Webflow
Website builder · webflow.com · last read 2026-10-12
Identity
| Legal entity | Webflow, Inc. |
|---|---|
| HQ | US |
| Parent company | — |
| Ultimate ownership | — |
| EU contracting entity | — |
| LEI | — |
| US CLOUD Act reach | Contracting entity incorporated in the US |
| Source | webflow.com · 2026-10-09 |
Data location
No data-location observation recorded yet.
Subprocessor chain
37 third parties · 34 with a country outside the EEA · all read 2026-10-09
| Subprocessor | Country | Purpose |
|---|---|---|
| 6Sense | US | Firmographic Data, Data Enrichment |
| Ably Realtime Ltd. | GB | Real-time notifications within the designer and dashboard |
| Airtable (Formagrid, Inc.) | US | Collaboration and productivity SaaS solution |
| Amazon Web Services, Inc. | US | Cloud services, hosting, and translation services |
| Amplitude, Inc. | US | Product usage analytics |
| Anrok | US | Tax compliance automation |
| Anthropic | US | Artificial Intelligence services |
| Asana, Inc. | US | Task and project management |
| Birdie (Philo Labs, SAS) | FR | Customer support SaaS |
| Census (Sutro Labs, Inc.) | US | Data warehouse syncing |
| Cloudflare, Inc. | US | Content delivery network |
| Datadog, Inc. | US | Monitoring and security |
| dbt Labs, Inc. | US | Data transformation SaaS solution |
| Decagon AI, Inc. | US | Customer support chatbot |
| Elasticsearch, Inc. | US | Product search functionality and analytics |
| Fivetran, Inc. | US | Data pipeline automation |
| Google LLC | US | G Suite, email, file storage, and translation services |
| Mailjet, Inc. | US | Transaction email provider |
| MongoDB, Inc. | US | Cloud database provider |
| OpenAI, L.L.C. | US | Artificial Intelligence services |
| Outreach Corporation | US | Sales engagement platform |
| Pocus, Inc. | US | Sales engagement platform |
| Salesforce, Inc. | US | Customer relationship management platform |
| Slack (a Salesforce Company) | US | Team communication |
| Snowflake, Inc. | US | Data warehouse |
| StatSig, Inc. | US | Product feature management |
| Stigg, Inc. | US | Billing and subscriptions |
| Stripe | US | Payment Processing |
| Tableau (a Salesforce Company) | US | Business intelligence |
| TaxJar (a Stripe Company) | US | Sales tax compliance |
| Tines Security Services Ltd. | IE | Security automation |
| Twilio Segment (Twilio, Inc.) | US | Customer data platform |
| Typeform SL | ES | Forms and survey provider |
| Workato, Inc. | US | Workflow automation |
| Zapier, Inc. | US | Workflow automation |
| Zendesk, Inc. | US | Customer service platform |
| Zoom (Zoom Video Communications, Inc.) | US | Video communications |
The count outside the EEA is arithmetic over the country column, not a judgement about lawfulness. A transfer outside the EEA can be perfectly lawful; whether this one is depends on your use, not on the vendor.
Processing terms
From the vendor's data processing agreement · read 2026-10-09 · webflow.com
| Term | What the agreement says |
|---|---|
| Transfer mechanism | EU-U.S. DPF |
| Transfer mechanism | SCC module 1 |
| Transfer mechanism | SCC module 2 |
| Transfer mechanism | SCC module 3 |
| Transfer mechanism | Swiss FADP clauses |
| Transfer mechanism | UK Addendum |
| Transfer mechanism | UK IDTA |
| Notice of new subprocessors | Prior written notice of subprocessor changes (SCC Clause 9 Option 2); notice period set in Section 5 of the DPA, which is not in this part |
| Notice of new subprocessors | Prior written notice of subprocessor changes (SCC Clause 9 Option 2); period set in Section 5 of the DPA, not stated in this part |
| Notice of new subprocessors | email notification to customers who sign up at webflow.com/legal/subprocessors; no advance notice period stated |
| If you object to one | may reasonably object within 15 calendar days of the email notice; Webflow will use reasonable efforts to change the Platform or recommend a change; if no alternative, customer may terminate its subscription but must pay outstanding fees; customers who do not sign up for notifications are deemed to have waived the right to object |
| Breach notification | without undue delay after a confirmed Data Breach |
| Audit | Third-party auditor agreed by both parties, on 30 days' prior written notice and at customer's cost; no more than once every 12 months; no on-site audit unless legally required by a Regulator |
| Audit | Under the CCPA terms, the customer may take reasonable and appropriate steps, as set out in DPA Section 6 (Audit), to check that Webflow processes Customer Personal Information under the Agreement |
| Audit | information needed to demonstrate GDPR compliance; at customer's request, Webflow will permit and contribute to audits as set out in Section 6 (Audit) |
Terms as the agreement states them. Where it is silent on a term, there is no row; that is not a statement that the vendor does not offer it.
