{"@context":"https://certreports.com/llms.txt","vendor":{"slug":"clay","name":"Clay","domain":"clay.com","category":"Sales tools","one_liner":"Infrastructure to get any data, run agentic workflows, and launch GTM","trust_center_url":"https://trust.clay.com/","security_page_url":null,"url":"https://certreports.com/vendors/clay/security","last_verified_at":"2026-09-21T00:00:00.000Z","claimed":false,"verified_profile":false},"attestations":[{"framework":"soc-2","framework_name":"SOC 2","state":"vendor_stated","state_label":"Vendor-stated","sentence":"Vendor states a SOC 2 Type II report on its trust centre (Vanta) as of 21 Sep 2026.","kind":"type2","status_text":"Vendor states SOC 2 Type 2 on its trust centre","issued_at":null,"expires_at":null,"period_start":null,"period_end":null,"auditor":null,"impact_level":null,"as_of":"2026-09-21","under_review":false,"source":"vanta","url":"https://certreports.com/vendors/clay/soc-2","evidence":[{"source_type":"trust_center","source_name":"Clay trust centre (Vanta)","url":"https://trust.clay.com/","fetched_at":"2026-09-21 22:56:48.549193+00","content_hash":"d779edcaac2bf39f71f9c635b75d91f969dd62c2ade3f438fada9309cf71c91f","wayback_url":null,"quote":"SOC 2 Type 2","confidence":1},{"source_type":"trust_center","source_name":"Clay trust centre (Vanta)","url":"https://trust.clay.com/","fetched_at":"2026-09-19 07:33:31.814577+00","content_hash":"2866d244999097ca2252952326ebb44d883fc98da5bb6882db8b6760cf51b0f0","wayback_url":null,"quote":"SOC 2 Type 2","confidence":1}]},{"framework":"gdpr","framework_name":"GDPR","state":"vendor_stated","state_label":"Vendor-stated","sentence":"Vendor states a data processing agreement on its trust centre (Vanta) as of 21 Sep 2026.","kind":null,"status_text":"Vendor states GDPR on its trust centre","issued_at":null,"expires_at":null,"period_start":null,"period_end":null,"auditor":null,"impact_level":null,"as_of":"2026-09-21","under_review":false,"source":"vanta","url":"https://certreports.com/vendors/clay/gdpr","evidence":[{"source_type":"trust_center","source_name":"Clay trust centre (Vanta)","url":"https://trust.clay.com/","fetched_at":"2026-09-21 22:56:48.549193+00","content_hash":"d779edcaac2bf39f71f9c635b75d91f969dd62c2ade3f438fada9309cf71c91f","wayback_url":null,"quote":"GDPR","confidence":1},{"source_type":"trust_center","source_name":"Clay trust centre (Vanta)","url":"https://trust.clay.com/","fetched_at":"2026-09-19 07:33:31.814577+00","content_hash":"2866d244999097ca2252952326ebb44d883fc98da5bb6882db8b6760cf51b0f0","wayback_url":null,"quote":"GDPR","confidence":1}]},{"framework":"iso-27001","framework_name":"ISO/IEC 27001","state":"vendor_stated","state_label":"Vendor-stated","sentence":"Vendor states an ISO/IEC 27001 certificate on its trust centre (Vanta) as of 21 Sep 2026.","kind":null,"status_text":"Vendor states ISO 27001:2022 on its trust centre","issued_at":null,"expires_at":null,"period_start":null,"period_end":null,"auditor":null,"impact_level":null,"as_of":"2026-09-21","under_review":false,"source":"vanta","url":"https://certreports.com/vendors/clay/iso-27001","evidence":[{"source_type":"trust_center","source_name":"Clay trust centre (Vanta)","url":"https://trust.clay.com/","fetched_at":"2026-09-21 22:56:48.549193+00","content_hash":"d779edcaac2bf39f71f9c635b75d91f969dd62c2ade3f438fada9309cf71c91f","wayback_url":null,"quote":"ISO 27001:2022","confidence":1},{"source_type":"trust_center","source_name":"Clay trust centre (Vanta)","url":"https://trust.clay.com/","fetched_at":"2026-09-19 07:33:31.814577+00","content_hash":"2866d244999097ca2252952326ebb44d883fc98da5bb6882db8b6760cf51b0f0","wayback_url":null,"quote":"ISO 