How-to
Vendor Security Questionnaire Questions Answered by Public Evidence
Solomon Amos · 26 Sep 2026 · 8 min read
UserTesting
GDPR evidence
UserTesting is a platform for getting rapid customer feedback on almost any customer experience you can imagine, including websites, mobile
Vendor-statedUserTesting and GDPR
UserTesting states it holds a data processing agreement. CertReports captured this on 21 Sep 2026 from its trust centre (Vanta); it is a vendor statement, not an independent confirmation.
Evidence
Vendor-statedVendor states GDPR on its trust centre
as of 21 Sep 2026 · confidence 90%Vendor-statedVendor states ISO 27701:2019 on its trust centre
as of 21 Sep 2026 · confidence 90%ExpiredInactive
as of 26 Oct 2026 · confidence 100%- Kind
- Listing
- Issued or listed
- 3 Oct 2016
- Scope
- The kind of information we hold We collect, store and process the following information in connection with a person’s employment with UserTesting. We collect personal contact details, personal information (e.g. date of birth), government issued identification, tax information, employment information, compensation information and performance information. How we use personal data We use this personal data to help UserTesting: perform contracts with the Personnel, making employment and compensation decisions, communicating with Personnel, detecting and preventing fraud, making and receiving payments and to address any legal obligations we may have. Sensitive Personal Data will be used for the administration of health benefits, administration of UserTesting equity/option plan and the application and administration of disability benefits. Data sharing We may have to share your data with third parties, where it is required by law or where the use of the data falls under the categories mentioned above. We may also share your personal data in context of the possible sale or restructuring of the business. In this situation we will, so far as possible, share anonymised data with the other parties until we feel the likelihood is high that the transaction will be completed, after which we will share your personal data with the other parties if and to the extent required under the terms of the transaction.
| Source | Captured | Quote | Links |
|---|---|---|---|
Data Privacy Framework list Official registry · HTTP 200 | 26 Oct 2026 | User Testing, Inc.: Inactive | Live pagesha256 2e3a62fa7d |
ExpiredInactive
as of 26 Oct 2026 · confidence 100%- Kind
- Listing
- Issued or listed
- 16 Aug 2024
- Scope
- In respect of study participants: In our capacity as data processor, to provide the services to improve the user experience for our customer's users. In respect of panelists: To send suitable and appropriate studies to panelists if they consent. Data is shared to third parties such as suppliers and affiliates, and where requested, customers. In respect of customers: To provide the services, conduct billing, send marketing communications. Data is shared to third parties such as suppliers, CRM providers and affiliates. In respect of employees/former employees: To meet our legal requirements and protect company information as appropriate. Data is shared to third parties such as suppliers, HR system and benefits providers and affiliates. For more information, please visit https://www.usertesting.com/privacy-center/
| Source | Captured | Quote | Links |
|---|---|---|---|
Data Privacy Framework list Official registry · HTTP 200 | 26 Oct 2026 | UserTesting: Inactive | Live pagesha256 200790d4cb |
What GDPR means, and what it does not
"GDPR compliant" is a claim, not a certification. The verifiable facts are a public DPA, SCC usage, an EU representative, data residency options and a Data Privacy Framework listing.
Read the GDPR guide and browse all vendors with evidenceQuestions buyers ask
Is UserTesting GDPR compliant?
There is no GDPR certification in general use. The verifiable facts are a public data processing agreement, standard contractual clauses, an EU representative and a Data Privacy Framework listing. See the legal artefacts and the DPF row on this page, each with its capture date.
How does CertReports verify this?
Every state carries a capture date, a source and a snapshot link. Registry rows come from the official registry data; vendor statements come from the vendor’s own page or trust centre; nothing is inferred. Vendors can dispute any row and corrections ship within two business days.
Change history
- 18 Sep 2026GDPR evidence addedA GDPR row entered the index with state Vendor-stated.
- 18 Sep 2026Subprocessor added: User Interviews SubprocessorsUser Interviews Subprocessors appeared on the subprocessor list.
- 18 Sep 2026Subprocessor added: UserTesting SubprocessorsUserTesting Subprocessors appeared on the subprocessor list.
- 18 Sep 2026Subprocessor added: UserZoom SubprocessorsUserZoom Subprocessors appeared on the subprocessor list.
Alternatives with GDPR evidence
Similar vendors (shared product tags or the Customer support category) whose GDPR row is verified or vendor-stated, ranked by similarity.
ChurnZero
Customer support
Deliver digital first customer success with ChurnZero software that helps businesses improve the customer experience and drive
Entersekt International
Customer support
Enhance your digital banking with adaptive authentication and real-time risk intelligence that reduces fraud, improves customer experience
Understand GDPR evidence
All articlesExplainers
The EU-US Data Privacy Framework, explained for vendor reviews
Solomon Amos · 7 Sep 2026 · 10 min read