Spendesk
Spend management · spendesk.com · last read 2026-10-12
Identity
| Legal entity | Spendesk SAS |
|---|---|
| HQ | FR |
| Parent company | — |
| Ultimate ownership | — |
| EU contracting entity | — |
| LEI | — |
| US CLOUD Act reach | Not determined from the sources read |
| Source | spendesk.com · 2026-10-08 |
Data location
| Region | EU data location | Minimum plan | Source | Observed |
|---|---|---|---|---|
| EU | EU by default | — | spendesk.com | 2026-10-08 |
EU: The sub-processor list names Amazon Web Services EMEA SARL for "Hosting services" with a processing location of "European Union". The document doesn't present this as a customer choice, and it names no plan or cost.
Subprocessor chain
21 third parties · 4 of the vendor's own group companies · 12 with a country outside the EEA · all read 2026-10-08
| Subprocessor | Country | Purpose |
|---|---|---|
| Airbyte, Inc. | EU | Data analysis, ETL provider |
| Aircall SAS | EU, US | Customer calls platform |
| Amazon Web Services EMEA SARL | EU | Hosting services |
| Amplitude, Inc. | EU, US, CA | Data analysis for Services performance |
| Anthropic Ireland, Limited (Claude Enterprise) | EU, US | AI assistant for internal productivity tasks |
| DataDog, Inc. | EU, US | Data analysis for Services performance |
| Dust (Permutation Lab SAS) | EU | Bot assistant for support platform |
| Fivetran Inc. | US | Data analysis, ETL provider |
| Forest Admin, Inc. (operating in France through: Forest Admin) | EU, US | Interface for data management |
| Generix Group SAS | EU | E-invoicing platform provider |
| Google Cloud France | EU, US | Cloud hosting and AI services |
| Intercom R&D Unlimited Company | US | Support platform / Messaging and ticketing system |
| Looker (Google Cloud France SARL) | EU, US | Data analysis |
| Mailjet SAS | EU | Email provider |
| MessageBird (Bird B.V.) | EU | SMS provider |
| Salesforce.com France SAS | EU | CRM |
| Segment (Twilio Ireland Limited) | EU, US | Data analysis, ETL provider |
| Slack (Salesforce.com France SAS) | EU | Approval notifications |
| Snowflake Computing Netherlands B.V. | EU, US | Data analysis |
| Tickstar AB | EU | E-invoicing platform provider (Belgium) |
| Zerocoma, S.L. | EU | Invoices certified digitalisation (Spanish customers only) |
Spendesk's own group companies listed as subprocessors (4)
| Company | Country | Purpose |
|---|---|---|
| Spendesk España SL | ES | Customer service and technical support |
| Spendesk GmbH | DE | Customer service and technical support |
| Spendesk Italia S.R.L. | IT | Customer service and technical support |
| Spendesk Limited | GB | Customer service and technical support |
The count outside the EEA is arithmetic over the country column, not a judgement about lawfulness. A transfer outside the EEA can be perfectly lawful; whether this one is depends on your use, not on the vendor.
Processing terms
From the vendor's data processing agreement · read 2026-10-09 · spendesk.com
| Term | What the agreement says |
|---|---|
| Transfer mechanism | SCC (module not stated) |
| Notice of new subprocessors | Spendesk informs the Customer of any new third-party AI provider that processes Customer Data, under the terms of the Agreement, and updates the documentation; no notice period stated |
| Notice of new subprocessors | Vendor will inform the controller when it recruits a new sub-processor; the sub-processors list is on the vendor's website; no notice period or method stated |
| If you object to one | May object within 30 days of being informed, in the form set out in the General Terms and Conditions; if the objection is on reasonable data-protection grounds, may terminate the applicable Contract by written notice |
| Breach notification | without undue delay after becoming aware |
| Audit | Audits by the controller or an auditor it chooses, at the controller's own cost, once every 12 months with at least 60 Business Days' written notice; audit limited to 3 Business Days of processor staff time |
| Audit | Vendor provides the information needed to show compliance; customer may run checks at its own expense under the vendor's external audit policy, with exceptions for a proven breach or an audit required by a supervisory authority |
Terms as the agreement states them. Where it is silent on a term, there is no row; that is not a statement that the vendor does not offer it.
Assurance
| Scheme | Status | Scope | Source | Observed |
|---|---|---|---|---|
| GDPR | Claimed | — | spendesk.com | 2026-10-08 |
| ISO 27001:2022 · ISO27001 | Available on request | — | spendesk.com | 2026-10-08 |
Claimed means the vendor asserts the scheme on its own page and offers nothing further. Available on request means the report or certificate exists but sits behind a request, a login or an NDA. Neither is a certificate we have seen. That is a distinction an auditor makes, so we make it too.
Official registers
- ACN qualified cloud (Italy): checked 2026-10-12, no entry under Spendesk; Spendesk SAS
- DORA critical ICT third-party providers (ESAs): checked 2026-10-12, no entry under Spendesk; Spendesk SAS
- Data Privacy Framework List (US): checked 2026-10-12, no entry under Spendesk; Spendesk SAS
- EU Cloud Code of Conduct (GDPR Art. 40): checked 2026-10-12, no entry under Spendesk; Spendesk SAS
- FedRAMP Marketplace (US): checked 2026-10-12, no entry under Spendesk; Spendesk SAS
- SecNumCloud qualified services (ANSSI, France): checked 2026-10-12, no entry under Spendesk; Spendesk SAS
What the authority publishes, not what the vendor claims. An entry covers the offering it names and nothing else: a FedRAMP authorisation for a government edition says nothing about the commercial service. No entry is not a finding about security - most vendors never apply - and an entry filed under a name not listed above would not have been found.
Support window
Not yet collected. This row will say not declared only once we have read a lifecycle or security page and found no period stated — see support windows.
Vulnerability reporting: [email protected] (security.txt, expires 2026-12-31; read 2026-10-11)
Documents
| Document | Disclosure | Transcription | HTTP | Observed |
|---|---|---|---|---|
| certifications | Public | full | 200 | 2026-10-08 |
| dpa | Public | full | 200 | 2026-10-09 |
| residency | Public | full | 200 | 2026-10-08 |
| subprocessors | Public | full | 200 | 2026-10-08 |
History
Nothing has moved since we started watching this vendor on 2026-10-08. Changes appear here only after a human has reviewed them.