What changed in Retool's DPA and subprocessor list — and what to check now

What changed

Four distinct changes occurred across Retool's data protection documentation within a short window. Each is worth treating separately because each has a different record-keeping consequence.

Legal entity in the DPA. The most significant change is rated critical severity [src:vendor_change/7a710728-fae8-485f-876e-e2463fa8b5ca]. Retool's DPA previously identified the counterparty as "Retool Inc., a Delaware corporation" at a specific San Francisco address. That language has been replaced with a general reference to "Retool" acting on behalf of its Affiliates [src:vendor_change/814ff08c-3184-4d4b-a8f1-3901ca09e42a]. The contracting party and the jurisdiction for the agreement are now less precisely defined in the document itself [src:vendor_change/7a710728-fae8-485f-876e-e2463fa8b5ca]. The vendor profile on file continues to list the legal entity as Retool Inc., a US-incorporated company in the devtools category [src:vendor/retool], but that information no longer appears on the face of the DPA.

DPA definitions and structure. Retool also updated the DPA's definitions section and overall structure [src:vendor_change/8982a387-74b9-4933-bfbf-eae777a8bbb8]. New defined terms were added for Standard Contractual Clauses modules, covering both Controller-to-Processor and Processor-to-Processor transfer configurations. The DPA now includes explicit references to EU, UK, Swiss, and US data protection laws. At the same time, several previously defined terms were removed: Personal Data Breach, Sub-processor, Supervisory Authority, Third Party Request, and references to specific US state privacy laws no longer appear in the definitions section [src:vendor_change/8982a387-74b9-4933-bfbf-eae777a8bbb8].

Subprocessor list. Intercom, Inc. and Salesforce, Inc. have been removed [src:vendor_change/fe7d197b-2426-4dff-bf16-b3e9a925ae5d]. Pylon Labs, Inc. has been added in their place [src:vendor_change/259ea0ec-9433-4cc8-97c7-e91006394545]. Retool's subprocessor list is publicly accessible at https://docs.retool.com/legal/subprocessors [src:vendor/retool].

Trust page. The trust page was updated to split security contact information into separate sections and to add a dedicated abuse reporting address [src:vendor_change/6bfdb187-bdd2-4b3e-8cb7-73e0e48eb3a7]. A subsequent update then removed that abuse reporting address while retaining the restructured security contact information [src:vendor_change/54b305d9-37cd-49fa-abb8-c02271be8e57]. The net effect is a reorganised security contact section without a dedicated abuse channel.

---

Who it affects

Organisations whose records of processing name the old counterparty. Any record that identifies the processor as "Retool Inc., a Delaware corporation" at a specific address will now be inconsistent with the current DPA wording [src:vendor_change/814ff08c-3184-4d4b-a8f1-3901ca09e42a]. Under Article 30 GDPR, records of processing activities are expected to identify processors accurately. A mismatch between the record and the live agreement is the kind of gap a supervisory authority will notice during an audit.

Controllers relying on specific SCC module designations. The DPA now explicitly names Controller-to-Processor and Processor-to-Processor SCC modules as defined terms [src:vendor_change/8982a387-74b9-4933-bfbf-eae777a8bbb8]. If a client's transfer impact assessment or internal mapping assumed an older, less structured SCC arrangement, the basis documented in the TIA may need revisiting. No transfer mechanism is recorded for Retool at present [src:vendor/retool], which is itself a gap to resolve before relying on the DPA for transfer legitimacy.

Clients who built notification workflows around Intercom or Salesforce as Retool subprocessors. Both have been removed [src:vendor_change/fe7d197b-2426-4dff-bf16-b3e9a925ae5d]. If a client's DPIA, vendor register, or data flow map listed either of those companies in the context of Retool's processing chain, those entries require updating. Pylon Labs, Inc. is now the listed replacement for customer communication functions [src:vendor_change/259ea0ec-9433-4cc8-97c7-e91006394545]. Clients with obligations to notify their own customers of subprocessor changes — for instance, under a contract that incorporates Retool's subprocessor list by reference — should check whether their notice period has been triggered. For the wider question of what to do when a vendor updates its DPA, see Subprocessor lists: what changes when a vendor updates its DPA.

Clients who are themselves processors. Where a client processes personal data on behalf of their own controller customers, and Retool sits in that chain, the Processor-to-Processor SCC module becomes relevant. The DPA's restructured approach to this configuration [src:vendor_change/8982a387-74b9-4933-bfbf-eae777a8bbb8] means the underlying flow-down obligations may have changed. That is worth confirming against the current DPA text at https://docs.retool.com/legal/dpa [src:vendor/retool].

---

What to do about it

Update the legal entity entry in every affected record. The immediate action is mechanical but important. Wherever a client's records of processing or internal vendor register names "Retool Inc., a Delaware corporation" as the processor counterparty, that entry now requires a note reflecting that the current DPA uses a more general "Retool" and Affiliates formulation [src:vendor_change/814ff08c-3184-4d4b-a8f1-3901ca09e42a]. Document the date of the change and the source. The brand is not always the counterparty — this change is a practical illustration of that principle.

Read the current DPA definitions section before updating any TIA. Several terms that may have appeared in a client's transfer documentation — Sub-processor, Supervisory Authority, Personal Data Breach — are no longer defined within the DPA itself [src:vendor_change/8982a387-74b9-4933-bfbf-eae777a8bbb8]. Before updating a transfer impact assessment or supplementary measure document, confirm whether those concepts are now addressed by reference to the applicable law rather than by internal definition, and adjust your client's documentation accordingly.

Resolve the absent transfer mechanism. No transfer mechanism is recorded for Retool, and no data region restrictions are noted [src:vendor/retool]. If a client is transferring personal data from the EU, UK, or Switzerland to Retool, the basis for that transfer must be identified and documented separately from the DPA review. The DPA now references EU, UK, and Swiss regimes explicitly [src:vendor_change/8982a387-74b9-4933-bfbf-eae777a8bbb8], but referencing a regime is not the same as establishing a transfer mechanism. This should be treated as an open item until resolved. For UK-specific considerations, UK GDPR vs. GDPR: vendor registry differences that matter to your client base is a useful reference.

Update subprocessor entries. Replace Intercom, Inc. and Salesforce, Inc. with Pylon Labs, Inc. in any client-facing vendor map or DPIA that included Retool's subprocessor chain [src:vendor_change/fe7d197b-2426-4dff-bf16-b3e9a925ae5d]. Verify the current list directly at https://docs.retool.com/legal/subprocessors [src:vendor/retool] before finalising any update, as the list moved in both directions within this review window.

Check trust page references. If any client documentation — an internal security questionnaire response, a vendor assessment, or a GDPR record — cited an abuse reporting channel at Retool, note that the address added to the trust page was subsequently removed [src:vendor_change/54b305d9-37cd-49fa-abb8-c02271be8e57]. The current security contact information is at https://docs.retool.com/legal/security [src:vendor/retool]. If your process for handling incidents involving Retool referenced a specific email, verify it against the current page before relying on it. For guidance on how to structure vendor security contact documentation, a security questionnaire from your client's customer: the first hour covers the practical steps.