eucsoft

Sentry

Error tracking · sentry.io · last read 2026-11-09

At a glance

Is Sentry GDPR compliant?
No tool is GDPR compliant on its own: compliance depends on what you process with it and how. What follows is what Sentry itself publishes, each answer linked to its source and the date we read it.
Does Sentry have a data processing agreement (DPA)?
Yes. Sentry publishes a data processing agreement at sentry.io. It gives 30 days' notice before a new subprocessor is added. It promises breach notification "without undue delay", with no number of hours. Source and date
Which version of the Sentry DPA is current?
On 2026-11-02, Sentry's DPA at sentry.io printed “Version 5.1.0 (Latest version) 5.1.0 (Latest version - May 29, 2024)”. Source and date
Does Sentry have a SOC 2 report?
Sentry says SOC 2 Type 1 and Type 2 reports are available on request. In Sentry's words: “Sentry’s SOC 2 report and ISO 27001 certificate are available to customers via their Sentry account or upon request.” We read this on 2026-10-04. Source and date
Is Sentry ISO 27001 certified?
Sentry states ISO/IEC 27001 certification, and says the certificate or audit report is available on request. In Sentry's words: “If you already use Sentry, you can access the report and certificate via your Sentry account. Otherwise, contact us for a copy of any report(s) you’re interested in reading (it’ll be less infuriating than your social feed.).” We read this on 2026-10-04. Source and date
How does Sentry transfer personal data out of the EU?
Sentry's agreement relies on the EU standard contractual clauses, the EU-U.S. Data Privacy Framework and the UK transfer addendum. Sentry.io is on the official Data Privacy Framework List (status: Active). Source and date
Does Sentry offer EU data residency?
The vendor documents an EU region but states nothing about which plan reaches it or what it costs. Source and date
Who are Sentry's subprocessors?
Sentry lists 8 third-party subprocessors; 7 of them name at least one processing country outside the EEA. We last read the list on 2026-10-05. Source and date
How do you report a security vulnerability to Sentry?
Sentry publishes a security.txt at sentry.io naming [email protected]. The file falls short of RFC 9116: no Expires field. Source and date

The same questions for any vendor, and the rule behind each: the vendor due diligence checklist.

Identity

Legal entityFunctional Software, Inc. d/b/a Sentry
HQUS
Parent company—
Ultimate ownership—
EU contracting entity—
LEI254900HAQRSOM0F0QT50
US CLOUD Act reachContracting entity incorporated in the US
Sourcesentry.io · 2026-10-08

Legal entity from the vendor's own terms. LEI, registered country and parent company from the Global LEI Index (GLEIF); ownership is left empty where GLEIF names no parent. The CLOUD Act row is arithmetic over those countries, not an assessment of risk.

Sentry data residency

RegionEU data locationMinimum planSourceObserved
EUTerms not stated—docs.sentry.io2026-09-18

EU: Reviewed 2026-09-18: recorded as terms-unstated because the page states no price or plan. Chosen from a dropdown when creating the organization; EU storage is Frankfurt, Germany. Page states: 'once selected, your data storage location can't be changed. The only way to switch it is by creating a new organization.'

The same question for every vendor: where SaaS vendors store EU data.

Sentry's subprocessor list names AWS and Google for hosting or infrastructure. Which SaaS vendors run on which cloud, and the sovereign offerings of each: sovereign clouds.

Subprocessor chain

8 third parties · 3 of the vendor's own group companies · 7 with a country outside the EEA · all read 2026-10-05

SubprocessorCountryPurpose
Amazon Web Services, Inc.EU, USCloud infrastructure services
Anthropic, PBCUSAI/ML services
Cloudflare, Inc.EU, USCloud infrastructure services
Google LLC (Google Cloud Platform)EU, USCloud infrastructure services
Intercom, Inc.USCustomer support and messaging services
OpenAI, L.L.C.USAI/ML services
Sinch Email (Mailgun)EUEmail delivery services
Twilio Inc. (SendGrid)USEmail delivery services
Sentry's own group companies listed as subprocessors (3)
CompanyCountryPurpose
Functional Software GmbH—Provides parts of the Service and related technical support
Sentry Software Canada Inc.—Provides parts of the Service and related technical support
Sentry Software Netherlands B.V.—Provides parts of the Service and related technical support

The count outside the EEA is arithmetic over the country column, not a judgement about lawfulness. A transfer outside the EEA can be perfectly lawful; whether this one is depends on your use, not on the vendor.

Every subprocessor in the registry, and which vendors name it: subprocessors.