27001:2022","confidence":1}]},{"framework":"iso-42001","framework_name":"ISO/IEC 42001","state":"vendor_stated","state_label":"Vendor-stated","sentence":"Vendor states an ISO/IEC 42001 certificate on its trust centre (Vanta) as of 21 Sep 2026.","kind":null,"status_text":"Vendor states ISO 42001:2023 on its trust centre","issued_at":null,"expires_at":null,"period_start":null,"period_end":null,"auditor":null,"impact_level":null,"as_of":"2026-09-21","under_review":false,"source":"vanta","url":"https://certreports.com/vendors/clay/iso-42001","evidence":[{"source_type":"trust_center","source_name":"Clay trust centre (Vanta)","url":"https://trust.clay.com/","fetched_at":"2026-09-21 22:56:48.549193+00","content_hash":"d779edcaac2bf39f71f9c635b75d91f969dd62c2ade3f438fada9309cf71c91f","wayback_url":null,"quote":"ISO 42001:2023","confidence":1},{"source_type":"trust_center","source_name":"Clay trust centre (Vanta)","url":"https://trust.clay.com/","fetched_at":"2026-09-19 07:33:31.814577+00","content_hash":"2866d244999097ca2252952326ebb44d883fc98da5bb6882db8b6760cf51b0f0","wayback_url":null,"quote":"ISO 42001:2023","confidence":1}]},{"framework":"ccpa","framework_name":"CCPA / CPRA","state":"vendor_stated","state_label":"Vendor-stated","sentence":"Vendor states an CCPA / CPRA privacy notice on its trust centre (Vanta) as of 21 Sep 2026.","kind":null,"status_text":"Vendor states CCPA on its trust centre","issued_at":null,"expires_at":null,"period_start":null,"period_end":null,"auditor":null,"impact_level":null,"as_of":"2026-09-21","under_review":false,"source":"vanta","url":"https://certreports.com/vendors/clay/security","evidence":[{"source_type":"trust_center","source_name":"Clay trust centre (Vanta)","url":"https://trust.clay.com/","fetched_at":"2026-09-21 22:56:48.549193+00","content_hash":"d779edcaac2bf39f71f9c635b75d91f969dd62c2ade3f438fada9309cf71c91f","wayback_url":null,"quote":"CCPA","confidence":1},{"source_type":"trust_center","source_name":"Clay trust centre (Vanta)","url":"https://trust.clay.com/","fetched_at":"2026-09-19 07:33:31.814577+00","content_hash":"2866d244999097ca2252952326ebb44d883fc98da5bb6882db8b6760cf51b0f0","wayback_url":null,"quote":"CCPA","confidence":1}]}],"brief":{"summary":"According to Clay's trust centre, as of 19 Sep 2026, the company has a SOC 2 Type II report on file. Clay's trust centre also states, as of 19 Sep 2026, that the company meets GDPR requirements. As of 19 Sep 2026, Clay states on its trust centre that it holds ISO/IEC 27001:2022. Clay states on its trust centre, as of 19 Sep 2026, that it holds ISO/IEC 42001:2023. Clay's trust centre further states, as of 19 Sep 2026, that the company meets CCPA/CPRA requirements.","bullets":["SOC 2 Type II report: vendor states on trust centre, as of 19 Sep 2026","ISO/IEC 27001:2022 and ISO/IEC 42001:2023: vendor states on trust centre, as of 19 Sep 2026","GDPR and CCPA/CPRA: vendor states on trust centre, as of 19 Sep 2026"],"model":"claude-sonnet-5 (subscription)","generated_at":"2026-09-19 10:38:09.911487+00"},"legal_docs":[{"kind":"subprocessors","url":"https://trust.clay.com/","availability":"public","detail":"34 subprocessors listed on the trust centre","as_of":"2026-09-21"},{"kind":"privacy","url":"https://privacy.clay.com","availability":"public","detail":null,"as_of":"2026-09-21"},{"kind":"dpa","url":"https://trust.clay.com/","availability":"on_request","detail":"Listed on the trust centre as \"Data Processing Agreement\"","as_of":"2026-09-21"}],"documents":[{"type":"bridge_letter","title":"SOC 2 Bridge Letter - September 2026","availability":"on_request","source_url":"https://trust.clay.com/","last_seen":"2026-09-21"},{"type":"dpa","title":"Data