Explainers
What Is Third-Party Risk Management (TPRM)? A Practical Guide
Solomon Amos · 2 Nov 2026 · 10 min read
Platform.sh
GDPR evidence
Ship at agent speed with humans in the
No public evidencePlatform.sh and GDPR
CertReports found no public GDPR evidence for Platform.sh as of unknown date. This does not mean the vendor is non-compliant. It means CertReports found no public evidence at the last check.
Evidence
VerifiedActive: EU-US Certification, UK Extension Certification, SW-US Certification
as of 2 Nov 2026 · confidence 100%- Kind
- Listing
- Issued or listed
- 18 Dec 2023
- Expires or valid through
- 27 Nov 2026
- Scope
- Platform.sh, Inc. doing business as Upsun collects personal data directly from customers in the EU, UK, or Switzerland when, for example, they visit the Upsun website and subscribe to our services (including creating an account with us). Upsun obtains personal data, such as contact information, address, and telephone numbers, in connection with maintaining its customer relationships, providing its products and services to customers, and safeguarding the integrity of the services as mentioned above. Upsun collects and processes Human Resources Personal Data for purposes including but not limited to • General business administration; • Compensation (e.g., stock plan, salary, payroll, and health benefits); • General human resources management ; • Performance management (e.g., employee reviews and training) ; • Monitoring of the use of company technology; • Comply with legal obligations. Upsun may disclose the relevant personal data to recipients such as (i) Upsun affiliates and subsidiaries, (ii) third-party controllers, and third-party processors to help us provide, maintain, protect, and improve our services and sites. Upsun also may disclose the relevant personal data if it is required by law or legal process or in response to lawful requests from public authorities, including to meet national security, public interest, or law enforcement requirements.
| Source | Captured | Quote | Links |
|---|---|---|---|
Data Privacy Framework list Official registry · HTTP 200 | 2 Nov 2026 | Platform.sh: Active: EU-US Certification, UK Extension Certification, SW-US Certification | Live pagesha256 378c0de15a |
What GDPR means, and what it does not
"GDPR compliant" is a claim, not a certification. The verifiable facts are a public DPA, SCC usage, an EU representative, data residency options and a Data Privacy Framework listing.
Read the GDPR guide and browse all vendors with evidenceQuestions buyers ask
Is Platform.sh GDPR compliant?
There is no GDPR certification in general use. The verifiable facts are a public data processing agreement, standard contractual clauses, an EU representative and a Data Privacy Framework listing. See the legal artefacts and the DPF row on this page, each with its capture date.
How does CertReports verify this?
Every state carries a capture date, a source and a snapshot link. Registry rows come from the official registry data; vendor statements come from the vendor’s own page or trust centre; nothing is inferred. Vendors can dispute any row and corrections ship within two business days.
Change history
- 18 Sep 2026First indexed by CertReports1 evidence row across 1 framework entered the index.
Alternatives with GDPR evidence
Similar vendors (shared product tags or the Cloud and hosting category) whose GDPR row is verified or vendor-stated, ranked by similarity.
Railway
Cloud and hosting
Railway is a full-stack cloud for deploying web apps, servers, databases, and more with automatic scaling, monitoring, and
Vercel
Cloud and hosting
The autonomous stack for every app and
Render
Cloud and hosting
Deploy and scale any app or agent from your first user to your
Understand GDPR evidence
All articlesHow-to
Vendor Security Questionnaire Questions Answered by Public Evidence
Solomon Amos · 26 Sep 2026 · 8 min read