Skip to main content
Clay logo

Clay

Regulatory evidence

Infrastructure to get any data, run agentic workflows, and launch GTM

clay.comSales toolsLast verified 21 Sep 2026

Clay against third-party requirements

For each regulation, how many of the requirements it places on your vendors Clay’s public evidence reaches. Open one for every item with its date and source.

Documents on the trust centre

What the vendor lists, typed; public items can be read now, the rest are available on request.

7 documents listed on Clay’s trust centre

trust.clay.com
  • SOC 2 bridge letter
    • SOC 2 Bridge Letter - September 2026on request · seen 21 Sep 2026
  • Data processing agreement
    • Data Processing Agreementon request · seen 21 Sep 2026
  • ISO certificate
    • ISO 27001 Certificateon request · seen 21 Sep 2026
    • ISO 42001 Certificateon request · seen 21 Sep 2026
  • Penetration test report
    • Network Penetration Test Reporton request · seen 21 Sep 2026
    • Web Penetration Test Reporton request · seen 21 Sep 2026
  • SOC 2 report
    • SOC 2 Type 2 Reporton request · seen 21 Sep 2026

What the vendor says

Answers the vendor publishes to questions buyers ask, quoted with the link to where it says so.

  • Where data is hosted or processed

    Where does Clay get its data?

    Clay provides its users with data from three types of sources. Integration partners. Clay provides its customers with tools that enable them to connect with more than seventy third-party data providers and obtain data directly from them. Websites. Clay’s HTTP API tool allows Clay’s customers to download data from public websites. Proprietary Data. Clay maintains proprietary databases containing data it has acquire...

    as of 21 Sep 2026Source

  • Where data is hosted or processed

    Where do your third-party data providers get their data?

    We work with more than seventy integration partners who use industry-standard practices to collect lead data from a wide array of sources. Some sources are public. Others may be private or proprietary. For specific questions, we would invite you to reach out to the data provider directly. You can find a list of our data providers here - https://docs.google.com/document/d/1hl1q4iyTt0SVSmwKqBOozbAq4 A9UcoAN7t6Ob4yYz...

    as of 21 Sep 2026Source

  • Where data is hosted or processed

    Where can Clay consumers exercise their data rights?

    Our Privacy Policy contains specific information on consumers’ data rights and how to exercise them. https://privacy.clay.com/policies

    as of 21 Sep 2026Source

  • Where data is hosted or processed

    Can clients define the legal jurisdictions where their data can be transmitted, processed or stored? Please provide details?

    Clay and its subprocessors process customer data in the United States. Clay does not currently offer alternative processing locations. For more information please see our Privacy Policy (https://privacy.clay.com/policies).

    Regions named: USas of 21 Sep 2026Source

  • Where data is hosted or processed

    Please provide the full list of where (countries) you and the subprocessors process customer data.

    Clay and its subprocessors process customer data in the United States. You can find a complete list of Clay’s subprocessors here https://docs.google.com/document/d/1hl1q4iyTt0SVSmwKqBOozbAq4 A9UcoAN7t6Ob4yYzA/edit. For more information please see our Privacy Policy (https://privacy.clay.com/policies).

    Regions named: USas of 21 Sep 2026Source

  • Where data is hosted or processed

    Where can Clay customers exercise their data subject rights?

    Please review our Privacy Policy (https://privacy.clay.com/policies) for information on how data subjects can exercise their rights under the GDPR.

    as of 21 Sep 2026Source

  • International data transfers

    In case you or your subprocessors process personal data in third countries, what legal ground do you use to transfer the personal data to the third countries?

    Clay and its subprocessors process customer data in the United States. You can find a complete list of Clay’s subprocessors here (https://docs.google.com/document/d/1hl1q4iyTt0SVSmwKqBOozbAq4 A9UcoAN7t6Ob4yYzA/edit). Insofar as Clay is required to legitimize data transfers pursuant to the GDPR, it does so using Standard Contractual Clauses.

    Regions named: USas of 21 Sep 2026Source

  • International data transfers

    Does Clay transfer data from the EU to other countries?

    Clay does not maintain a presence in Europe and therefore does not transfer data from Europe to other countries.

    Regions named: EUas of 21 Sep 2026Source

  • Use of customer data to train models

    Can we opt-out of having our data used for AI training?

    If Clay were to decide at some future date to make customer tables available for AI training, it would provide a mechanism for customers to opt out.

    as of 21 Sep 2026Source

  • Use of customer data to train models

    Will Clay use our data for any AI training purposes?

    No. Clay does not make customer tables available to third parties.

    as of 21 Sep 2026Source

All articles

This maps third-party obligations to the vendor evidence that may support them. It is not legal advice and never a statement that a vendor or its customers comply; confirm scope and sufficiency with your counsel or auditor. “No public evidence” means nothing public was found at the last check. Citations link to the official text.