Safebase: DPA, subprocessors and transfers

Links last opened 2 November 2026. Record confirmed by a person on 6 October 2026. 17 recorded changes, listed below.

Safebase contracts through SafeBase, LLC, registered in United States. Transfers of personal data out of the EEA are covered by EU-US Data Privacy Framework (DPF). Its trust center is published at https://trust.drata.com/?itemUid=e3fae2ca-94a9-416b-b577-5c90e382df57. Its customer data processing agreement, also called a data processing addendum, is published by Safebase itself; the link is below. Its sub-processor list is published by Safebase itself; the link is below. We open those pages every day — last on 2 November 2026 — and a person last went through this record on 6 October 2026.

Contracting legal entity: SafeBase, LLC
Country of registration: United States
Transfer mechanism: EU-US Data Privacy Framework (DPF)
A US certification scheme covered by an EU adequacy decision. Transfers to a certified US organisation need no further mechanism for the certified scope.
Data processing agreement: https://safebase.io/dpa
Subprocessor list: https://trust.drata.com/?itemUid=e3fae2ca-94a9-416b-b577-5c90e382df57
Security or trust page: https://trust.drata.com/?itemUid=e3fae2ca-94a9-416b-b577-5c90e382df57

What to put in your subprocessor list

A ready row. Replace the purpose with what your client actually uses Safebase for.

Subprocessor	Legal entity	Country	Purpose	Transfer	DPA
Safebase	SafeBase, LLC	US	Finance	DPF	https://safebase.io/dpa

Questions people ask about Safebase

Where is Safebase's DPA?: Safebase publishes its customer data processing agreement at https://safebase.io/dpa. We last opened that link on 2 November 2026.
Is Safebase's DPA the same thing as a data processing addendum?: Yes. A data processing agreement and a data processing addendum are two names for the document Article 28 of the GDPR requires between a controller and a processor; vendors use both, and some call it processor terms. What it has to contain does not change with the name. Safebase's is at https://safebase.io/dpa.
Where is Safebase's sub-processor list?: Safebase publishes the list of its own sub-processors at https://trust.drata.com/?itemUid=e3fae2ca-94a9-416b-b577-5c90e382df57. We last opened that link on 2 November 2026.
Which legal entity does Safebase contract through?: SafeBase, LLC, registered in United States. That is the name to put in a record of processing or a sub-processor list, not the brand.
What covers a transfer of personal data to Safebase outside the EEA?: EU-US Data Privacy Framework (DPF). A US certification scheme covered by an EU adequacy decision. Transfers to a certified US organisation need no further mechanism for the certified scope. Whether that is enough for a particular processing operation is a judgement for the controller.
Where is Safebase's trust center?: Safebase publishes it at https://trust.drata.com/?itemUid=e3fae2ca-94a9-416b-b577-5c90e382df57. A trust center, trust page or security page is the same thing under different names: the vendor's own account of how it protects data, and the place it keeps its certifications. It is Safebase's page, so we link to it rather than repeat what it says.

What has changed, and when

Changes we noticed on Safebase's own pages, each with the page we saw it on. The vendor does not publish this, and neither does anyone else.

