What changed in Recurly's DPA and subprocessor list — and what to check now

Three changes landed on Recurly's public documentation in the space of a fortnight. Each one is independent, but together they create a gap between what your client's records of processing say and what Recurly currently publishes. This post sets out what changed, who it affects, and the practical steps to close that gap.

What changed

The DPA page returned a 404. Recurly's data processing agreement page became inaccessible on or around 29 September 2026, returning a 404 error [src:vendor_change/8d29507e-f745-45ca-8477-f4acf8d8d59d]. A PDF of Recurly's EU Personal Data Processing Agreement is listed in the vendor record at a go.recurly.com URL [src:vendor/recurly]. The public DPA page is no longer accessible [src:vendor_change/8d29507e-f745-45ca-8477-f4acf8d8d59d]. This change is classified as critical severity [src:vendor_change/8d29507e-f745-45ca-8477-f4acf8d8d59d].

Seven subprocessors were removed. On 2 October 2026, Recurly's subprocessor list dropped seven entries: Appcues, Avalara, New Relic, Omni Analytics, Sentry, Zendesk, and Amazon Web Services [src:vendor_change/0751de18-4120-424b-94b9-39f4067552b8]. The subprocessor list page itself — at recurly.com/legal/privacy/subprocessors/ — remains publicly accessible [src:vendor/recurly]. Only the listed vendors changed.

The trust page lost security and compliance detail. Also on 2 October 2026, Recurly's trust page at recurly.com/legal/security/ was updated in a way that removed detailed security and compliance information, including PCI-DSS Level 1 certification status, security practices, and answers to common compliance questions [src:vendor_change/977fc740-7f3e-49ee-94d0-05eca6cea5be]. This change is classified as minor severity, but it affects the evidence available to support any assessment that relied on that page [src:vendor_change/977fc740-7f3e-49ee-94d0-05eca6cea5be].

Who it affects

Any client that uses Recurly as a payments subprocessor and is subject to GDPR obligations will need a current, signed or countersigned DPA on file. Recurly, Inc. is a US entity [src:vendor/recurly] and relies on the EU-US Data Privacy Framework as its transfer mechanism [src:vendor/recurly]. Where a client's records of processing referenced the previous PDF DPA, those records now point to a document whose accessibility is unconfirmed.

The subprocessor removals matter differently depending on how your client's DPA is drafted. If the DPA required notification of subprocessor changes, Recurly removing seven vendors is a change your client should be aware of — even if the direction of change (removal rather than addition) is generally lower risk [src:vendor_change/0751de18-4120-424b-94b9-39f4067552b8]. Whether the removal of Amazon Web Services reflects a genuine infrastructure change or a list-keeping decision is worth clarifying directly with Recurly [src:vendor_change/0751de18-4120-424b-94b9-39f4067552b8].

The trust page change matters most to clients who relied on the published PCI-DSS Level 1 status as documentary evidence in their own vendor assessments or customer-facing documentation [src:vendor_change/977fc740-7f3e-49ee-94d0-05eca6cea5be]. That evidence is no longer publicly available. If it was cited in an assessment report, the citation is now broken.

Consultants handling clients in the payments sector more broadly may find it useful to consider how documentation gaps present differently across vendors. For context on a vendor where the DPA itself is absent rather than temporarily inaccessible, see When a vendor has no public data processing agreement. For a worked example of how entity and document changes interact, see What changed in Stripe's DPA and subprocessor list — and what to check now.

What to do about it

Request a current DPA directly from Recurly. The public page is gone; the document may still exist and may be available on request [src:vendor_change/8d29507e-f745-45ca-8477-f4acf8d8d59d]. Contact Recurly's legal or privacy team and ask for the current EU Personal Data Processing Agreement. Until you have it, your client's records of processing contain a reference to a document whose current status is unknown.

Update your records of processing to reflect the subprocessor removals. The seven vendors — Appcues, Avalara, New Relic, Omni Analytics, Sentry, Zendesk, and Amazon Web Services — should no longer appear as Recurly subprocessors in your client's records [src:vendor_change/0751de18-4120-424b-94b9-39f4067552b8]. If your client's DPA or internal policy required them to maintain an accurate subprocessor chain, this is a routine update, but it still needs to be made.

Replace or remove the trust page citation. If any assessment report, vendor review, or client-facing document cited Recurly's trust page as evidence of PCI-DSS Level 1 status, that citation no longer resolves to the claimed content [src:vendor_change/977fc740-7f3e-49ee-94d0-05eca6cea5be]. Obtain the certification evidence directly — for example, by requesting an Attestation of Compliance from Recurly — rather than relying on a vendor's own web page. That is good practice regardless of this specific change.

Clarify the AWS removal. Amazon Web Services appearing on and then disappearing from a payments vendor's subprocessor list is worth a direct question. It could mean Recurly migrated infrastructure, consolidated to a different listed entity, or simply corrected an error in the previous list [src:vendor_change/0751de18-4120-424b-94b9-39f4067552b8]. The answer affects how your client characterises the change in any internal review.

Check the transfer mechanism documentation. Recurly relies on the EU-US Data Privacy Framework [src:vendor/recurly]. The DPA would ordinarily contain the provisions that give that mechanism contractual effect. Until you have a current DPA, you cannot confirm that the transfer mechanism documentation is in order. For clients who have already documented DPF reliance, note that the supporting contract needs to be current and accessible — not just the DPF certification itself.

For the mechanics of reviewing what changes when a vendor updates its DPA, see Subprocessor lists: what changes when a vendor updates its DPA [src:vendor/recurly]. For how to keep vendor documentation current across a larger client base, see How to scale a privacy practice past 20 clients [src:vendor/recurly].

The vendor record for Recurly was last verified on 16 September 2026 and last updated on 2 October 2026 [src:vendor/recurly]. The subprocessor list URL at recurly.com/legal/privacy/subprocessors/ remains the authoritative public source for the current list [src:vendor/recurly]. Check it before you finalise any client documentation that references Recurly's processing chain.