailchimp; The Rocket Science Group LLC dba Mailchimp
- EU Cloud Code of Conduct (GDPR Art. 40): checked 2026-11-02, no entry under Intuit Ireland Software Limited; Mailchimp; The Rocket Science Group LLC d/b/a Mailchimp; The Rocket Science Group LLC dba Mailchimp
- FedRAMP Marketplace (US): checked 2026-11-02, no entry under Intuit Ireland Software Limited; Mailchimp; The Rocket Science Group LLC d/b/a Mailchimp; The Rocket Science Group LLC dba Mailchimp
- GPAI Code of Practice signatories (European Commission): checked 2026-11-09, no entry under Intuit Ireland Software Limited; Mailchimp; The Rocket Science Group LLC d/b/a Mailchimp; The Rocket Science Group LLC dba Mailchimp
- SecNumCloud qualified services (ANSSI, France): checked 2026-11-02, no entry under Intuit Ireland Software Limited; Mailchimp; The Rocket Science Group LLC d/b/a Mailchimp; The Rocket Science Group LLC dba Mailchimp
What the authority publishes, not what the vendor claims. An entry covers the offering it names and nothing else: a FedRAMP authorisation for a government edition says nothing about the commercial service. No entry is not a finding about security - most vendors never apply - and an entry filed under a name not listed above would not have been found.
What an entry on the Data Privacy Framework List covers, and which vendors hold one: EU-US Data Privacy Framework.
Support window
| Product | Support period | State | SBOM | Source | Observed |
|---|---|---|---|---|---|
| Mailchimp (SaaS) | — | Service only | unknown | mailchimp.com | 2026-09-18 |
Vulnerability reporting: mailchimp.com (security.txt, no Expires field; read 2026-10-17)
How other vendors publish theirs: security.txt across the registry.
Documents
| Document | Disclosure | Transcription | HTTP | Observed |
|---|---|---|---|---|
| dpa | Public | full | 200 | 2026-10-09 |
| dpa-de | Public | full | 200 | 2026-10-09 |
| subprocessors | Public | full | 200 | 2026-09-18 |
| tia | Public | full | 200 | 2026-10-20 |
History
Nothing has moved since we started watching this vendor on 2026-10-09. Changes appear here only after a human has reviewed them.
Every reviewed change across the registry, newest first: vendor changes.