Usercentrics
Consent management · usercentrics.com · last read 2026-10-12
Identity
| Legal entity | Usercentrics GmbH |
|---|---|
| HQ | DE |
| Parent company | — |
| Ultimate ownership | — |
| EU contracting entity | Usercentrics A/S |
| LEI | — |
| US CLOUD Act reach | Not determined from the sources read |
| Source | usercentrics.com · 2026-10-08 |
Data location
| Region | EU data location | Minimum plan | Source | Observed |
|---|---|---|---|---|
| EU | EU by default | — | usercentrics.com | 2026-10-08 |
EU: The DPA states that processing of Controller data takes place within the EU / EEA, with no plan or customer choice required. Databases are hosted on servers within EU member states, primarily Frankfurt and Belgium.
Subprocessor chain
5 third parties · 0 with a country outside the EEA · all read 2026-10-08
| Subprocessor | Country | Purpose |
|---|---|---|
| BUNNY WAY, informacijske storitve d.o.o. | EU | Content Delivery Network (CDN) |
| Cloudflare, Inc. | — | Content Delivery Network (CDN) |
| Google Cloud | EU | Resources for the production system and related systems (static hosting, APIs and databases) |
| Google Cloud EMEA Ltd. | EU | Hosting |
| Hetzner Online GmbH | EU | Hosting |
The count outside the EEA is arithmetic over the country column, not a judgement about lawfulness. A transfer outside the EEA can be perfectly lawful; whether this one is depends on your use, not on the vendor.
Processing terms
From the vendor's data processing agreement · read 2026-10-09 · usercentrics.com
| Term | What the agreement says |
|---|---|
| Transfer mechanism | SCC (module not stated) |
| Notice of new subprocessors | 30 days before processing starts, written notice (email sufficient) |
| Notice of new subprocessors | 30 days before the start of processing, in writing (email sufficient) |
| If you object to one | Customer may object within the 30-day period (silence = approval). If the objection has an important data protection reason and no acceptable solution is reached, customer has a special right of termination: it declares intent within one week, the vendor may fix the issue within two weeks, and otherwise termination takes effect on receipt. Where the service cannot be provided without the subprocessor, either party may terminate without notice. |
| If you object to one | May object within the notice period (silence counts as approval); if there is an important data protection reason and no acceptable solution is found, either party may terminate without notice or liability |
| Breach notification | without undue delay |
| Audit | Audits incl. inspections by controller or third-party auditor, by prior written agreement on scope and timing; processor may instead provide documentation (audit certificates, reports, ISO 27001 certification); on-site inspections only if reasonably necessary after reviewing that documentation; results are processor's Confidential Information |
| Audit | Information and inspections in agreement with Processor, by Controller or appointed auditors; Processor may provide documentation instead (audit certificates, third-party reports, ISO 27001 certification); on-site visits right preserved |
| Audit | Information on request; audits including inspections by the controller or a third-party auditor, with scope and timing set by prior written agreement; processor may provide documentation as proof |
| Audit | Processor may provide third-party audit reports or certifications (e.g. ISO 27001); Controller keeps the right to on-site visits and to spot checks, which as a rule must be announced in good time |
Terms as the agreement states them. Where it is silent on a term, there is no row; that is not a statement that the vendor does not offer it.
