Loading…
Links last opened 20 October 2026. Record confirmed by a person on 16 September 2026. 5 recorded changes, listed below.
Brevo contracts through Sendinblue SAS, registered in France. It is registered inside the EEA, so sending personal data to it is not a transfer out of the EEA. Data regions it offers: EU. Its trust center is published at https://www.brevo.com/features/data-security/. Its customer data processing agreement, also called a data processing addendum, is published by Brevo itself; the link is below. Its sub-processor list is published by Brevo itself; the link is below. We open those pages every day — last on 20 October 2026 — and a person last went through this record on 16 September 2026.
Reaching Brevo is not a transfer out of the EEA: it is registered in France. This is what the record holds for where it sends personal data on, and it is not something we have checked — its sub-processor list is the place to look.
A ready row. Replace the purpose with what your client actually uses Brevo for.
| Subprocessor | Legal entity | Country | Purpose | Transfer | DPA |
|---|---|---|---|---|---|
| Brevo | Sendinblue SAS | FR | Communication | SCC | https://www.brevo.com/legal/termsofuse/ |
Changes we noticed on Brevo's own pages, each with the page we saw it on. The vendor does not publish this, and neither does anyone else.
20 October 2026
Brevo updated its corporate name from Sendinblue to Brevo throughout its legal documents and subprocessor list. The vendor added references to subprocessors in countries without EU adequacy decisions (FX), which may require additional data transfer mechanisms to be documented in your data processing agreement.
20 October 2026
The contracting entity name changed from Sendinblue to Brevo, reflecting a legal entity rebranding. This affects records of processing and data processing agreements as the contracting party's legal name has been updated while maintaining the same registration number and address.
15 October 2026
Brevo's DPA section 3.2 on user account protection now explicitly states that customers remain solely responsible for maintaining the confidentiality of their account credentials, which clarifies the allocation of security responsibilities between the parties.
9 October 2026
Brevo changed the legal entity name from SIB INC. US to Brevo INC. US as the signatory and billing entity under the data processing agreement. This affects how the vendor is officially identified in records of processing and may require updating subprocessor lists and DPA documentation to reflect the current legal entity.
22 September 2026
We recorded a change to the UK transfer mechanism.
Recorded from a source other than their own pages.
Enter your website: each service it loads, what it is for and links to its own DPA, in a minute or two. No sign-up.
Worked out from the registry and what we have written: the country this vendor contracts from, the guides that answer the question this page raises, and the rest of the registry.
Six of them. All communication in the registry · others that transfer the same way.