strongDM: DPA, subprocessors and transfers

Links last opened 30 October 2026. Record confirmed by a person on 27 October 2026. 3 recorded changes, listed below.

strongDM contracts through StrongDM, Inc., registered in United States. Its trust center is published at https://security.strongdm.com/. Its customer data processing agreement, also called a data processing addendum, is published by strongDM itself; the link is below. Its sub-processor list is published by strongDM itself; the link is below. We open those pages every day — last on 30 October 2026 — and a person last went through this record on 27 October 2026.

Contracting legal entity: StrongDM, Inc.
Country of registration: United States
Data processing agreement: https://www.strongdm.com/legal/data-processing-agreement
Subprocessor list: https://security.strongdm.com/?itemUid=e3fae2ca-94a9-416b-b577-5c90e382df57
Security or trust page: https://security.strongdm.com/

What to put in your subprocessor list

A ready row. Replace the purpose with what your client actually uses strongDM for.

Subprocessor	Legal entity	Country	Purpose	Transfer	DPA
strongDM	StrongDM, Inc.	US	Hosting and infrastructure	—	https://www.strongdm.com/legal/data-processing-agreement

Questions people ask about strongDM

Where is strongDM's DPA?: strongDM publishes its customer data processing agreement at https://www.strongdm.com/legal/data-processing-agreement. We last opened that link on 30 October 2026.
Is strongDM's DPA the same thing as a data processing addendum?: Yes. A data processing agreement and a data processing addendum are two names for the document Article 28 of the GDPR requires between a controller and a processor; vendors use both, and some call it processor terms. What it has to contain does not change with the name. strongDM's is at https://www.strongdm.com/legal/data-processing-agreement.
Where is strongDM's sub-processor list?: strongDM publishes the list of its own sub-processors at https://security.strongdm.com/?itemUid=e3fae2ca-94a9-416b-b577-5c90e382df57. We last opened that link on 30 October 2026.
Which legal entity does strongDM contract through?: StrongDM, Inc., registered in United States. That is the name to put in a record of processing or a sub-processor list, not the brand.
Where is strongDM's trust center?: strongDM publishes it at https://security.strongdm.com/. A trust center, trust page or security page is the same thing under different names: the vendor's own account of how it protects data, and the place it keeps its certifications. It is strongDM's page, so we link to it rather than repeat what it says.

What has changed, and when

Changes we noticed on strongDM's own pages, each with the page we saw it on. The vendor does not publish this, and neither does anyone else.

30 October 2026
StrongDM added seven subprocessors to its list: Klue, Anthropic, Anthropic PBC, OpenAI, Cerebras Systems, Groq, and PostHog. Six of these (Anthropic PBC, OpenAI, Cerebras Systems, Groq, and Google) process customer data for Large-Language Model services in Beta opt-in features, while PostHog handles platform and client analytics, all located in the United States or Europe with data processing agreements in place.
Seen on https://security.strongdm.com/?itemUid=e3fae2ca-94a9-416b-b577-5c90e382df57
29 October 2026
strongDM's DPA now references adequacy decisions as a transfer mechanism, meaning data can be transferred to countries the EU, UK, or Switzerland recognize as providing adequate data protection without requiring standard contractual clauses. The vendor changed from strongDM Inc. to Delinea Inc. and substantially restructured the DPA document, adding specific definitions for UK GDPR, EU GDPR, and Swiss Data Protection Law compliance mechanisms.
Seen on https://www.strongdm.com/legal/data-processing-agreement
29 October 2026
The contracting legal entity changed from StrongDM, Inc. to Delinea Inc., which affects the vendor identity listed in your subprocessor records and data processing agreement.
Seen on https://www.strongdm.com/legal/data-processing-agreement

See the 7 sub-processors strongDM lists →

Building your own sub-processor list?

Enter your website: each service it loads, what it is for and links to its own DPA, in a minute or two. No sign-up.

Build my list

Worked out from the registry and what we have written: the country this vendor contracts from, the guides that answer the question this page raises, and the rest of the registry.

Other hosting and infrastructure

Six of them. All hosting and infrastructure in the registry.

Subprocessor

Legal entity

Country

Purpose

Transfer

DPA

strongDM

StrongDM, Inc.

Hosting and infrastructure

—

https://www.strongdm.com/legal/data-processing-agreement

Questions people ask about strongDM

Where is strongDM's DPA?

strongDM publishes its customer data processing agreement at https://www.strongdm.com/legal/data-processing-agreement. We last opened that link on 30 October 2026.

Is strongDM's DPA the same thing as a data processing addendum?

Yes. A data processing agreement and a data processing addendum are two names for the document Article 28 of the GDPR requires between a controller and a processor; vendors use both, and some call it processor terms. What it has to contain does not change with the name. strongDM's is at https://www.strongdm.com/legal/data-processing-agreement.

Where is strongDM's sub-processor list?

strongDM publishes the list of its own sub-processors at https://security.strongdm.com/?itemUid=e3fae2ca-94a9-416b-b577-5c90e382df57. We last opened that link on 30 October 2026.

Which legal entity does strongDM contract through?

StrongDM, Inc., registered in United States. That is the name to put in a record of processing or a sub-processor list, not the brand.

Where is strongDM's trust center?

strongDM publishes it at https://security.strongdm.com/. A trust center, trust page or security page is the same thing under different names: the vendor's own account of how it protects data, and the place it keeps its certifications. It is strongDM's page, so we link to it rather than repeat what it says.

What has changed, and when

Changes we noticed on strongDM's own pages, each with the page we saw it on. The vendor does not publish this, and neither does anyone else.

30 October 2026

StrongDM added seven subprocessors to its list: Klue, Anthropic, Anthropic PBC, OpenAI, Cerebras Systems, Groq, and PostHog. Six of these (Anthropic PBC, OpenAI, Cerebras Systems, Groq, and Google) process customer data for Large-Language Model services in Beta opt-in features, while PostHog handles platform and client analytics, all located in the United States or Europe with data processing agreements in place.

Seen on https://security.strongdm.com/?itemUid=e3fae2ca-94a9-416b-b577-5c90e382df57

29 October 2026

strongDM's DPA now references adequacy decisions as a transfer mechanism, meaning data can be transferred to countries the EU, UK, or Switzerland recognize as providing adequate data protection without requiring standard contractual clauses. The vendor changed from strongDM Inc. to Delinea Inc. and substantially restructured the DPA document, adding specific definitions for UK GDPR, EU GDPR, and Swiss Data Protection Law compliance mechanisms.

Seen on https://www.strongdm.com/legal/data-processing-agreement

29 October 2026

The contracting legal entity changed from StrongDM, Inc. to Delinea Inc., which affects the vendor identity listed in your subprocessor records and data processing agreement.

Seen on https://www.strongdm.com/legal/data-processing-agreement

strongDM: DPA, subprocessors and transfers

What to put in your subprocessor list

Questions people ask about strongDM

What has changed, and when

Building your own sub-processor list?

Where to go next

Other hosting and infrastructure

strongDM: DPA, subprocessors and transfers

What to put in your subprocessor list

Questions people ask about strongDM

What has changed, and when

Building your own sub-processor list?

Where to go next

Other hosting and infrastructure