Processing Agreement","availability":"on_request","source_url":"https://trust.clay.com/","last_seen":"2026-09-21"},{"type":"iso_certificate","title":"ISO 27001 Certificate","availability":"on_request","source_url":"https://trust.clay.com/","last_seen":"2026-09-21"},{"type":"iso_certificate","title":"ISO 42001 Certificate","availability":"on_request","source_url":"https://trust.clay.com/","last_seen":"2026-09-21"},{"type":"pentest_report","title":"Network Penetration Test Report","availability":"on_request","source_url":"https://trust.clay.com/","last_seen":"2026-09-21"},{"type":"pentest_report","title":"Web Penetration Test Report","availability":"on_request","source_url":"https://trust.clay.com/","last_seen":"2026-09-21"},{"type":"soc2_report","title":"SOC 2 Type 2 Report","availability":"on_request","source_url":"https://trust.clay.com/","last_seen":"2026-09-21"}],"statements":[{"topic":"data_location","question":"Where does Clay get its data?","answer":"Clay provides its users with data from three types of sources. Integration partners. Clay provides its customers with tools that enable them to connect with more than seventy third-party data providers and obtain data directly from them. Websites. Clay’s HTTP API tool allows Clay’s customers to download data from public websites. Proprietary Data. Clay maintains proprietary databases containing data it has acquired from third parties.","value":null,"regions":[],"source_url":"https://trust.clay.com/faq?s=xetu0yb9ndfavya823y6uo","as_of":"2026-09-21"},{"topic":"data_location","question":"Where do your third-party data providers get their data?","answer":"We work with more than seventy integration partners who use industry-standard practices to collect lead data from a wide array of sources. Some sources are public. Others may be private or proprietary. For specific questions, we would invite you to reach out to the data provider directly. You can find a list of our data providers here - https://docs.google.com/document/d/1hl1q4iyTt0SVSmwKqBOozbAq4 A9UcoAN7t6Ob4yYzA/edit).","value":null,"regions":[],"source_url":"https://trust.clay.com/faq?s=54job8cibm9zpdafj87oo","as_of":"2026-09-21"},{"topic":"data_location","question":"Where can Clay consumers exercise their data rights?","answer":"Our Privacy Policy contains specific information on consumers’ data rights and how to exercise them. https://privacy.clay.com/policies","value":null,"regions":[],"source_url":"https://trust.clay.com/faq?s=v5d301nrljzkqd7ahihecw","as_of":"2026-09-21"},{"topic":"data_location","question":"Can clients define the legal jurisdictions where their data can be transmitted, processed or stored? Please provide details?","answer":"Clay and its subprocessors process customer data in the United States. Clay does not currently offer alternative processing locations. For more information please see our Privacy Policy (https://privacy.clay.com/policies).","value":null,"regions":["US"],"source_url":"https://trust.clay.com/faq?s=7sq71cwh94k7iylkwnhmu","as_of":"2026-09-21"},{"topic":"data_location","question":"Please provide the full list of where (countries) you and the subprocessors process customer data.","answer":"Clay and its subprocessors process customer data in the United States. You can find a complete list of Clay’s subprocessors here https://docs.google.com/document/d/1hl1q4iyTt0SVSmwKqBOozbAq4 A9UcoAN7t6Ob4yYzA/edit. For more information please see our Privacy Policy (https://privacy.clay.com/policies).","value":null,"regions":["US"],"source_url":"https://trust.clay.com/faq?s=y1epwwp9dz4lzsfmm0fw2","as_of":"2026-09-21"},{"topic":"data_location","question":"Where