Explainers
What Is Third-Party Risk Management (TPRM)? A Practical Guide
Solomon Amos · 2 Nov 2026 · 10 min read
Cerebrum
GDPR evidence
Cerebrum delivers biometric identity verification and screening infrastructure to stop fraud, protect organizations, and streamline trust
Vendor-statedCerebrum and GDPR
Cerebrum states it holds a data processing agreement. CertReports captured this on 30 Sep 2026 from its trust centre (Vanta); it is a vendor statement, not an independent confirmation.
Evidence
Vendor-statedVendor states GDPR on its trust centre
as of 30 Sep 2026 · confidence 90%VerifiedActive: EU-US Certification, SW-US Certification, UK Extension Certification
as of 2 Nov 2026 · confidence 100%- Kind
- Listing
- Issued or listed
- 23 Jan 2026
- Expires or valid through
- 23 Jan 2027
- Scope
- Cerebrum processes personal data under the EU-U.S. Data Privacy Framework (DPF) to provide identity verification, credential validation, and compliance automation services for enterprise and reseller clients. The data originates from organizations and their applicants, employees, or contractors whose identities must be verified for regulatory or background-screening purposes. The categories of data processed include identification and contact details (name, email, phone, date of birth, address), government-issued identifiers and ID document images, biometric and liveness data (facial geometry or motion data processed ephemerally for identity verification), employment and credential information, device and usage metadata, and account or transaction logs. Cerebrum uses this data to (1) authenticate individuals and prevent fraud; (2) fulfill contractual obligations to client organizations and their resellers; (3) maintain audit trails for compliance with applicable laws (such as FCRA and AML/KYC regulations); (4) improve the accuracy and reliability of its verification models; and (5) provide customer support, system security, and fraud-detection analytics. Personal data may be disclosed to third parties solely as necessary to perform these functions: • Resellers / Consumer Reporting Agencies who act as controllers of user data and determine verification criteria. • Service vendors and subprocessors providing secure hosting, email delivery, or customer-support infrastructure. • Legal and regulatory authorities when required by law or to protect rights, safety, or prevent fraud. • Corporate affiliates under common control for centralized operations and compliance management. Cerebrum ensures onward transfers comply with the DPF Principles and limits recipients’ use of data to the intended purpose. When transferring personal data from the EU, UK, or Switzerland to the United States, Cerebrum relies on its certification to the respective DPF frameworks and commits to resolve complaints through VeraSafe as its independent recourse mechanism. EU, UK, and Swiss individuals may contact VeraSafe or Cerebrum directly to exercise their rights of access, correction, or deletion. Cerebrum does not sell personal data and processes sensitive data (such as biometrics) only as instructed by the relevant controller or with the individual’s explicit consent.
| Source | Captured | Quote | Links |
|---|---|---|---|
Data Privacy Framework list Official registry · HTTP 200 | 2 Nov 2026 | Cerebrum: Active: EU-US Certification, SW-US Certification, UK Extension Certification | Live pagesha256 cfa170ed4e |
What GDPR means, and what it does not
"GDPR compliant" is a claim, not a certification. The verifiable facts are a public DPA, SCC usage, an EU representative, data residency options and a Data Privacy Framework listing.
Read the GDPR guide and browse all vendors with evidenceQuestions buyers ask
Is Cerebrum GDPR compliant?
There is no GDPR certification in general use. The verifiable facts are a public data processing agreement, standard contractual clauses, an EU representative and a Data Privacy Framework listing. See the legal artefacts and the DPF row on this page, each with its capture date.
How does CertReports verify this?
Every state carries a capture date, a source and a snapshot link. Registry rows come from the official registry data; vendor statements come from the vendor’s own page or trust centre; nothing is inferred. Vendors can dispute any row and corrections ship within two business days.
Change history
- 18 Sep 2026GDPR evidence addedA GDPR row entered the index with state Vendor-stated.
- 18 Sep 2026Subprocessor added: 1Password1Password appeared on the subprocessor list.
- 18 Sep 2026Subprocessor added: Amazon Web ServicesAmazon Web Services appeared on the subprocessor list.
- 18 Sep 2026Subprocessor added: Google Cloud PlatformGoogle Cloud Platform appeared on the subprocessor list.
- 18 Sep 2026Subprocessor added: Google WorkspaceGoogle Workspace appeared on the subprocessor list.
- 18 Sep 2026Subprocessor added: Grafana CloudGrafana Cloud appeared on the subprocessor list.
- 18 Sep 2026Subprocessor added: PhoenixNAPPhoenixNAP appeared on the subprocessor list.
Alternatives with GDPR evidence
Similar vendors (shared product tags or the DevOps and observability category) whose GDPR row is verified or vendor-stated, ranked by similarity.
Veriff
AI tools
Veriff is a global AI-native identity platform building trust online
jwplayer
DevOps and observability
JWX helps streamers, publishers, and advertisers create, deliver, and monetize video with one intelligent workflow - built for speed
Kentik Technologies
DevOps and observability
Kentik is the network intelligence platform for modern infrastructure
y
DevOps and observability
AI agents powering financial infrastructure for merchants, banks, and
Avala AI
DevOps and observability
Fleet Learning Infrastructure for Physical
NetScout Systems
DevOps and observability
Drive observability, cybersecurity, DDoS protection, and AIOps initiatives with NETSCOUT's AI-ready data
Centavo
DevOps and observability
Payabli delivers payment infrastructure through a single unified API, enabling software platforms to embed, manage, and scale
Understand GDPR evidence
All articlesHow-to
Vendor Security Questionnaire Questions Answered by Public Evidence
Solomon Amos · 26 Sep 2026 · 8 min read