Clerk (clerk.com): DPA, subprocessors and data location
Where to find the Clerk (clerk.com) DPA and subprocessor list, how much notice you get of new subprocessors, where data is stored and how it leaves the EU. Each fact has a source link and the date we checked it. Typical use: user authentication and management. The table is the short version; the sections below add detail.
Clerk (clerk.com) at a glance
| DPA and how it is accepted | |
|---|---|
| Subprocessor list | |
| Notice of new subprocessors | |
| Objection window and remedy | Window: 10 days Details on objecting |
| Data regions |
|
| Transfer mechanism |
|
| Vendor role | Both: processor for some data, controller for other data. Details on its role |
| Checked on | (the oldest check date of any fact on this page) |
Notes on Clerk (clerk.com)
Clerk is a processor for Customer Personal Data and an independent controller for Account Information, not a joint controller (section 3.1(a)). Check which of the two applies to the data you send.
The DPA says Clerk relies on the DPF for transfers and uses the SCCs as a fallback (section 11). It states that hosting is primarily in Google Cloud data centers and Cloudflare, names no country or region, and offers no region choice.
Notice is 15 days with a 10-day objection window (section 5.3); the DPA does not say how notice is delivered. The clerk.com subprocessor page points to the up-to-date list in Clerk's Trust Center.
Clerk (clerk.com) DPA: where to find it and how it is accepted
Read the DPA on clerk.com. Incorporated into and forming part of the Agreement; effective on the Agreement's effective date (preamble). Last updated November 26, 2024..
Source: clerk.com, checked 2026-10-16Clerk (clerk.com) subprocessors: the list and how change notices reach you
Clerk (clerk.com)'s subprocessor list.
Source: clerk.com, checked 2026-10-16Notice before a new subprocessor starts: 15 days.
Section 5.3: at least fifteen (15) days' notice of any proposed change, including additions and replacements. The DPA does not say how notice is delivered.
Source: clerk.com, checked 2026-10-16You can object within 10 days. The parties work in good faith toward a resolution. If none is reached within a reasonable time, either party may terminate the Agreement as its sole and exclusive remedy. During an objection period Clerk may suspend the affected part of the Services (section 5.3).
Section 5.3: written objection within ten (10) days after Clerk gives notice.
Source: clerk.com, checked 2026-10-16Source: clerk.com, checked 2026-10-16Where Clerk (clerk.com) stores data
- Google Cloud data centers and Cloudflare (no country or region named)
Schedule 2 item 7: Clerk "hosts Personal Data primarily in Google Cloud data centers and Cloudflare". Section 4.4: Clerk may store and process data anywhere it or its subprocessors maintain facilities. The DPA names no country or region and offers no region choice.
Source: clerk.com, checked 2026-10-16How Clerk (clerk.com) moves data outside the EU and UK
- DPF
- SCCs (Modules 1, 2 and 3, fallback)
- UK Addendum
- Swiss terms
Section 11.2: Clerk states it participates in the DPF through self-certification, and transfers rely on it while it is valid. Section 11.1: the SCCs apply to the extent Clerk cannot rely on the DPF. Section 12 covers UK and Swiss law.
Source: clerk.com, checked 2026-10-16EU-U.S. Data Privacy Framework list: listed.
Listed on the Data Privacy Framework participant list as "Clerk, Inc.": EU-U.S. DPF, UK Extension and Swiss-U.S. DPF all shown as Active. The DPA (section 11.2) says Clerk participates in the DPF through self-certification. Read from the list's own participant data on 2026-10-17.
Source: www.dataprivacyframework.gov, checked 2026-10-17Is Clerk (clerk.com) a processor or a controller?
Both: processor for some data, controller for other data.
Section 3.1(a): Clerk is a processor (or sub-processor) for Customer Personal Data, and for Account Information it is an independent controller, not a joint controller.
Source: clerk.com, checked 2026-10-16Is Clerk (clerk.com) GDPR compliant?
We don't give a compliance verdict, and no vendor can be 'GDPR compliant' on its own; compliance depends on how you use it. Here is what Clerk (clerk.com)'s own documents say:
- A DPA is published: Incorporated into and forming part of the Agreement; effective on the Agreement's effective date (preamble). Last updated November 26, 2024.
- A subprocessor list is published.
- Notice of new subprocessors: 15 days. Section 5.3: at least fifteen (15) days' notice of any proposed change, including additions and replacements. The DPA does not say how notice is delivered.
- Transfer mechanisms named: DPF, SCCs (Modules 1, 2 and 3, fallback), UK Addendum, Swiss terms.
- Data locations named: Google Cloud data centers and Cloudflare (no country or region named).
What stays with you: accepting or signing the DPA where it needs that, choosing and setting the region, your own records of processing, and any consent or notices your own users need.
Add Clerk (clerk.com) to your own subprocessor list
This row uses the facts above. Change the purpose to match how you use Clerk (clerk.com), then paste it into your list, or open it in the generator to add your other vendors.
| Vendor | Purpose | Data location | Transfer mechanism | Vendor DPA | Vendor subprocessor list |
|---|---|---|---|---|---|
| Clerk (clerk.com) | User authentication and management | Google Cloud data centers and Cloudflare (no country or region named) | DPF; SCCs (Modules 1, 2 and 3, fallback); UK Addendum; Swiss terms | DPA | List |
Same row as Markdown
| Vendor | Purpose | Data location | Transfer mechanism | Vendor DPA | Vendor subprocessor list |
| --- | --- | --- | --- | --- | --- |
| Clerk (clerk.com) | User authentication and management | Google Cloud data centers and Cloudflare (no country or region named) | DPF; SCCs (Modules 1, 2 and 3, fallback); UK Addendum; Swiss terms | [DPA](https://clerk.com/legal/dpa) | [Subprocessors](https://clerk.com/legal/subprocessors) |
If you add or replace Clerk (clerk.com): what to tell your customers
Under Art. 28(2) GDPR, a processor that engages another processor needs its customer's authorisation. Where that authorisation is general, the processor must tell the customer about intended additions or replacements and give it a chance to object. The GDPR sets no fixed number of days. Customer DPAs usually set one, so check the number you agreed to.
Clerk (clerk.com) states 15 days of notice before it adds a subprocessor. Section 5.3: at least fifteen (15) days' notice of any proposed change, including additions and replacements. The DPA does not say how notice is delivered. If your own customers were promised a longer notice, you have a gap to plan for.
Use the subprocessor list template for the list itself. Tell customers before the change takes effect: what changes, the new vendor's purpose and location, the date, and how to object.
What changed
- Re-checked the notice, objection, location and transfer clauses against the full text; no changes.
- Checked the Data Privacy Framework list: "Clerk, Inc." is listed (EU-U.S. DPF, UK Extension and Swiss-U.S. DPF all shown as Active). dpf_listed set to true.
- First check: facts recorded from Clerk's own DPA (last updated November 26, 2024) and subprocessor page (July 10, 2026).
Related vendors
Sources and method
- https://clerk.com/legal/dpa checked 2026-10-16
- https://clerk.com/legal/subprocessors checked 2026-10-16
- https://www.dataprivacyframework.gov/participant/2718 checked 2026-10-17
Facts come from Clerk (clerk.com)'s own public pages, read by hand, and can change. Read the source before relying on it. The facts and templates here are not legal advice. How we check: methodology, which also says where to report an error. Official site: clerk.com.