2 November 2026
Safebase added six sub-processors: Close, Asana, ClickUp, Zoom, Ramp, and GitLab. The vendor also updated its Trust Center documentation, removing references to previous certifications and partners while adding details about its AI governance policy and data processing practices.
Seen on https://trust.drata.com/?itemUid=e3fae2ca-94a9-416b-b577-5c90e382df57
1 November 2026
Three sub-processors were added to the subprocessor list: Qualified, Vercel, and Amazon Web Services. Multiple other sub-processors were removed from the list, including Abnormal Security, Asana, Instacart, ClickUp, Zoom, Ramp, Crossbeam, GitLab, Jamf, and Palantir.
Seen on https://trust.drata.com/?itemUid=e3fae2ca-94a9-416b-b577-5c90e382df57
30 October 2026
Safebase added six new subprocessors: Close, Asana, ClickUp, Zoom, Ramp, and GitLab. You need to update your subprocessor list and notify customers of these additions per your data processing agreement requirements.
Seen on https://trust.drata.com/?itemUid=e3fae2ca-94a9-416b-b577-5c90e382df57
28 October 2026
Amazon Web Services was added as a subprocessor, identified as a qualified vendor on Safebase's trust documentation. This addition should be reflected in your subprocessor list and may require updated data flow documentation if AWS processing was not previously disclosed.
Seen on https://trust.drata.com/?itemUid=e3fae2ca-94a9-416b-b577-5c90e382df57
27 October 2026
Safebase added six new subprocessors: Close, Asana, ClickUp, Zoom, Ramp, and GitLab. You should update your subprocessor list and notify customers according to your data processing agreement requirements.
Seen on https://trust.drata.com/?itemUid=e3fae2ca-94a9-416b-b577-5c90e382df57
26 October 2026
Amazon Web Services has been added as a subprocessor for Safebase, identified as a qualified vendor that hosts the company's infrastructure.
Seen on https://trust.drata.com/?itemUid=e3fae2ca-94a9-416b-b577-5c90e382df57
24 October 2026
Safebase added six subprocessors: Close, Asana, ClickUp, Zoom, Ramp, and GitLab. You should update your subprocessor list and notify affected data subjects if required by your processing agreement.
Seen on https://trust.drata.com/?itemUid=e3fae2ca-94a9-416b-b577-5c90e382df57
23 October 2026
Amazon Web Services has been added as a subprocessor for Safebase, listed as a Qualified vendor operating remotely. This addition to the subprocessor list reflects Safebase's use of AWS infrastructure and must be documented in records of processing and data processing agreements.
Seen on https://trust.drata.com/?itemUid=e3fae2ca-94a9-416b-b577-5c90e382df57
22 October 2026
Safebase added six new subprocessors: Close, Asana, ClickUp, Zoom, Ramp, and GitLab. You should update your subprocessor list and notify data subjects if your contract requires it.
Seen on https://trust.drata.com/?itemUid=e3fae2ca-94a9-416b-b577-5c90e382df57
20 October 2026
Amazon Web Services has been added as a subprocessor in Safebase's vendor documentation, which requires updating the subprocessor list in your records of processing and data processing agreements.
Seen on https://trust.drata.com/?itemUid=e3fae2ca-94a9-416b-b577-5c90e382df57
19 October 2026
Safebase added six new subprocessors: Close, Asana, ClickUp, Zoom, Ramp, and GitLab. You should update your subprocessor list and notify data subjects if required by your data processing agreement.
Seen on https://trust.drata.com/?itemUid=e3fae2ca-94a9-416b-b577-5c90e382df57
18 October 2026
Amazon Web Services was added as a subprocessor used by Safebase, and this must be reflected in any subprocessor list or data processing agreement documenting processors and subprocessors handling customer data.
Seen on https://trust.drata.com/?itemUid=e3fae2ca-94a9-416b-b577-5c90e382df57
17 October 2026
Safebase added six subprocessors: Close, Asana, ClickUp, Zoom, Ramp, and GitLab. You should update your subprocessor list and notify affected data subjects if your contract requires it.
Seen on https://trust.drata.com/?itemUid=e3fae2ca-94a9-416b-b577-5c90e382df57
14 October 2026
We recorded changes to the transfer mechanism, the UK transfer mechanism.
12 October 2026
Amazon Web Services has been added as a subprocessor to Safebase's platform.
Seen on https://trust.drata.com/?itemUid=e3fae2ca-94a9-416b-b577-5c90e382df57
11 October 2026
Safebase added six subprocessors: Close, Asana, ClickUp, Zoom, Ramp, and GitLab. You should update your subprocessor list and notify affected data subjects if required by your contract or applicable law.
Seen on https://trust.drata.com/?itemUid=e3fae2ca-94a9-416b-b577-5c90e382df57
8 October 2026
Safebase added Amazon Web Services as a subprocessor to their platform infrastructure, which means customer data may now be processed by AWS in addition to Safebase's own systems and should be reflected in your records of processing.
Seen on https://trust.drata.com/?itemUid=e3fae2ca-94a9-416b-b577-5c90e382df57

See the 5 sub-processors Safebase lists →

Building your own sub-processor list?