can Clay customers exercise their data subject rights?","answer":"Please review our Privacy Policy (https://privacy.clay.com/policies) for information on how data subjects can exercise their rights under the GDPR.","value":null,"regions":[],"source_url":"https://trust.clay.com/faq?s=v1e9vt8ddw2npeskfuelw9","as_of":"2026-09-21"},{"topic":"data_transfers","question":"In case you or your subprocessors process personal data in third countries, what legal ground do you use to transfer the personal data to the third countries?","answer":"Clay and its subprocessors process customer data in the United States. You can find a complete list of Clay’s subprocessors here (https://docs.google.com/document/d/1hl1q4iyTt0SVSmwKqBOozbAq4 A9UcoAN7t6Ob4yYzA/edit). Insofar as Clay is required to legitimize data transfers pursuant to the GDPR, it does so using Standard Contractual Clauses.","value":null,"regions":["US"],"source_url":"https://trust.clay.com/faq?s=czlyxrmuxxwyjyk7yb772v","as_of":"2026-09-21"},{"topic":"data_transfers","question":"Does Clay transfer data from the EU to other countries?","answer":"Clay does not maintain a presence in Europe and therefore does not transfer data from Europe to other countries.","value":null,"regions":["EU"],"source_url":"https://trust.clay.com/faq?s=ckl77u4ql2ssekf98nml3b","as_of":"2026-09-21"},{"topic":"model_training","question":"Can we opt-out of having our data used for AI training?","answer":"If Clay were to decide at some future date to make customer tables available for AI training, it would provide a mechanism for customers to opt out.","value":null,"regions":[],"source_url":"https://trust.clay.com/faq?s=bn53hjjgvmjgpe61eq10o","as_of":"2026-09-21"},{"topic":"model_training","question":"Will Clay use our data for any AI training purposes?","answer":"No. Clay does not make customer tables available to third parties.","value":"no","regions":[],"source_url":"https://trust.clay.com/faq?s=o70mj513rk6lh3oqec9aaq","as_of":"2026-09-21"}],"security_profile":{"iso42001":true,"trains_on_customer_data":"no","data_residency_regions":["US"],"pen_test_cadence":"report available","as_of":"2026-09-21"},"regulations_url":"https://certreports.com/api/v1/vendors/clay/regulations/{regulation}","subprocessors":[{"name":"Amazon Web Services","domain":"amazon.com","purpose":"Cloud provider","location":"USA","vendor_url":"https://certreports.com/vendors/amazon/security"},{"name":"Amplitude","domain":"amplitude.com","purpose":"Data analytics","location":"USA","vendor_url":"https://certreports.com/vendors/amplitude/security"},{"name":"Anthropic","domain":"anthropic.com","purpose":"LLM provider/hosting","location":"USA","vendor_url":"https://certreports.com/vendors/anthropic/security"},{"name":"Braintrust","domain":"braintrust.dev","purpose":"LLM Operations","location":"USA","vendor_url":null},{"name":"Browserbase","domain":"browserbase.com","purpose":"LLM Operations","location":"USA","vendor_url":null},{"name":"ClickHouse","domain":"clickhouse.com","purpose":"Database","location":"USA","vendor_url":null},{"name":"Cohere","domain":"cohere.com","purpose":"LLM operations","location":"Canada","vendor_url":"https://certreports.com/vendors/cohere/security"},{"name":"Cube Dev","domain":"cube.dev","purpose":"Data analytics","location":"USA","vendor_url":null},{"name":"Datadog","domain":"datadoghq.com","purpose":"APM and security","location":"USA","vendor_url":"https://certreports.com/vendors/datadog/security"},{"name":"Fireworks","domain":"fireworks.ai","purpose":"LLM