WordPress.com
Website builder · wordpress.com · last read 2026-11-09
At a glance
- Is WordPress.com GDPR compliant?
- No tool is GDPR compliant on its own: compliance depends on what you process with it and how. What follows is what WordPress.com itself publishes, each answer linked to its source and the date we read it.
- How does WordPress.com transfer personal data out of the EU?
- Automattic Inc. is on the official Data Privacy Framework List (status: Active). Source and date
- Where does WordPress.com store EU customer data?
- The vendor states that no EU location is offered. Source and date
- Who are WordPress.com's subprocessors?
- WordPress.com lists 5 third-party subprocessors; 4 of them name at least one processing country outside the EEA. We last read the list on 2026-11-02. We have recorded 1 change to it, the latest on 2026-11-02. Source and date
- How do you report a security vulnerability to WordPress.com?
- WordPress.com publishes a security.txt at wordpress.com naming https://hackerone.com/automattic/reports/new or [email protected]. The file falls short of RFC 9116: no Expires field. Source and date
The same questions for any vendor, and the rule behind each: the vendor due diligence checklist.
Identity
| Legal entity | Automattic Inc. |
|---|---|
| HQ | US |
| Parent company | — |
| Ultimate ownership | — |
| EU contracting entity | Aut O’Mattic A8C Ireland Ltd. |
| LEI | 254900SC9UVUIZP1CH08 |
| US CLOUD Act reach | Contracting entity incorporated in the US |
| Source | wordpress.com · 2026-10-25 |
Legal entity from the vendor's own terms. LEI, registered country and parent company from the Global LEI Index (GLEIF); ownership is left empty where GLEIF names no parent. The CLOUD Act row is arithmetic over those countries, not an assessment of risk.
Data location
| Region | EU data location | Minimum plan | Source | Observed |
|---|---|---|---|---|
| EU | No EU location | — | wordpress.com | 2026-10-25 |
EU: WordPress.com stores personal data on servers in both the US and the EU, and states it is not possible to restrict a site's data to a single geographic location. EU transfers are covered by Standard Contractual Clauses in its DPA instead.
The same question for every vendor: where SaaS vendors store EU data.
WordPress.com's subprocessor list names AWS for hosting or infrastructure. Which SaaS vendors run on which cloud, and the sovereign offerings of each: sovereign clouds.
Subprocessor chain
5 third parties · 4 with a country outside the EEA · all read 2026-11-02
| Subprocessor | Country | Purpose |
|---|---|---|
| Amazon Web Services | US | Storage and backup of data |
| Anthropic, PBC | US | Powering AI features |
| Google LLC | US | Powering AI features |
| Linode | DE | Hosts MailPoet accounts |
| OpenAI OpCo, LLC | US | Powering AI features |
The count outside the EEA is arithmetic over the country column, not a judgement about lawfulness. A transfer outside the EEA can be perfectly lawful; whether this one is depends on your use, not on the vendor.
Every subprocessor in the registry, and which vendors name it: subprocessors.
Processing terms
No data processing agreement read yet.
These terms side by side for every vendor: data processing agreements compared. What vendors give you for a transfer impact assessment: transfer impact assessments.
Assurance
No certification claims transcribed yet.
SecNumCloud, C5, ENS and HDS for every vendor, with the pages for ISO standards, SOC 2 and TISAX: certifications compared.
Official registers
| Register | Offering, as the register names it | Status | Level | Valid until | Observed |
|---|---|---|---|---|---|
| Data Privacy Framework List (US) | EU-U.S. Data Privacy Framework · Automattic Inc. | Active | non-HR data | 2027-01-06 | 2026-10-25 |
| Data Privacy Framework List (US) | Swiss-U.S. Data Privacy Framework · Automattic Inc. | Active | non-HR data | 2027-01-06 | 2026-10-25 |
| Data Privacy Framework List (US) | UK Extension to the EU-U.S. DPF · Automattic Inc. | Active | non-HR data | 2027-01-06 | 2026-10-25 |
| FedRAMP Marketplace (US) | WordPress VIP · Automattic, Inc. | FedRAMP Authorized | Moderate | — | 2026-10-25 |
| Global LEI Index (GLEIF) | Automattic Inc. · Automattic Inc. | ISSUED | US-DE | 2027-05-08 | 2026-10-25 |
- ACN qualified cloud (Italy): checked 2026-11-09, no entry under Aut O’Mattic A8C Ireland Ltd.; Automattic Inc.; WordPress.com
- ISO 27001 on the basis of IT-Grundschutz (BSI, Germany): checked 2026-11-09, no entry under Aut O’Mattic A8C Ireland Ltd.; Automattic Inc.; WordPress.com
- CISPE Data Protection Code of Conduct (GDPR Art. 40): checked 2026-11-09, no entry under Aut O’Mattic A8C Ireland Ltd.; Automattic Inc.; WordPress.com
- DORA critical ICT third-party providers (ESAs): checked 2026-11-09, no entry under Aut O’Mattic A8C Ireland Ltd.; Automattic Inc.; WordPress.com
- Data Privacy Framework List (US): checked 2026-11-09, 3 entries under Aut O’Mattic A8C Ireland Ltd.; Automattic Inc.; WordPress.com
- ENS certificates of conformity (CCN, Spain): checked 2026-11-09, no entry under Aut O’Mattic A8C Ireland Ltd.; Automattic Inc.; WordPress.com
- EU Cloud Code of Conduct (GDPR Art. 40): checked 2026-11-09, no entry under Aut O’Mattic A8C Ireland Ltd.; Automattic Inc.; WordPress.com
- FedRAMP Marketplace (US): checked 2026-11-09, 1 entry under Aut O’Mattic A8C Ireland Ltd.; Automattic Inc.; WordPress.com
- GPAI Code of Practice signatories (European Commission): checked 2026-11-09, no entry under Aut O’Mattic A8C Ireland Ltd.; Automattic Inc.; WordPress.com
- SecNumCloud qualified services (ANSSI, France): checked 2026-11-09, no entry under Aut O’Mattic A8C Ireland Ltd.; Automattic Inc.; WordPress.com
What the authority publishes, not what the vendor claims. An entry covers the offering it names and nothing else: a FedRAMP authorisation for a government edition says nothing about the commercial service. No entry is not a finding about security - most vendors never apply - and an entry filed under a name not listed above would not have been found.
What an entry on the Data Privacy Framework List covers, and which vendors hold one: EU-US Data Privacy Framework.
Support window
Not yet collected. This row will say not declared only once we have read a lifecycle or security page and found no period stated — see support windows.
Vulnerability reporting: hackerone.com, [email protected] (security.txt, no Expires field; read 2026-10-25)
How other vendors publish theirs: security.txt across the registry.
Documents
| Document | Disclosure | Transcription | HTTP | Observed |
|---|---|---|---|---|
| identity | Public | full | 200 | 2026-10-25 |
| residency | Public | full | 200 | 2026-10-25 |
| subprocessors | Public | full | 200 | 2026-11-02 |
History
| Detected | What moved | Why | Source |
|---|---|---|---|
| 2026-11-02 | Subprocessors added Anthropic, PBC; Google LLC; Linode; OpenAI OpCo, LLC | the vendor changed it | automattic.com |
Every reviewed change across the registry, newest first: vendor changes.