PostHog: DPA, subprocessors and transfers

Links last opened 30 October 2026. Record confirmed by a person on 16 September 2026. 4 recorded changes, listed below.

PostHog contracts through PostHog, Inc., registered in United States. Transfers of personal data out of the EEA are covered by EU-US Data Privacy Framework (DPF). Data regions it offers: US, EU. Its trust center is published at https://trust.posthog.com/. Its customer data processing agreement, also called a data processing addendum, is published by PostHog itself; the link is below. Its sub-processor list is published by PostHog itself; the link is below. We open those pages every day — last on 30 October 2026 — and a person last went through this record on 16 September 2026.

Contracting legal entity: PostHog, Inc.
Country of registration: United States
Transfer mechanism: EU-US Data Privacy Framework (DPF)
A US certification scheme covered by an EU adequacy decision. Transfers to a certified US organisation need no further mechanism for the certified scope.
Data processing agreement: https://posthog.com/dpa
Subprocessor list: https://posthog.com/subprocessors
Security or trust page: https://trust.posthog.com/
Data regions: US, EU

What to put in your subprocessor list

A ready row. Replace the purpose with what your client actually uses PostHog for.

Subprocessor	Legal entity	Country	Purpose	Transfer	DPA
PostHog	PostHog, Inc.	US	Analytics	DPF	https://posthog.com/dpa

Questions people ask about PostHog

Where is PostHog's DPA?: PostHog publishes its customer data processing agreement at https://posthog.com/dpa. We last opened that link on 30 October 2026.
Is PostHog's DPA the same thing as a data processing addendum?: Yes. A data processing agreement and a data processing addendum are two names for the document Article 28 of the GDPR requires between a controller and a processor; vendors use both, and some call it processor terms. What it has to contain does not change with the name. PostHog's is at https://posthog.com/dpa.
Where is PostHog's sub-processor list?: PostHog publishes the list of its own sub-processors at https://posthog.com/subprocessors. We last opened that link on 30 October 2026.
Which legal entity does PostHog contract through?: PostHog, Inc., registered in United States. That is the name to put in a record of processing or a sub-processor list, not the brand.
What covers a transfer of personal data to PostHog outside the EEA?: EU-US Data Privacy Framework (DPF). A US certification scheme covered by an EU adequacy decision. Transfers to a certified US organisation need no further mechanism for the certified scope. Whether that is enough for a particular processing operation is a judgement for the controller.
Where is PostHog's trust center?: PostHog publishes it at https://trust.posthog.com/. A trust center, trust page or security page is the same thing under different names: the vendor's own account of how it protects data, and the place it keeps its certifications. It is PostHog's page, so we link to it rather than repeat what it says.

What has changed, and when

Changes we noticed on PostHog's own pages, each with the page we saw it on. The vendor does not publish this, and neither does anyone else.

30 October 2026
PostHog clarified that its DPA takes precedence over other related agreements when there is a conflict regarding the processing of company personal data. The reference sections for Swiss Standard Contractual Clauses were updated from Sections 10.2 and 10.3 to Sections 10.4 and 10.5.
Seen on https://posthog.com/dpa
23 October 2026
PostHog removed a line from their DPA that referenced Annex C, Part B for restrictions and safeguards applicable to sensitive data transfers. This means you should verify whether sensitive data transfer restrictions are now documented elsewhere in their DPA or if they no longer apply.
Seen on https://posthog.com/dpa
27 September 2026
We recorded a change to the UK transfer mechanism.
22 September 2026
PostHog updated their data processing agreement by changing a reference from "Pricing Docs" to "Pricing," which may affect how pricing information is documented or located within the agreement.
Seen on https://posthog.com/dpa

Building your own sub-processor list?

Enter your website: each service it loads, what it is for and links to its own DPA, in a minute or two. No sign-up.

Build my list

Worked out from the registry and what we have written: the country this vendor contracts from, the guides that answer the question this page raises, and the rest of the registry.

Other analytics

Six of them. All analytics in the registry · others that transfer the same way.

Subprocessor

Legal entity

Country

Purpose

Transfer

DPA

PostHog

PostHog, Inc.

Analytics

DPF

https://posthog.com/dpa

Questions people ask about PostHog

Where is PostHog's DPA?

PostHog publishes its customer data processing agreement at https://posthog.com/dpa. We last opened that link on 30 October 2026.

Is PostHog's DPA the same thing as a data processing addendum?

Yes. A data processing agreement and a data processing addendum are two names for the document Article 28 of the GDPR requires between a controller and a processor; vendors use both, and some call it processor terms. What it has to contain does not change with the name. PostHog's is at https://posthog.com/dpa.

Where is PostHog's sub-processor list?

PostHog publishes the list of its own sub-processors at https://posthog.com/subprocessors. We last opened that link on 30 October 2026.

Which legal entity does PostHog contract through?

PostHog, Inc., registered in United States. That is the name to put in a record of processing or a sub-processor list, not the brand.

What covers a transfer of personal data to PostHog outside the EEA?

EU-US Data Privacy Framework (DPF). A US certification scheme covered by an EU adequacy decision. Transfers to a certified US organisation need no further mechanism for the certified scope. Whether that is enough for a particular processing operation is a judgement for the controller.

Where is PostHog's trust center?

PostHog publishes it at https://trust.posthog.com/. A trust center, trust page or security page is the same thing under different names: the vendor's own account of how it protects data, and the place it keeps its certifications. It is PostHog's page, so we link to it rather than repeat what it says.

What has changed, and when

Changes we noticed on PostHog's own pages, each with the page we saw it on. The vendor does not publish this, and neither does anyone else.

30 October 2026

PostHog clarified that its DPA takes precedence over other related agreements when there is a conflict regarding the processing of company personal data. The reference sections for Swiss Standard Contractual Clauses were updated from Sections 10.2 and 10.3 to Sections 10.4 and 10.5.

Seen on https://posthog.com/dpa

23 October 2026

PostHog removed a line from their DPA that referenced Annex C, Part B for restrictions and safeguards applicable to sensitive data transfers. This means you should verify whether sensitive data transfer restrictions are now documented elsewhere in their DPA or if they no longer apply.

Seen on https://posthog.com/dpa

27 September 2026

We recorded a change to the UK transfer mechanism.

22 September 2026

PostHog updated their data processing agreement by changing a reference from "Pricing Docs" to "Pricing," which may affect how pricing information is documented or located within the agreement.

Seen on https://posthog.com/dpa

PostHog: DPA, subprocessors and transfers

What to put in your subprocessor list

Questions people ask about PostHog

What has changed, and when

Building your own sub-processor list?

Where to go next

Other analytics

PostHog: DPA, subprocessors and transfers

What to put in your subprocessor list

Questions people ask about PostHog

What has changed, and when

Building your own sub-processor list?

Where to go next

Other analytics