provider/hosting","location":"USA","vendor_url":"https://certreports.com/vendors/fireworks-ai/security"},{"name":"Fivetran","domain":"fivetran.com","purpose":"Data ETL","location":"USA","vendor_url":"https://certreports.com/vendors/fivetran/security"},{"name":"Google Gemini","domain":"google.com","purpose":"LLM provider/hosting","location":"USA","vendor_url":"https://certreports.com/vendors/google/security"},{"name":"Grafana","domain":"grafana.com","purpose":"Logging and metrics","location":"USA","vendor_url":"https://certreports.com/vendors/grafana-labs/security"},{"name":"Intercom","domain":"intercom.com","purpose":"Customer support","location":"USA","vendor_url":"https://certreports.com/vendors/intercom/security"},{"name":"Langsmith","domain":"langchain.com","purpose":"LLM logging and tracing","location":"USA","vendor_url":"https://certreports.com/vendors/langchain/security"},{"name":"Mezmo","domain":"mezmo.com","purpose":"Logging and metrics","location":"USA","vendor_url":"https://certreports.com/vendors/mezmo/security"},{"name":"Mistral","domain":"mistral.ai","purpose":"LLM provider/hosting","location":"France","vendor_url":"https://certreports.com/vendors/mistral-ai/security"},{"name":"OpenAI","domain":"openai.com","purpose":"LLM provider/hosting","location":"USA","vendor_url":"https://certreports.com/vendors/openai/security"},{"name":"Parallel Web Systems","domain":"parallel.ai","purpose":"LLM operations","location":"USA","vendor_url":null},{"name":"Planetscale","domain":"planetscale.com","purpose":null,"location":"USA","vendor_url":"https://certreports.com/vendors/planetscale/security"},{"name":"Postmark","domain":"postmarkapp.com","purpose":"Email service provider","location":"USA","vendor_url":"https://certreports.com/vendors/postmark/security"},{"name":"Raindrop.ai","domain":"raindrop.ai","purpose":"LLM operations","location":"USA","vendor_url":"https://certreports.com/vendors/raindrop/security"},{"name":"Segment","domain":"segment.com","purpose":"Data analytics","location":"USA","vendor_url":"https://certreports.com/vendors/segment/security"},{"name":"Sentry","domain":"sentry.io","purpose":"Error logging","location":"USA","vendor_url":"https://certreports.com/vendors/sentry/security"},{"name":"SerpApi","domain":"serpapi.com","purpose":"LLM operations","location":"USA","vendor_url":null},{"name":"Serper","domain":"serper.dev","purpose":"LLM operations","location":"USA","vendor_url":null},{"name":"Slack","domain":"slack.com","purpose":"Customer Support","location":"USA","vendor_url":"https://certreports.com/vendors/slack-technologies/security"},{"name":"Smartlead","domain":"smartlead.ai","purpose":"Email sequencer","location":"USA","vendor_url":null},{"name":"Snowflake","domain":"snowflake.com","purpose":"Data analytics","location":"USA","vendor_url":"https://certreports.com/vendors/snowflake/security"},{"name":"Turbopuffer","domain":"turbopuffer.com","purpose":"Vector Database","location":"USA","vendor_url":null},{"name":"Verisoul","domain":"verisoul.ai","purpose":"Fraud Detection","location":"USA","vendor_url":null},{"name":"WorkOS","domain":"workos.com","purpose":"Authentication support","location":"USA","vendor_url":null},{"name":"Zapier","domain":"zapier.com","purpose":"Data imports","location":"USA","vendor_url":"https://certreports.com/vendors/zapier/security"},{"name":"Zenrows","domain":"zenrows.com","purpose":"LLM operations","location":"Spain","vendor_url":null}],"disclaimer":"CertReports indexes public evidence. A missing framework means no public evidence was found at the last check, not that the vendor is non-compliant. SOC 2 is a report, not a certification; HIPAA has no certification.","generated_at":"2026-11-03T18:56:11.494Z"}