Assurance
| Scheme | Status | Scope | Source | Observed |
|---|---|---|---|---|
| ISO 27001 · ISO27001 | Claimed | — | webflow.com | 2026-10-09 |
| ISO 27017 · ISO27017 | Claimed | — | webflow.com | 2026-10-09 |
| ISO 27018 · ISO27018 | Claimed | — | webflow.com | 2026-10-09 |
| ISO 42001 · ISO42001 | Claimed | — | webflow.com | 2026-10-09 |
| PCI-DSS · PCIDSS | Claimed | how Webflow meets the security requirements for handling and transmitting payment information | webflow.com | 2026-10-09 |
| SOC 2 · SOC2 | Claimed | — | webflow.com | 2026-10-09 |
| SOC 2 Type II · SOC2T2 | Claimed | security, availability, and confidentiality controls | webflow.com | 2026-10-09 |
Claimed means the vendor asserts the scheme on its own page and offers nothing further. Available on request means the report or certificate exists but sits behind a request, a login or an NDA. Neither is a certificate we have seen. That is a distinction an auditor makes, so we make it too.
Official registers
| Register | Offering, as the register names it | Status | Level | Valid until | Observed |
|---|---|---|---|---|---|
| Data Privacy Framework List (US) | EU-U.S. Data Privacy Framework · Webflow | Active | non-HR data | 2027-02-24 | 2026-10-09 |
| Data Privacy Framework List (US) | Swiss-U.S. Data Privacy Framework · Webflow | Active | non-HR data | 2027-02-24 | 2026-10-09 |
| Data Privacy Framework List (US) | UK Extension to the EU-U.S. DPF · Webflow | Active | non-HR data | 2027-02-24 | 2026-10-09 |
- ACN qualified cloud (Italy): checked 2026-10-12, no entry under Webflow; Webflow, Inc.
- DORA critical ICT third-party providers (ESAs): checked 2026-10-12, no entry under Webflow; Webflow, Inc.
- Data Privacy Framework List (US): checked 2026-10-12, 3 entries under Webflow; Webflow, Inc.
- EU Cloud Code of Conduct (GDPR Art. 40): checked 2026-10-12, no entry under Webflow; Webflow, Inc.
- FedRAMP Marketplace (US): checked 2026-10-12, no entry under Webflow; Webflow, Inc.
- SecNumCloud qualified services (ANSSI, France): checked 2026-10-12, no entry under Webflow; Webflow, Inc.
What the authority publishes, not what the vendor claims. An entry covers the offering it names and nothing else: a FedRAMP authorisation for a government edition says nothing about the commercial service. No entry is not a finding about security - most vendors never apply - and an entry filed under a name not listed above would not have been found.
Support window
| Product | Support period | State | SBOM | Source | Observed |
|---|---|---|---|---|---|
| Webflow (service) | — | Service only | unknown | webflow.com | 2026-10-11 |
Vulnerability reporting: (security.txt, no Contact field; read 2026-10-11)
Documents
| Document | Disclosure | Transcription | HTTP | Observed |
|---|---|---|---|---|
| certifications | Public | full | 200 | 2026-10-09 |
| dpa | Public | full | 200 | 2026-10-09 |
| subprocessors | Public | full | 200 | 2026-10-09 |
History
Nothing has moved since we started watching this vendor on 2026-10-09. Changes appear here only after a human has reviewed them.