Enter your website: each service it loads, what it is for and links to its own DPA, in a minute or two. No sign-up.

Build my list

Worked out from the registry and what we have written: the country this vendor contracts from, the guides that answer the question this page raises, and the rest of the registry.

Other finance

Six of them. All finance in the registry · others that transfer the same way.

Subprocessor

Legal entity

Country

Purpose

Transfer

DPA

Safebase

SafeBase, LLC

Finance

DPF

https://safebase.io/dpa

Questions people ask about Safebase

Where is Safebase's DPA?

Safebase publishes its customer data processing agreement at https://safebase.io/dpa. We last opened that link on 2 November 2026.

Is Safebase's DPA the same thing as a data processing addendum?

Yes. A data processing agreement and a data processing addendum are two names for the document Article 28 of the GDPR requires between a controller and a processor; vendors use both, and some call it processor terms. What it has to contain does not change with the name. Safebase's is at https://safebase.io/dpa.

Where is Safebase's sub-processor list?

Safebase publishes the list of its own sub-processors at https://trust.drata.com/?itemUid=e3fae2ca-94a9-416b-b577-5c90e382df57. We last opened that link on 2 November 2026.

Which legal entity does Safebase contract through?

SafeBase, LLC, registered in United States. That is the name to put in a record of processing or a sub-processor list, not the brand.

What covers a transfer of personal data to Safebase outside the EEA?

EU-US Data Privacy Framework (DPF). A US certification scheme covered by an EU adequacy decision. Transfers to a certified US organisation need no further mechanism for the certified scope. Whether that is enough for a particular processing operation is a judgement for the controller.

Where is Safebase's trust center?

Safebase publishes it at https://trust.drata.com/?itemUid=e3fae2ca-94a9-416b-b577-5c90e382df57. A trust center, trust page or security page is the same thing under different names: the vendor's own account of how it protects data, and the place it keeps its certifications. It is Safebase's page, so we link to it rather than repeat what it says.

What has changed, and when

Changes we noticed on Safebase's own pages, each with the page we saw it on. The vendor does not publish this, and neither does anyone else.

2 November 2026

Safebase added six sub-processors: Close, Asana, ClickUp, Zoom, Ramp, and GitLab. The vendor also updated its Trust Center documentation, removing references to previous certifications and partners while adding details about its AI governance policy and data processing practices.

Seen on https://trust.drata.com/?itemUid=e3fae2ca-94a9-416b-b577-5c90e382df57

1 November 2026

Three sub-processors were added to the subprocessor list: Qualified, Vercel, and Amazon Web Services. Multiple other sub-processors were removed from the list, including Abnormal Security, Asana, Instacart, ClickUp, Zoom, Ramp, Crossbeam, GitLab, Jamf, and Palantir.

Seen on https://trust.drata.com/?itemUid=e3fae2ca-94a9-416b-b577-5c90e382df57

30 October 2026

Safebase added six new subprocessors: Close, Asana, ClickUp, Zoom, Ramp, and GitLab. You need to update your subprocessor list and notify customers of these additions per your data processing agreement requirements.

Seen on https://trust.drata.com/?itemUid=e3fae2ca-94a9-416b-b577-5c90e382df57

28 October 2026

Amazon Web Services was added as a subprocessor, identified as a qualified vendor on Safebase's trust documentation. This addition should be reflected in your subprocessor list and may require updated data flow documentation if AWS processing was not previously disclosed.

Seen on https://trust.drata.com/?itemUid=e3fae2ca-94a9-416b-b577-5c90e382df57

27 October 2026

Safebase added six new subprocessors: Close, Asana, ClickUp, Zoom, Ramp, and GitLab. You should update your subprocessor list and notify customers according to your data processing agreement requirements.