Assurance
| Scheme | Status | Scope | Source | Observed |
|---|---|---|---|---|
| CCPA | Claimed | — | trust.usercentrics.com | 2026-10-08 |
| GDPR | Claimed | — | trust.usercentrics.com | 2026-10-08 |
| HIPAA | Available on request | — | trust.usercentrics.com | 2026-10-08 |
| HIPAA | Available on request | Usercentrics GmbH and its affiliates | trust.usercentrics.com | 2026-10-08 |
| ISO 27001:2022 · ISO27001 | Available on request | — | trust.usercentrics.com | 2026-10-08 |
| ISO 27701:2019 · ISO27701 | Available on request | — | trust.usercentrics.com | 2026-10-08 |
| ISO27701:2019 · ISO27701 | Claimed | Usercentrics Gmbh and Its affiliates | trust.usercentrics.com | 2026-10-08 |
| LGPD | Claimed | — | trust.usercentrics.com | 2026-10-08 |
| NIS 2 · NIS2 | Claimed | — | trust.usercentrics.com | 2026-10-08 |
| DMA | Claimed | — | trust.usercentrics.com | 2026-10-08 |
| Google Consent Mode V2 | Claimed | — | trust.usercentrics.com | 2026-10-08 |
| Microsoft Consent Mode | Claimed | — | trust.usercentrics.com | 2026-10-08 |
| NIST CSF 2.0 | Claimed | — | trust.usercentrics.com | 2026-10-08 |
| NIST CSF 2.0 | Claimed | Usercentrics Gmbh and Its affiliates | trust.usercentrics.com | 2026-10-08 |
| POPIA | Claimed | — | trust.usercentrics.com | 2026-10-08 |
| TCF | Claimed | — | trust.usercentrics.com | 2026-10-08 |
| VCDPA | Claimed | — | trust.usercentrics.com | 2026-10-08 |
| SOC 2 Type 2 · SOC2T2 | Available on request | — | trust.usercentrics.com | 2026-10-08 |
| SOC 2 Type II · SOC2T2 | Available on request | Usercentrics GmbH and its affiliates | trust.usercentrics.com | 2026-10-08 |
| TISAX Level 3 · TISAX | Available on request | — | trust.usercentrics.com | 2026-10-08 |
| FADP · nFADP | Claimed | — | trust.usercentrics.com | 2026-10-08 |
Claimed means the vendor asserts the scheme on its own page and offers nothing further. Available on request means the report or certificate exists but sits behind a request, a login or an NDA. Neither is a certificate we have seen. That is a distinction an auditor makes, so we make it too.
Official registers
- ACN qualified cloud (Italy): checked 2026-10-12, no entry under Usercentrics; Usercentrics A/S; Usercentrics GmbH
- DORA critical ICT third-party providers (ESAs): checked 2026-10-12, no entry under Usercentrics; Usercentrics A/S; Usercentrics GmbH
- Data Privacy Framework List (US): checked 2026-10-12, no entry under Usercentrics; Usercentrics A/S; Usercentrics GmbH
- EU Cloud Code of Conduct (GDPR Art. 40): checked 2026-10-12, no entry under Usercentrics; Usercentrics A/S; Usercentrics GmbH
- FedRAMP Marketplace (US): checked 2026-10-12, no entry under Usercentrics; Usercentrics A/S; Usercentrics GmbH
- SecNumCloud qualified services (ANSSI, France): checked 2026-10-12, no entry under Usercentrics; Usercentrics A/S; Usercentrics GmbH
What the authority publishes, not what the vendor claims. An entry covers the offering it names and nothing else: a FedRAMP authorisation for a government edition says nothing about the commercial service. No entry is not a finding about security - most vendors never apply - and an entry filed under a name not listed above would not have been found.
Support window
| Product | Support period | State | SBOM | Source | Observed |
|---|---|---|---|---|---|
| Usercentrics (service) | — | Service only | unknown | usercentrics.com | 2026-10-11 |
Vulnerability reporting: no security.txt at the well-known path (read 2026-10-11)
Documents
| Document | Disclosure | Transcription | HTTP | Observed |
|---|---|---|---|---|
| certifications | Public | full | 200 | 2026-10-08 |
| dpa | Public | full | 200 | 2026-10-09 |
| residency | Public | full | 200 | 2026-10-08 |
| subprocessors | Public | full | 200 | 2026-10-08 |
History
Nothing has moved since we started watching this vendor on 2026-10-08. Changes appear here only after a human has reviewed them.