Loading…
Links last opened 17 October 2026. Record confirmed by a person on 16 September 2026. 5 recorded changes, listed below.
Customer.io contracts through Peaberry Software Inc., registered in United States. Transfers of personal data out of the EEA are covered by Standard contractual clauses (SCC). Data regions it offers: US, EU. Its trust center is published at https://customer.io/security. Its customer data processing agreement, also called a data processing addendum, is published by Customer.io itself; the link is below. Its sub-processor list is published by Customer.io itself; the link is below. We open those pages every day — last on 17 October 2026 — and a person last went through this record on 16 September 2026.
Contract terms adopted by the European Commission that the vendor signs to protect personal data transferred outside the EEA. Usually part of the vendor's DPA.
A ready row. Replace the purpose with what your client actually uses Customer.io for.
| Subprocessor | Legal entity | Country | Purpose | Transfer | DPA |
|---|---|---|---|---|---|
| Customer.io | Peaberry Software Inc. | US | Communication | SCC | https://customer.io/legal/dpa |
Changes we noticed on Customer.io's own pages, each with the page we saw it on. The vendor does not publish this, and neither does anyone else.
6 October 2026
Customer.io added Infobip as a subprocessor. The subprocessor list was updated in October 2026, replacing the previous version from March 2026.
1 October 2026
Customer.io updated their DPA execution process by replacing a signing link with an email contact method, so you now need to email privacy@customer.io to request a signed Data Processing Agreement instead of using a previous signing mechanism.
Seen on https://customer.io/legal/dpa
30 September 2026
Customer.io updated its Data Processing Agreement effective September 2026, making the document effective from that date forward. The updated DPA adds detailed sections on data breach notification procedures, data deletion obligations, compliance verification processes including audit rights and frequency limits, and clarifies that the agreement cannot be modified except through written instrument signed by both parties.
Seen on https://customer.io/legal/dpa
29 September 2026
Customer.io updated its Data Processing Agreement, removing the "Effective September 2026" date and sections on personal data breach notification, data deletion, compliance verification, and general provisions, while keeping the introductory language and the definition of European Data Protection Law. The changes mean your records of processing and data processing agreement files need to be updated with the current version of Customer.io's DPA.
Seen on https://customer.io/legal/dpa
27 September 2026
Customer.io updated its Data Processing Agreement effective September 2026, adding detailed sections on personal data breach notification procedures, data deletion obligations upon termination, compliance verification and audit rights, and general modification terms. The changes clarify notification timelines for breaches, Customer.io's data retention and deletion policies, audit procedures with specific notice periods and frequency limits, and confidentiality protections for audit findings.
Seen on https://customer.io/legal/dpa
Enter your website: each service it loads, what it is for and links to its own DPA, in a minute or two. No sign-up.
Worked out from the registry and what we have written: the country this vendor contracts from, the guides that answer the question this page raises, and the rest of the registry.
Six of them. All communication in the registry · others that transfer the same way.