PostHog
Analytics · posthog.com · last read 2026-11-09
At a glance
- Is PostHog GDPR compliant?
- No tool is GDPR compliant on its own: compliance depends on what you process with it and how. What follows is what PostHog itself publishes, each answer linked to its source and the date we read it.
- Does PostHog have a data processing agreement (DPA)?
- Yes. PostHog publishes a data processing agreement at posthog.com. It gives 14 days' notice before a new subprocessor is added. It promises breach notification "without undue delay", with no number of hours. Source and date
- Does PostHog have a SOC 2 report?
- PostHog says a SOC 2 Type 2 report is available on request. In PostHog's words: “Our products are covered by our SOC 2 Type II report, independently audited and evaluated by a third-party to ensure our controls meet industry standards for security, confidentiality, privacy, and availability.” We read this on 2026-10-25. Source and date
- Where is PostHog's trust center?
- PostHog publishes a page it calls “Trust Portal” at trust.posthog.com. Some of its documents sit behind a request or sign-in: the page says “Get access”. The page mentions SOC 2, a penetration test, subprocessors and a DPA. We read it on 2026-11-03. Source and date
- How does PostHog transfer personal data out of the EU?
- PostHog's agreement relies on the EU standard contractual clauses, the EU-U.S. Data Privacy Framework and the UK transfer addendum. PostHog Inc is on the official Data Privacy Framework List (status: Active). Source and date
- Does PostHog offer EU data residency?
- The vendor documents an EU region but states nothing about which plan reaches it or what it costs. Source and date
- Who are PostHog's subprocessors?
- PostHog lists 4 third-party subprocessors; 2 of them name at least one processing country outside the EEA. We last read the list on 2026-10-25. The page we read covers only part of the list. Source and date
- How do you report a security vulnerability to PostHog?
- PostHog publishes a security.txt at posthog.com naming [email protected]. Source and date
The same questions for any vendor, and the rule behind each: the vendor due diligence checklist.
Identity
| Legal entity | PostHog Inc. |
|---|---|
| HQ | US |
| Parent company | — |
| Ultimate ownership | — |
| EU contracting entity | — |
| LEI | — |
| US CLOUD Act reach | Contracting entity incorporated in the US |
| Source | posthog.com · 2026-10-25 |
PostHog data residency
| Region | EU data location | Minimum plan | Source | Observed |
|---|---|---|---|---|
| EU | Terms not stated | — | posthog.com | 2026-10-25 |
EU: The document recommends PostHog Cloud EU, hosted on servers in Frankfurt, but names no plan or cost for it.
The same question for every vendor: where SaaS vendors store EU data.
PostHog's subprocessor list names AWS for hosting or infrastructure. Which SaaS vendors run on which cloud, and the sovereign offerings of each: sovereign clouds.
Subprocessor chain
4 third parties · 2 with a country outside the EEA · all read 2026-10-25 · partial: the page we read covers only part of the vendor's subprocessors
| Subprocessor | Country | If hosted in the EU | Purpose |
|---|---|---|---|
| Amazon Web Services, Inc. | US, DE | DE | Cloud storage of PostHog Cloud data |
| Cloudflare, Inc. | — | — | Managed reverse proxy, edge-network, content delivery, security, and traffic routing services of infrastructure |
| Modal Labs, Inc. | US, DE | DE | Serverless compute infrastructure for isolated code execution |
| Wiz, Inc. | DE, FR | — | Security vulnerability management and detection |
The count outside the EEA is arithmetic over the country column, not a judgement about lawfulness. A transfer outside the EEA can be perfectly lawful; whether this one is depends on your use, not on the vendor.
Every subprocessor in the registry, and which vendors name it: subprocessors.
Processing terms
From the vendor's data processing agreement · read 2026-10-25 · posthog.com
| Term | What the agreement says |
|---|---|
| Transfer mechanism | EU-U.S. DPF |
| Transfer mechanism | SCC module 2 |
| Transfer mechanism | Swiss FADP clauses |
| Transfer mechanism | UK Addendum |
| Transfer mechanism | other |
| Notice of new subprocessors | General written authorization under SCC clause 9 option 2; the period for notifying changes to the subprocessor list follows Clause 5.3 of the DPA |
| Notice of new subprocessors | at least 14 days in advance of updates to the Subprocessor list, with an opportunity to object |
| If you object to one | Object in writing within 7 days; Processor cancels or offers alternative, or takes corrective steps; if not addressed within 30 days, Company may terminate the affected Service |
| Obligations passed to subprocessors | written contract imposing on the Subprocessor obligations equivalent to those this Agreement imposes on Processor; Processor remains fully liable for Subprocessor performance |
| Breach notification | without undue delay |
| Deletion when the service ends | at the end of the Services, on Company's request, delete or procure deletion of all copies, unless law requires storage, retention is needed to resolve a dispute between the parties, or retention is necessary to combat harmful use of the Services |
| Getting your data back | at the end of the Services, on Company's request, securely return the data or provide self-service functionality for Company to retrieve it |
| Requests from data subjects | assists via appropriate technical and organizational measures; notifies Company of requests received directly and does not respond except on Company's documented instructions or as required by law |
| Audit | Company may, upon written notice, exercise its right to audit Processor as a step to stop and remediate unauthorized use of Personal Data |
| Audit | information to demonstrate compliance; audits including inspections by the Company, at the Company's cost |
| Processing on your instructions | only on Company's documented instructions, including for data transfers outside the Protected Area, unless required by law (with prior notice unless prohibited) |
| Confidentiality of staff | personnel with access subject to confidentiality undertakings or professional or statutory obligations of confidentiality |
| Security measures | appropriate technical and organizational measures, including those in Article 32(1) GDPR/UK GDPR and those at Annex II |
Terms as the agreement states them. Where it is silent on a term, there is no row; that is not a statement that the vendor does not offer it.
