Explainers
What Is Third-Party Risk Management (TPRM)? A Practical Guide
Solomon Amos · 2 Nov 2026 · 10 min read
Vendor-statedExpel and GDPR
Expel states it holds a data processing agreement. CertReports captured this on 30 Sep 2026 from its trust centre (Drata); it is a vendor statement, not an independent confirmation.
Evidence
Vendor-statedVendor states GDPR on its trust centre
as of 30 Sep 2026 · confidence 80%| Source | Captured | Quote | Links |
|---|---|---|---|
Expel trust centre (Drata) Vendor trust centre · HTTP 200 | 29 Sep 2026 | GDPR | |
Expel trust centre (Drata) Vendor trust centre · HTTP 200 | 27 Sep 2026 | GDPR | |
Expel trust centre (Drata) Vendor trust centre · HTTP 200 | 25 Sep 2026 | GDPR | |
Expel trust centre (Drata) Vendor trust centre · HTTP 200 | 21 Sep 2026 | GDPR | |
Expel trust centre (Drata) Vendor trust centre · HTTP 200 | 18 Sep 2026 | GDPR |
Vendor-statedVendor states ISO/IEC 27701 on its trust centre
as of 30 Sep 2026 · confidence 80%| Source | Captured | Quote | Links |
|---|---|---|---|
Expel trust centre (Drata) Vendor trust centre · HTTP 200 | 29 Sep 2026 | ISO/IEC 27701 | |
Expel trust centre (Drata) Vendor trust centre · HTTP 200 | 27 Sep 2026 | ISO/IEC 27701 | |
Expel trust centre (Drata) Vendor trust centre · HTTP 200 | 25 Sep 2026 | ISO/IEC 27701 | |
Expel trust centre (Drata) Vendor trust centre · HTTP 200 | 21 Sep 2026 | ISO/IEC 27701 | |
Expel trust centre (Drata) Vendor trust centre · HTTP 200 | 18 Sep 2026 | ISO/IEC 27701 |
VerifiedActive: EU-US Certification, UK Extension Certification, SW-US Certification
as of 2 Nov 2026 · confidence 100%- Kind
- Listing
- Issued or listed
- 4 Mar 2024
- Expires or valid through
- 2 Mar 2027
- Scope
- Expel provides a web-based security platform that businesses use to monitor their network security and react to security issues, as well as websites where customers can learn more about our offerings. Expel’s Online Privacy Policy describes how Expel processes personal data that we collect through our websites, through social media, in connection with our marketing activities, and through other activities described in the Online Privacy Policy, such as name, email, and certain online identifiers. Expel processes this personal data for business and operational purposes, marketing and commercial purposes, security purposes, and legal and compliance purposes. Expel may share this personal information with third-party vendors who help us operate and maintain our site and services, such as for direct mail delivery and marketing automation. In addition, in order to provide service to customers, Expel collects, analyzes and reviews certain computer and network activities to alert our customers to potential cybersecurity threats in their environments and provide managed detection and response. The types of personal data processed in providing this service include user account information and data derived from customer endpoints. Expel shares this personal data with third-party vendors who help us operate and maintain our site and services, such as cloud infrastructure vendors like GCP and AWS. Our third party providers (also known as ‘subprocessors’) only receive personal information about our customers for the limited purposes of providing us with their services. Expel’s Workbench Privacy Policy describes the information that we process on behalf of our business customers, including the list of third-party subprocessors, while delivering Workbench and our Managed Detection and Response services. More information and a current list of subprocessors is available at https://expel.com/notices/
| Source | Captured | Quote | Links |
|---|---|---|---|
Data Privacy Framework list Official registry · HTTP 200 | 2 Nov 2026 | Expel, Inc.: Active: EU-US Certification, UK Extension Certification, SW-US Certification | Live pagesha256 c6d18b9414 |
What GDPR means, and what it does not
"GDPR compliant" is a claim, not a certification. The verifiable facts are a public DPA, SCC usage, an EU representative, data residency options and a Data Privacy Framework listing.
Read the GDPR guide and browse all vendors with evidenceQuestions buyers ask
Is Expel GDPR compliant?
There is no GDPR certification in general use. The verifiable facts are a public data processing agreement, standard contractual clauses, an EU representative and a Data Privacy Framework listing. See the legal artefacts and the DPF row on this page, each with its capture date.
How does CertReports verify this?
Every state carries a capture date, a source and a snapshot link. Registry rows come from the official registry data; vendor statements come from the vendor’s own page or trust centre; nothing is inferred. Vendors can dispute any row and corrections ship within two business days.
Change history
- 22 Sep 2026DPA changedThe data processing agreement URL changed.
- 18 Sep 2026GDPR evidence addedA GDPR row entered the index with state Vendor-stated.
Alternatives with GDPR evidence
Similar vendors (shared product tags or the Security category) whose GDPR row is verified or vendor-stated, ranked by similarity.
Forcepoint
Security
Forcepoint is a global data security leader headquartered in Austin, Texas, delivering AI-native protection for sensitive data across
RSA Security
Security
Outseer delivers all-cause fraud prevention using predictive AI, real-time behavioral biometrics, and global consortium data—detecting and
SEON Technologies
Security
SEON's fraud prevention platform unifies real-time detection and AML in one
Understand GDPR evidence
All articlesHow-to
Vendor Security Questionnaire Questions Answered by Public Evidence
Solomon Amos · 26 Sep 2026 · 8 min read