No public evidenceFOSSA and GDPR
CertReports found no public GDPR evidence for FOSSA as of unknown date. This does not mean the vendor is non-compliant. It means CertReports found no public evidence at the last check.
Evidence
- Kind
- listing
- Issued or listed
- 7 Feb 2019
- Expires or valid through
- 24 Jul 2027
- Scope
- FOSSA uses personal data to provide, maintain, and improve its cloud-based platform and AI tools for open-source software management, including delivering code analysis and fixes through fossabot, authenticating users, and providing customer support. It also uses personal data to communicate with users about service changes, respond to inquiries, and send newsletters, marketing, and promotional materials (which users may opt out of), as well as to analyze and monitor how the Service is used and to detect, prevent, and address technical issues. o The types of data we collect are: (1) Email address (2) First name and last name (3) Professional and employment-related information (4) Phone number (5) Address, State, Province, ZIP/Postal code,City (6) Cookies and Usage Data. o We collect email address and name for general usage of our application (i.e. logging into the platform and being able to differentiate from different users at the same company) o We may collect professional and employment related information when an end-user reaches out for a demonstration of the product (occasionally the form may ask for additional information like phone number to contact the individual. Additionally, customers may use our role based permission to assign a user a role that might identify them as an "engineer" of a company or "legal" individual of a company. o We store address information typically associated with billing information (i.e. invoices, remit, payment, etc.) o We use anonymous cookies to track usage and time-based login (i.e. asked to re-login for security protocols.) Disclosure to Third Parties FOSSA discloses personal data received to third parties only as necessary to operate our services and business. These recipients fall into the following categories: Service providers / sub-processors acting on FOSSA's behalf under written contract that limits their use of the data to the services they provide to us. These include Amazon Web Services (cloud hosting and storage), DataDog and PagerDuty (platform monitoring, logging, and incident response), Anthropic (LLM-based code analysis for our Fossabot feature; Anthropic does not train models on customer data), Stripe (payment processing, self service customers only), and analytics, customer-support, and feedback providers including PostHog, Google Analytics, Delighted, and DevRev.
| Source | Captured | Quote | Links |
|---|---|---|---|
Data Privacy Framework list Official registry · HTTP 200 | 17 Sep 2026 | FOSSA: Active: EU-US Certification, SW-US Certification, UK Extension Certification | Live pagesha256 b66ee65795 |
What GDPR means, and what it does not
"GDPR compliant" is a claim, not a certification. The verifiable facts are a public DPA, SCC usage, an EU representative, data residency options and a Data Privacy Framework listing.
Read the GDPR guide and browse all vendors with evidenceQuestions buyers ask
Is FOSSA GDPR compliant?
There is no GDPR certification in general use. The verifiable facts are a public data processing agreement, standard contractual clauses, an EU representative and a Data Privacy Framework listing. See the legal artefacts and the DPF row on this page, each with its capture date.
How does CertReports verify this?
Every state carries a capture date, a source and a snapshot link. Registry rows come from the official registry data; vendor statements come from the vendor’s own page or trust centre; nothing is inferred. Vendors can dispute any row and corrections ship within two business days.
Alternatives with GDPR evidence
Similar vendors (shared product tags or the DevOps and observability category) whose GDPR row is verified or vendor-stated, ranked by similarity.