Which version applies
We found no version number or date in the agreement as we read it.
These terms side by side for every vendor: data processing agreements compared. What vendors give you for a transfer impact assessment: transfer impact assessments.
Assurance
Does PostHog have a SOC 2 report?
PostHog says a SOC 2 Type 2 report is available on request. We read this on 2026-10-25.
- Available on request “Our products are covered by our SOC 2 Type II report, independently audited and evaluated by a third-party to ensure our controls meet industry standards for security, confidentiality, privacy, and availability.”
Source: trust.posthog.com, 2026-10-25
Of the 114 vendors in this registry whose own pages mention SOC 2, 57 say the report is available on request, 1 links to the report itself, and 56 state it without saying how to get it. The type is the one the vendor names.
| Scheme | Status | Scope | Source | Observed |
|---|---|---|---|---|
| CCPA | Claimed | — | trust.posthog.com | 2026-10-25 |
| GDPR | Claimed | — | trust.posthog.com | 2026-10-25 |
| HIPAA | Claimed | — | trust.posthog.com | 2026-10-25 |
| SOC 2 · SOC2 | Available on request | — | trust.posthog.com | 2026-10-25 |
| SOC 2 Type II · SOC2T2 | Available on request | Our products; controls for security, confidentiality, privacy, and availability | trust.posthog.com | 2026-10-25 |
Claimed means the vendor asserts the scheme on its own page and offers nothing further. Available on request means the report or certificate exists but sits behind a request, a login or an NDA. Neither is a certificate we have seen. That is a distinction an auditor makes, so we make it too.
SecNumCloud, C5, ENS and HDS for every vendor, with the pages for ISO standards, SOC 2 and TISAX: certifications compared.
Official registers
| Register | Offering, as the register names it | Status | Level | Valid until | Observed |
|---|---|---|---|---|---|
| Data Privacy Framework List (US) | EU-U.S. Data Privacy Framework · PostHog Inc | Active | HR data, non-HR data | 2027-03-10 | 2026-10-25 |
| Data Privacy Framework List (US) | Swiss-U.S. Data Privacy Framework · PostHog Inc | Active | HR data, non-HR data | 2027-03-10 | 2026-10-25 |
| Data Privacy Framework List (US) | UK Extension to the EU-U.S. DPF · PostHog Inc | Active | HR data, non-HR data | 2027-03-10 | 2026-10-25 |
- ACN qualified cloud (Italy): checked 2026-11-09, no entry under PostHog; PostHog Inc.
- ISO 27001 on the basis of IT-Grundschutz (BSI, Germany): checked 2026-11-09, no entry under PostHog; PostHog Inc.
- CISPE Data Protection Code of Conduct (GDPR Art. 40): checked 2026-11-09, no entry under PostHog; PostHog Inc.
- DORA critical ICT third-party providers (ESAs): checked 2026-11-09, no entry under PostHog; PostHog Inc.
- Data Privacy Framework List (US): checked 2026-11-09, 3 entries under PostHog; PostHog Inc.
- ENS certificates of conformity (CCN, Spain): checked 2026-11-09, no entry under PostHog; PostHog Inc.
- EU Cloud Code of Conduct (GDPR Art. 40): checked 2026-11-09, no entry under PostHog; PostHog Inc.
- FedRAMP Marketplace (US): checked 2026-11-09, no entry under PostHog; PostHog Inc.
- GPAI Code of Practice signatories (European Commission): checked 2026-11-09, no entry under PostHog; PostHog Inc.
- SecNumCloud qualified services (ANSSI, France): checked 2026-11-09, no entry under PostHog; PostHog Inc.
What the authority publishes, not what the vendor claims. An entry covers the offering it names and nothing else: a FedRAMP authorisation for a government edition says nothing about the commercial service. No entry is not a finding about security - most vendors never apply - and an entry filed under a name not listed above would not have been found.
What an entry on the Data Privacy Framework List covers, and which vendors hold one: EU-US Data Privacy Framework.
Support window
Not yet collected. This row will say not declared only once we have read a lifecycle or security page and found no period stated — see support windows.
Vulnerability reporting: [email protected] (security.txt, expires 2027-08-30; read 2026-10-25)
How other vendors publish theirs: security.txt across the registry.
Documents
Where is PostHog's trust center?
PostHog publishes a page it calls “Trust Portal” at trust.posthog.com. Some of its documents sit behind a request or sign-in. The page mentions SOC 2, a penetration test, subprocessors and a DPA. We read it on 2026-11-03. Open trust.posthog.com
- Name “Welcome to the PostHog Trust Portal! Here, you can find our compliance documents, answers to common security and privacy questions, and details about our”
- Request step “Get access”
Source: trust.posthog.com, 2026-11-03. Read from the page's text, without a model; every vendor's trust center.
| Document | Disclosure | Transcription | HTTP | Observed |
|---|---|---|---|---|
| certifications | Public | full | 200 | 2026-10-25 |
| dpa | Public | full | 200 | 2026-10-25 |
| identity | Public | full | 200 | 2026-10-25 |
| residency | Public | full | 200 | 2026-10-25 |
| subprocessors | Public | partial | 200 | 2026-10-25 |
History
Nothing has moved since we started watching this vendor on 2026-10-25. Changes appear here only after a human has reviewed them.
Every reviewed change across the registry, newest first: vendor changes.