The EU-US Data Privacy Framework, explained for vendor reviews
Solomon Amos · 7 Sep 2026 · 10 min read
Regulatory evidence
Infrastructure to get any data, run agentic workflows, and launch GTM
For each regulation, how many of the requirements it places on your vendors Clay’s public evidence reaches. Open one for every item with its date and source.
What the vendor lists, typed; public items can be read now, the rest are available on request.
7 documents listed on Clay’s trust centre
trust.clay.comAnswers the vendor publishes to questions buyers ask, quoted with the link to where it says so.
Where data is hosted or processed
Where does Clay get its data?
“Clay provides its users with data from three types of sources. Integration partners. Clay provides its customers with tools that enable them to connect with more than seventy third-party data providers and obtain data directly from them. Websites. Clay’s HTTP API tool allows Clay’s customers to download data from public websites. Proprietary Data. Clay maintains proprietary databases containing data it has acquire...”
as of 21 Sep 2026Source
Where data is hosted or processed
Where do your third-party data providers get their data?
“We work with more than seventy integration partners who use industry-standard practices to collect lead data from a wide array of sources. Some sources are public. Others may be private or proprietary. For specific questions, we would invite you to reach out to the data provider directly. You can find a list of our data providers here - https://docs.google.com/document/d/1hl1q4iyTt0SVSmwKqBOozbAq4 A9UcoAN7t6Ob4yYz...”
as of 21 Sep 2026Source
Where data is hosted or processed
Where can Clay consumers exercise their data rights?
“Our Privacy Policy contains specific information on consumers’ data rights and how to exercise them. https://privacy.clay.com/policies”
as of 21 Sep 2026Source
Where data is hosted or processed
Can clients define the legal jurisdictions where their data can be transmitted, processed or stored? Please provide details?
“Clay and its subprocessors process customer data in the United States. Clay does not currently offer alternative processing locations. For more information please see our Privacy Policy (https://privacy.clay.com/policies).”
Regions named: USas of 21 Sep 2026Source
Where data is hosted or processed
Please provide the full list of where (countries) you and the subprocessors process customer data.
“Clay and its subprocessors process customer data in the United States. You can find a complete list of Clay’s subprocessors here https://docs.google.com/document/d/1hl1q4iyTt0SVSmwKqBOozbAq4 A9UcoAN7t6Ob4yYzA/edit. For more information please see our Privacy Policy (https://privacy.clay.com/policies).”
Regions named: USas of 21 Sep 2026Source
Where data is hosted or processed
Where can Clay customers exercise their data subject rights?
“Please review our Privacy Policy (https://privacy.clay.com/policies) for information on how data subjects can exercise their rights under the GDPR.”
as of 21 Sep 2026Source
International data transfers
In case you or your subprocessors process personal data in third countries, what legal ground do you use to transfer the personal data to the third countries?
“Clay and its subprocessors process customer data in the United States. You can find a complete list of Clay’s subprocessors here (https://docs.google.com/document/d/1hl1q4iyTt0SVSmwKqBOozbAq4 A9UcoAN7t6Ob4yYzA/edit). Insofar as Clay is required to legitimize data transfers pursuant to the GDPR, it does so using Standard Contractual Clauses.”
Regions named: USas of 21 Sep 2026Source
International data transfers
Does Clay transfer data from the EU to other countries?
“Clay does not maintain a presence in Europe and therefore does not transfer data from Europe to other countries.”
Regions named: EUas of 21 Sep 2026Source
Use of customer data to train models
Can we opt-out of having our data used for AI training?
“If Clay were to decide at some future date to make customer tables available for AI training, it would provide a mechanism for customers to opt out.”
as of 21 Sep 2026Source
Use of customer data to train models
Will Clay use our data for any AI training purposes?
“No. Clay does not make customer tables available to third parties.”
as of 21 Sep 2026Source
Solomon Amos · 7 Sep 2026 · 10 min read
CertReports Research · 18 Sep 2026 · 12 min read
This maps third-party obligations to the vendor evidence that may support them. It is not legal advice and never a statement that a vendor or its customers comply; confirm scope and sufficiency with your counsel or auditor. “No public evidence” means nothing public was found at the last check. Citations link to the official text.