Explainers
What Is Third-Party Risk Management (TPRM)? A Practical Guide
Solomon Amos · 2 Nov 2026 · 10 min read
Avala AI
GDPR evidence
Fleet Learning Infrastructure for Physical
Vendor-statedAvala AI and GDPR
Avala AI states it holds a data processing agreement. CertReports captured this on 30 Sep 2026 from its trust centre (Vanta); it is a vendor statement, not an independent confirmation.
Evidence
Vendor-statedVendor states GDPR on its trust centre
as of 30 Sep 2026 · confidence 90%VerifiedActive: EU-US Certification, SW-US Certification, UK Extension Certification
as of 2 Nov 2026 · confidence 100%- Kind
- Listing
- Issued or listed
- 3 Jul 2025
- Expires or valid through
- 23 Sep 2027
- Scope
- Avala AI, Inc. ("Avala") is an AI data infrastructure company. Customer organizations upload datasets, which our distributed workforce and AI-assisted tooling annotate and quality-check. Personal data covered by our DPF commitments is processed in four contexts. 1) Business contact data of customers and prospects. Types: name, business email address, phone number, company name and job title, billing address and payment method details. Why: to respond to enquiries, administer accounts, authenticate users, provide support, invoice and collect payment, send service, security and administrative messages, and market our services. How: submitted by the individual through our website, sales correspondence or account registration, and stored in our U.S.-hosted systems. 2) Website and application visitor data. Types: IP address, approximate location derived from it, browser and device characteristics, operating system, device identifiers, language preference, pages visited, referring URLs and other usage data collected via cookies and similar technologies. Why: to operate and secure the site and applications, measure and improve performance, detect and prevent fraud and abuse, and produce aggregated analytics. How: collected automatically when an individual uses our services. 3) Platform user and workforce contributor account data. Types: name, email address, phone number, account credentials, profile details, task and training history, performance and quality metrics, payout method details (including mobile wallet identifiers), and, where required for onboarding or compliance, date of birth and government identification details. Why: to create and secure accounts, assign and deliver annotation work and training, measure quality, calculate and remit payment, prevent fraud, and meet legal and tax obligations. How: provided by the individual at registration and onboarding, or generated by their use of the platform. 4) Personal data contained in customer-supplied datasets. Types: whatever personal data a customer's own dataset contains, which may include images, video, audio, sensor recordings or text depicting or describing individuals. Why: Avala processes this data solely as a service provider, on documented instructions from the customer, to perform the annotation, quality-control and data-processing services ordered. Avala does not use it for its own purposes and does not use personal data to train AI models; only anonymized, aggregated or de-identified derivations improve our tooling. How: uploaded by the customer or transferred from customer-designated storage into our U.S.-hosted environment, retained for the contracted period, then returned or deleted per the customer agreement. Disclosures to third parties. Avala does not sell personal data. We disclose covered personal data to service providers acting on our behalf under contracts requiring at least the same level of protection as the DPF Principles, in these categories: cloud infrastructure and hosting (Amazon Web Services); authentication and identity (Auth0, Google, Apple, GitHub); customer communication and support (Intercom); payment and workforce payout processing (Stripe, PayPal, Wise, Workpay, Apple Pay, Google Pay); analytics (Google Analytics, Mixpanel, Vercel Analytics); and error and performance monitoring (Sentry, Firebase). Personal data in customer-supplied datasets is additionally accessible to the annotation workforce contracted to perform the customer's ordered services. We may also disclose personal data to professional advisers, in connection with a merger, acquisition or sale of assets, and in response to lawful requests by public authorities, including to meet national security or law enforcement requirements. Avala remains liable under the DPF Principles where an agent processes covered personal data in a manner inconsistent with the Principles, unless we prove we are not responsible for the event giving rise to the damage.
| Source | Captured | Quote | Links |
|---|---|---|---|
Data Privacy Framework list Official registry · HTTP 200 | 2 Nov 2026 | Avala AI, Inc.: Active: EU-US Certification, SW-US Certification, UK Extension Certification | Live pagesha256 e8f9c6b70f |
Data Privacy Framework list Official registry · HTTP 200 | 17 Sep 2026 | Avala AI, Inc.: Inactive | Live pagesha256 043a112c46 |
What GDPR means, and what it does not
"GDPR compliant" is a claim, not a certification. The verifiable facts are a public DPA, SCC usage, an EU representative, data residency options and a Data Privacy Framework listing.
Read the GDPR guide and browse all vendors with evidenceQuestions buyers ask
Is Avala AI GDPR compliant?
There is no GDPR certification in general use. The verifiable facts are a public data processing agreement, standard contractual clauses, an EU representative and a Data Privacy Framework listing. See the legal artefacts and the DPF row on this page, each with its capture date.
How does CertReports verify this?
Every state carries a capture date, a source and a snapshot link. Registry rows come from the official registry data; vendor statements come from the vendor’s own page or trust centre; nothing is inferred. Vendors can dispute any row and corrections ship within two business days.
Change history
- 18 Sep 2026GDPR evidence addedA GDPR row entered the index with state Vendor-stated.
- 18 Sep 2026Subprocessor added: Amazon Web ServicesAmazon Web Services appeared on the subprocessor list.
- 18 Sep 2026Subprocessor added: Google WorkspaceGoogle Workspace appeared on the subprocessor list.
- 18 Sep 2026Subprocessor added: IntercomIntercom appeared on the subprocessor list.
Alternatives with GDPR evidence
Similar vendors (shared product tags or the DevOps and observability category) whose GDPR row is verified or vendor-stated, ranked by similarity.
Kentik Technologies
DevOps and observability
Kentik is the network intelligence platform for modern infrastructure
Sentry
DevOps and observability
Application performance monitoring for developers & software teams to see errors clearer, solve issues faster & continue learning
Cerebrum
DevOps and observability
Cerebrum delivers biometric identity verification and screening infrastructure to stop fraud, protect organizations, and streamline trust
y
DevOps and observability
AI agents powering financial infrastructure for merchants, banks, and
Centavo
DevOps and observability
Payabli delivers payment infrastructure through a single unified API, enabling software platforms to embed, manage, and scale
Understand GDPR evidence
All articlesHow-to
Vendor Security Questionnaire Questions Answered by Public Evidence
Solomon Amos · 26 Sep 2026 · 8 min read