Clay

Security and trust center evidence

Infrastructure to get any data, run agentic workflows, and launch GTM

clay.com Sales toolsLast verified 21 Sep 2026

Request the report Are you Clay?

SOC 2Vendor-stated

GDPRVendor-stated

ISO 27001Vendor-stated

ISO 42001Vendor-stated

CCPAVendor-stated

Clay has 5 vendor-stated rows in the CertReports index, last verified 21 Sep 2026. The strongest row is SOC 2: Vendor states SOC 2 Type 2 on its trust centre. This page is independent of the vendor’s own trust centre: dates, sources and caveats come from CertReports captures.

Reviewer brief

According to Clay's trust centre, as of 19 Sep 2026, the company has a SOC 2 Type II report on file. Clay's trust centre also states, as of 19 Sep 2026, that the company meets GDPR requirements. As of 19 Sep 2026, Clay states on its trust centre that it holds ISO/IEC 27001:2022. Clay states on its trust centre, as of 19 Sep 2026, that it holds ISO/IEC 42001:2023. Clay's trust centre further states, as of 19 Sep 2026, that the company meets CCPA/CPRA requirements.

SOC 2 Type II report: vendor states on trust centre, as of 19 Sep 2026
ISO/IEC 27001:2022 and ISO/IEC 42001:2023: vendor states on trust centre, as of 19 Sep 2026
GDPR and CCPA/CPRA: vendor states on trust centre, as of 19 Sep 2026

Facts only, each dated; nothing here is inferred, scored or advised. Brief generated 19 Sep 2026; it is regenerated whenever a row changes.

Among sales tools vendors

0verified rows

Category median 0, across 49 indexed sales tools vendors. Clay has no registry-verified row yet, like 57 percent of them; its evidence is vendor-stated or reported.

agentic workflowsdata enrichmentgtm automationlead generationsales automation

Compare with similar vendors

Pick your own comparison

Compliance grid

No public evidence yet for HIPAA, FedRAMP, PCI DSS, CSA STAR, Cyber Essentials, ISO 27701. This does not mean the vendor lacks them; it means nothing public was found at the last check.

Legal artefacts

Subprocessor list

Public · 34 subprocessors listed on the trust centre · as of 21 Sep 2026

Open

Public · as of 21 Sep 2026

Open

Data processing agreement

On request · Listed on the trust centre as "Data Processing Agreement" · as of 21 Sep 2026

Open

Subprocessors (34)

Amazon Web ServicesCloud provider · USA
AmplitudeData analytics · USA
AnthropicLLM provider/hosting · USA
BR
BraintrustLLM Operations · USA
BR
BrowserbaseLLM Operations · USA
CL
ClickHouseDatabase · USA
CohereLLM operations · Canada
CD
Cube DevData analytics · USA
DatadogAPM and security · USA
FireworksLLM provider/hosting · USA
FivetranData ETL · USA
Google GeminiLLM provider/hosting · USA
GrafanaLogging and metrics · USA
IntercomCustomer support · USA
LangsmithLLM logging and tracing · USA
MezmoLogging and metrics · USA
MistralLLM provider/hosting · France
OpenAILLM provider/hosting · USA
PW
Parallel Web SystemsLLM operations · USA
PlanetscaleUSA
PostmarkEmail service provider · USA
Raindrop.aiLLM operations · USA
SegmentData analytics · USA
SentryError logging · USA
SE
SerpApiLLM operations · USA
SE
SerperLLM operations · USA
SlackCustomer Support · USA
SM
SmartleadEmail sequencer · USA
SnowflakeData analytics · USA
TU
TurbopufferVector Database · USA
VE
VerisoulFraud Detection · USA
WO
WorkOSAuthentication support · USA
ZapierData imports · USA
ZE
ZenrowsLLM operations · Spain

Security profile

Pen test cadence: report available
Data residency: US
Trains on customer data: no

Displayed as a security profile from public statements, not as attestations, as of 21 Sep 2026.

Change history

22 Sep 2026DPA changedThe data processing agreement URL changed.
22 Sep 2026AI training policy changedTraining on customer data moved from unknown to no.
19 Sep 2026First indexed by CertReports5 evidence rows across 5 frameworks entered the index.