Processing terms

From the vendor's data processing agreement · read 2026-10-09 · sentry.io

TermWhat the agreement says
Transfer mechanismEU-U.S. DPF
Transfer mechanismSCC module 2
Transfer mechanismSCC module 3
Transfer mechanismSwiss FADP clauses
Transfer mechanismUK Addendum
Notice of new subprocessors30 days' prior written notice, via email or other means specified on the Subprocessor Page
Notice of new subprocessorsPrior notice of subprocessor changes as set out in Section 7.2 (List of Subprocessors) of the DPA (SCC Clause 9 option 2)
If you object to oneMay object on reasonable grounds before appointment; if not remedied or worked around within a reasonable time, customer may terminate the Agreement as sole remedy
Obligations passed to subprocessorscontract with each Subprocessor imposing data protection terms requiring protection of Personal Data to an equivalent standard to this DPA; Sentry remains responsible for Subprocessor compliance
Breach notificationpromptly and without undue delay
Deletion when the service endsDestroys Personal Data when the Term expires, except where law requires retention, in which case the data is isolated, protected from further processing and deleted per Sentry's deletion practices
Getting your data backCustomer must export any Personal Data it wants to keep before the Term expires
Requests from data subjectsReasonable and timely assistance, at Customer's expense, where Customer cannot access the data in the Service; requests made directly to Sentry are promptly passed on to Customer with as much detail as reasonably possible
AuditAudit by internationally-recognized independent auditor chosen by customer, at customer's cost, at most once per 12 months unless required by a data protection authority or following a Data Incident
AuditFor CCPA purposes, customer may take reasonable and appropriate steps under Section 4.4 (Audit Rights) of the DPA to help ensure Sentry's use of Personal Data is consistent with customer's CCPA obligations
AuditSummary of third-party audit reports on request (confidential); written responses to information requests no more than once per calendar year
Processing on your instructionsOnly on Customer's documented lawful instructions; no other purpose unless required by applicable law
Confidentiality of staffPersons authorized to process are under an appropriate contractual or statutory duty of confidentiality
Security measuresAppropriate technical and organizational measures described in Schedule 2

Terms as the agreement states them. Where it is silent on a term, there is no row; that is not a statement that the vendor does not offer it.

Which version applies

On 2026-11-02, the agreement printed: Version 5.1.0 (Latest version) 5.1.0 (Latest version - May 29, 2024) at sentry.io

Version 5.1.0 · Last updated 2024-05-29

This version is in our copies from 2026-10-09.

These terms side by side for every vendor: data processing agreements compared. What vendors give you for a transfer impact assessment: transfer impact assessments.

Assurance

Does Sentry have a SOC 2 report?

Sentry says SOC 2 Type 1 and Type 2 reports are available on request. We read this on 2026-10-04.

  • Available on request “Sentry’s SOC 2 report and ISO 27001 certificate are available to customers via their Sentry account or upon request.”

Source: sentry.io, 2026-10-04

Of the 114 vendors in this registry whose own pages mention SOC 2, 57 say the report is available on request, 1 links to the report itself, and 56 state it without saying how to get it. The type is the one the vendor names.

Is Sentry ISO 27001 certified?

Sentry states ISO/IEC 27001 certification, and says the certificate or audit report is available on request. We read this on 2026-10-04.

  • Available on request “If you already use Sentry, you can access the report and certificate via your Sentry account. Otherwise, contact us for a copy of any report(s) you’re interested in reading (it’ll be less infuriating than your social feed.)”

Source: sentry.io, 2026-10-04

Of the 122 vendors in this registry whose own pages state ISO/IEC 27001, 16 link to the certificate, 43 say it is available on request, and 63 state it without saying how to get it. A certificate names the certification body, the scope and the expiry date: those are the three things to check.

SchemeStatusScopeSourceObserved
HIPAA Attestation · HIPAAAvailable on request—sentry.io2026-10-04
HIPAA Security Rule, 45 CFR 164.308 · HIPAAClaimedrisk assessments throughout the product lifecyclesentry.io2026-10-04
ISO 27001 · ISO27001Available on request—sentry.io2026-10-04
NIST SP 800-30Claimedrisk management procedures, which include nine steps for risk assessment and seven steps for risk mitigationsentry.io2026-10-04
SOC 2 · SOC2Available on request—sentry.io2026-10-04
SOC2 Type I · SOC2T1Available on request—sentry.io2026-10-04
SOC2 Type II · SOC2T2Available on request—sentry.io2026-10-04

Claimed means the vendor asserts the scheme on its own page and offers nothing further. Available on request means the report or certificate exists but sits behind a request, a login or an NDA. Neither is a certificate we have seen. That is a distinction an auditor makes, so we make it too.

SecNumCloud, C5, ENS and HDS for every vendor, with the pages for ISO standards, SOC 2 and TISAX: certifications compared.

Official registers

RegisterOffering, as the register names itStatusLevelValid untilObserved
Data Privacy Framework List (US)EU-U.S. Data Privacy Framework · Sentry.ioActivenon-HR data2027-05-282026-10-05
Data Privacy Framework List (US)Swiss-U.S. Data Privacy Framework · Sentry.ioActivenon-HR data2027-05-282026-10-05
Data Privacy Framework List (US)UK Extension to the EU-U.S. DPF · Sentry.ioActivenon-HR data2027-05-282026-10-05
Global LEI Index (GLEIF)FUNCTIONAL SOFTWARE, INC. · FUNCTIONAL SOFTWARE, INC.ISSUEDUS-DE2027-01-212026-10-08

What the authority publishes, not what the vendor claims. An entry covers the offering it names and nothing else: a FedRAMP authorisation for a government edition says nothing about the commercial service. No entry is not a finding about security - most vendors never apply - and an entry filed under a name not listed above would not have been found.

What an entry on the Data Privacy Framework List covers, and which vendors hold one: EU-US Data Privacy Framework.

Support window

ProductSupport periodStateSBOMSourceObserved
Self-hosted Sentry—Not declaredunknowndevelop.sentry.dev2026-10-11

Vulnerability reporting: [email protected] (security.txt, no Expires field; read 2026-10-17)

How other vendors publish theirs: security.txt across the registry.

Documents

What we read, how it was disclosed, and when.
DocumentDisclosureTranscriptionHTTPObserved
dpaPublicfull2002026-10-09
lifecyclePublicfull2002026-10-11
subprocessorsPublicfull2002026-09-17
tiaPublicfull2002026-10-20

History

DetectedWhat movedWhySource
2026-09-18
EU data location No extra charge → Terms not stated
Note rewritten
we read a better pagedocs.sentry.io

Every reviewed change across the registry, newest first: vendor changes.