Mixpanel
Analytics · mixpanel.com · last read 2026-10-12
Identity
| Legal entity | MIXPANEL, INC. |
|---|---|
| HQ | US |
| Parent company | — |
| Ultimate ownership | — |
| EU contracting entity | — |
| LEI | 254900X7T87GPJF6A540 |
| US CLOUD Act reach | Contracting entity incorporated in the US |
| Source | mixpanel.com · 2026-10-08 |
Legal entity from the vendor's own terms. LEI, registered country and parent company from the Global LEI Index (GLEIF); ownership is left empty where GLEIF names no parent. The CLOUD Act row is arithmetic over those countries, not an assessment of risk.
Data location
| Region | EU data location | Minimum plan | Source | Observed |
|---|---|---|---|---|
| EU | Terms not stated | — | docs.mixpanel.com | 2026-10-08 |
Subprocessor chain
13 third parties · 1 of the vendor's own group companies · 13 with a country outside the EEA · all read 2026-10-08
| Subprocessor | Country | Purpose |
|---|---|---|
| Amazon Web Services, Inc. | US | Supplemental storage and backup storage for Mixpanel's Analytics platform, and disaster recovery storage |
| Anthropic, Inc. | US | Generalized artificial intelligence services |
| Atlassian Pty, Ltd. | US | Products for bug tracking and remediation |
| Braintrust Data, Inc. | US | Monitoring and analyzing AI interactions and system behavior supporting AI features |
| Google, Inc. | US | Google Cloud Platform infrastructure and storage of Customer Content, Personal Information; hosts Mixpanel's Analytics platform |
| Google, Inc. | US | Google Vertex AI generalized artificial intelligence services |
| HubSpot, Inc. | US | Customer relationship management services |
| OpenAI L.L.C. | US | Generalized artificial intelligence services supporting AI features |
| Pylon Labs, Inc. | US | Customer account administration and support |
| Snowflake Inc. | — | Storage where customers elect to use Mixpanel's warehouse connectors or ETL tools |
| Statisfy, Inc. | US | Customer success management software |
| Turbopuffer, Inc. | US, EU, IN | Serverless vector database used with artificial intelligence features |
| Zendesk, Inc. | US | Customer account administration and support |
Mixpanel's own group companies listed as subprocessors (1)
| Company | Country | Purpose |
|---|---|---|
| Mixpanel International, Inc. | GB, ES, SG, IN, IL | Provides access to Mixpanel's services and additional processing activities to customers around the world |
The count outside the EEA is arithmetic over the country column, not a judgement about lawfulness. A transfer outside the EEA can be perfectly lawful; whether this one is depends on your use, not on the vendor.
Processing terms
From the vendor's data processing agreement · read 2026-10-09 · mixpanel.com
| Term | What the agreement says |
|---|---|
| Transfer mechanism | EU-U.S. DPF |
| Transfer mechanism | SCC module 1 |
| Transfer mechanism | SCC module 2 |
| Transfer mechanism | SCC module 3 |
| Transfer mechanism | Swiss FADP clauses |
| Transfer mechanism | UK Addendum |
| Notice of new subprocessors | At least 30 days before a new subprocessor starts processing, by updating the online list; customers get updates by filling in a form |
| If you object to one | With reasonable grounds, the customer may object in writing by emailing [email protected] within 30 calendar days of the update or the notice, whichever is later. If it doesn't object in time, it is deemed to consent. |
| Breach notification | without undue delay |
| Audit | Mixpanel complies with reasonable Customer requests for audits and inspections under the Colorado Privacy Act, as set out in Section 3.5.2 (Privacy Impact Assessments); terms are cross-referenced, not stated in this part |
| Audit | Once per calendar year, on written request: third-party certifications and audit reports, plus written answers to audit questionnaires. An audit by a jointly selected third-party auditor, at the customer's cost, is allowed only if those documents are insufficient or the law requires it. Limited to once per calendar year, with no access to IT systems or subprocessor facilities. |
Terms as the agreement states them. Where it is silent on a term, there is no row; that is not a statement that the vendor does not offer it.
Assurance
| Scheme | Status | Scope | Source | Observed |
|---|---|---|---|---|
| GDPR | Claimed | — | mixpanel.com | 2026-10-08 |
| ISO 27001 · ISO27001 | Available on request | — | mixpanel.com | 2026-10-08 |
| ISO 27701 · ISO27701 | Available on request | — | mixpanel.com | 2026-10-08 |
| DPDP | Claimed | — | mixpanel.com | 2026-10-08 |
| SOC 2 type II · SOC2T2 | Available on request | — | mixpanel.com | 2026-10-08 |
Claimed means the vendor asserts the scheme on its own page and offers nothing further. Available on request means the report or certificate exists but sits behind a request, a login or an NDA. Neither is a certificate we have seen. That is a distinction an auditor makes, so we make it too.
Official registers
| Register | Offering, as the register names it | Status | Level | Valid until | Observed |
|---|---|---|---|---|---|
| Data Privacy Framework List (US) | EU-U.S. Data Privacy Framework · Mixpanel, Inc. | Active | HR data, non-HR data | 2027-08-10 | 2026-10-09 |
| Data Privacy Framework List (US) | Swiss-U.S. Data Privacy Framework · Mixpanel, Inc. | Active | HR data, non-HR data | 2027-08-10 | 2026-10-09 |
| Data Privacy Framework List (US) | UK Extension to the EU-U.S. DPF · Mixpanel, Inc. | Active | HR data, non-HR data | 2027-08-10 | 2026-10-09 |
| Global LEI Index (GLEIF) | MIXPANEL, INC. · MIXPANEL, INC. | ISSUED | US-DE | 2026-12-15 | 2026-10-09 |
- ACN qualified cloud (Italy): checked 2026-10-12, no entry under MIXPANEL, INC.; Mixpanel
- DORA critical ICT third-party providers (ESAs): checked 2026-10-12, no entry under MIXPANEL, INC.; Mixpanel
- Data Privacy Framework List (US): checked 2026-10-12, 3 entries under MIXPANEL, INC.; Mixpanel
- EU Cloud Code of Conduct (GDPR Art. 40): checked 2026-10-12, no entry under MIXPANEL, INC.; Mixpanel
- FedRAMP Marketplace (US): checked 2026-10-12, no entry under MIXPANEL, INC.; Mixpanel
- SecNumCloud qualified services (ANSSI, France): checked 2026-10-12, no entry under MIXPANEL, INC.; Mixpanel
What the authority publishes, not what the vendor claims. An entry covers the offering it names and nothing else: a FedRAMP authorisation for a government edition says nothing about the commercial service. No entry is not a finding about security - most vendors never apply - and an entry filed under a name not listed above would not have been found.
Support window
| Product | Support period | State | SBOM | Source | Observed |
|---|---|---|---|---|---|
| Mixpanel (service) | — | Service only | unknown | mixpanel.com | 2026-10-11 |
Vulnerability reporting: hackerone.com, [email protected], [email protected] (security.txt, expires 2027-05-18; read 2026-10-11)
Documents
| Document | Disclosure | Transcription | HTTP | Observed |
|---|---|---|---|---|
| certifications | Public | full | 200 | 2026-10-08 |
| dpa | Public | full | 200 | 2026-10-09 |
| residency | Public | full | 200 | 2026-10-08 |
| subprocessors | Public | full | 200 | 2026-10-08 |
History
Nothing has moved since we started watching this vendor on 2026-10-08. Changes appear here only after a human has reviewed them.