Seen on https://trust.drata.com/?itemUid=e3fae2ca-94a9-416b-b577-5c90e382df57

26 October 2026

Amazon Web Services has been added as a subprocessor for Safebase, identified as a qualified vendor that hosts the company's infrastructure.

Seen on https://trust.drata.com/?itemUid=e3fae2ca-94a9-416b-b577-5c90e382df57

24 October 2026

Safebase added six subprocessors: Close, Asana, ClickUp, Zoom, Ramp, and GitLab. You should update your subprocessor list and notify affected data subjects if required by your processing agreement.

Seen on https://trust.drata.com/?itemUid=e3fae2ca-94a9-416b-b577-5c90e382df57

23 October 2026

Amazon Web Services has been added as a subprocessor for Safebase, listed as a Qualified vendor operating remotely. This addition to the subprocessor list reflects Safebase's use of AWS infrastructure and must be documented in records of processing and data processing agreements.

Seen on https://trust.drata.com/?itemUid=e3fae2ca-94a9-416b-b577-5c90e382df57

22 October 2026

Safebase added six new subprocessors: Close, Asana, ClickUp, Zoom, Ramp, and GitLab. You should update your subprocessor list and notify data subjects if your contract requires it.

Seen on https://trust.drata.com/?itemUid=e3fae2ca-94a9-416b-b577-5c90e382df57

20 October 2026

Amazon Web Services has been added as a subprocessor in Safebase's vendor documentation, which requires updating the subprocessor list in your records of processing and data processing agreements.

Seen on https://trust.drata.com/?itemUid=e3fae2ca-94a9-416b-b577-5c90e382df57

19 October 2026

Safebase added six new subprocessors: Close, Asana, ClickUp, Zoom, Ramp, and GitLab. You should update your subprocessor list and notify data subjects if required by your data processing agreement.

Seen on https://trust.drata.com/?itemUid=e3fae2ca-94a9-416b-b577-5c90e382df57

18 October 2026

Amazon Web Services was added as a subprocessor used by Safebase, and this must be reflected in any subprocessor list or data processing agreement documenting processors and subprocessors handling customer data.

Seen on https://trust.drata.com/?itemUid=e3fae2ca-94a9-416b-b577-5c90e382df57

17 October 2026

Safebase added six subprocessors: Close, Asana, ClickUp, Zoom, Ramp, and GitLab. You should update your subprocessor list and notify affected data subjects if your contract requires it.

Seen on https://trust.drata.com/?itemUid=e3fae2ca-94a9-416b-b577-5c90e382df57

14 October 2026

We recorded changes to the transfer mechanism, the UK transfer mechanism.

12 October 2026

Amazon Web Services has been added as a subprocessor to Safebase's platform.

Seen on https://trust.drata.com/?itemUid=e3fae2ca-94a9-416b-b577-5c90e382df57

11 October 2026

Safebase added six subprocessors: Close, Asana, ClickUp, Zoom, Ramp, and GitLab. You should update your subprocessor list and notify affected data subjects if required by your contract or applicable law.

Seen on https://trust.drata.com/?itemUid=e3fae2ca-94a9-416b-b577-5c90e382df57

8 October 2026

Safebase added Amazon Web Services as a subprocessor to their platform infrastructure, which means customer data may now be processed by AWS in addition to Safebase's own systems and should be reflected in your records of processing.

Seen on https://trust.drata.com/?itemUid=e3fae2ca-94a9-416b-b577-5c90e382df57

Safebase: DPA, subprocessors and transfers

What to put in your subprocessor list

Questions people ask about Safebase

What has changed, and when

Building your own sub-processor list?

Where to go next

Other finance

Safebase: DPA, subprocessors and transfers

What to put in your subprocessor list

Questions people ask about Safebase

What has changed, and when

Building your own sub-processor list?

Where to go next

Other finance