Convex: DPA, subprocessors and data location
Where to find the Convex DPA and subprocessor list, how much notice you get of new subprocessors, where data is stored and how it leaves the EU. Each fact has a source link and the date we checked it. Typical use: backend database and realtime sync. The table is the short version; the sections below add detail.
Convex at a glance
| DPA and how it is accepted | |
|---|---|
| Subprocessor list | |
| Notice of new subprocessors | Not stated in the source we checked (2026-10-17). Details on subprocessors |
| Objection window and remedy | Window: 10 days Details on objecting |
| Data regions |
You can choose the region. |
| Transfer mechanism |
|
| Vendor role | Processor: it handles your customers' data on your instructions. Details on its role |
| Checked on | (the oldest check date of any fact on this page) |
Notes on Convex
Convex does publish a DPA. It binds from the effective date of the Agreement (section 1.2), and the SCCs count as signed when you execute the Agreement (section 6.2).
Section 3.5 promises email notice of new subprocessors only where Data Protection Laws require it, gives no advance period, and allows objections within 10 days. The clause offers good-faith talks and no termination right.
You choose the deployment region when you create a deployment: US East, Ireland, Sydney or Canada. The region cannot be changed afterwards, and the subprocessor list says AWS and PlanetScale process in the region you select. The DPA names the SCCs and does not mention the Data Privacy Framework.
Convex DPA: where to find it and how it is accepted
Read the DPA on www.convex.dev. The DPA becomes legally binding on the effective date of the Agreement (section 1.2), and executing the Agreement is deemed execution of the SCCs (section 6.2). The page shows no version or date..
Source: www.convex.dev, checked 2026-10-17Not stated in the source we checked (2026-10-17).
The DPA applies to the Agreement and does not list plans.
Source: www.convex.dev, checked 2026-10-17Convex subprocessors: the list and how change notices reach you
Convex's subprocessor list (23 entries on the check date).
Source: convex.dev, checked 2026-10-17The table lists 23 entries, among them AWS, PlanetScale, Datadog, Functional Software (Sentry), PostHog, Stripe, OpenRouter and Slack. The page shows no last-updated date.
Source: convex.dev, checked 2026-10-17How changes are announced: Email to the address on your Convex account, where required by Data Protection Laws (section 3.5).
Source: www.convex.dev, checked 2026-10-17Not stated in the source we checked (2026-10-17).
Section 3.5: where required by Data Protection Laws, Convex notifies the email address on your account about new subprocessors. The clause gives no advance period in days.
Source: www.convex.dev, checked 2026-10-17You can object within 10 days. If you have legitimate objections, the parties work together in good faith to resolve them (section 3.5). The clause names no termination right or refund.
Section 3.5: reasonable objections within ten (10) days of the notification.
Source: www.convex.dev, checked 2026-10-17Source: www.convex.dev, checked 2026-10-17Where Convex stores data
- AWS US East (N. Virginia)
- AWS Europe (Ireland)
- AWS Asia Pacific (Sydney)
- AWS Canada (Central)
You can choose the region.
Convex's regions page lists these four deployment regions and says you pick one when creating a deployment and that an existing deployment's region cannot be changed. The subprocessor page says AWS and PlanetScale process in the region you select. The other subprocessors are listed as processing in the United States, except Crowd Technologies GmbH in Germany.
Source: docs.convex.dev, checked 2026-10-17How Convex moves data outside the EU and UK
- SCCs (Module 2)
- UK Addendum
- Swiss FADP modifications
Section 6.1 authorizes transfers to the United States. Section 6.2 applies Module Two of the SCCs, for transfers to a country not found to provide an adequate level of protection, as supplemented by Exhibit A, which sets Irish law and courts and includes the Swiss FADP changes and a UK Addendum. The DPA does not mention the Data Privacy Framework.
Source: www.convex.dev, checked 2026-10-17Is Convex a processor or a controller?
Processor: it handles your customers' data on your instructions.
Section 3.1: you are the controller (or business) and Convex is the processor (or service provider).
Source: www.convex.dev, checked 2026-10-17Is Convex GDPR compliant?
We don't give a compliance verdict, and no vendor can be 'GDPR compliant' on its own; compliance depends on how you use it. Here is what Convex's own documents say:
- A DPA is published: The DPA becomes legally binding on the effective date of the Agreement (section 1.2), and executing the Agreement is deemed execution of the SCCs (section 6.2). The page shows no version or date.
- A subprocessor list is published.
- Transfer mechanisms named: SCCs (Module 2), UK Addendum, Swiss FADP modifications.
- Data locations named: AWS US East (N. Virginia), AWS Europe (Ireland), AWS Asia Pacific (Sydney), AWS Canada (Central).
What stays with you: accepting or signing the DPA where it needs that, choosing and setting the region, your own records of processing, and any consent or notices your own users need.
Add Convex to your own subprocessor list
This row uses the facts above. Change the purpose to match how you use Convex, then paste it into your list, or open it in the generator to add your other vendors.
| Vendor | Purpose | Data location | Transfer mechanism | Vendor DPA | Vendor subprocessor list |
|---|---|---|---|---|---|
| Convex | Backend database and realtime sync | AWS US East (N. Virginia); AWS Europe (Ireland); AWS Asia Pacific (Sydney); AWS Canada (Central) | SCCs (Module 2); UK Addendum; Swiss FADP modifications | DPA | List |
Same row as Markdown
| Vendor | Purpose | Data location | Transfer mechanism | Vendor DPA | Vendor subprocessor list |
| --- | --- | --- | --- | --- | --- |
| Convex | Backend database and realtime sync | AWS US East (N. Virginia); AWS Europe (Ireland); AWS Asia Pacific (Sydney); AWS Canada (Central) | SCCs (Module 2); UK Addendum; Swiss FADP modifications | [DPA](https://www.convex.dev/legal/dpa) | [Subprocessors](https://convex.dev/legal/subprocessors) |
If you add or replace Convex: what to tell your customers
Under Art. 28(2) GDPR, a processor that engages another processor needs its customer's authorisation. Where that authorisation is general, the processor must tell the customer about intended additions or replacements and give it a chance to object. The GDPR sets no fixed number of days. Customer DPAs usually set one, so check the number you agreed to.
In the source we checked, Convex doesn't state a notice period in days, so you may learn of a change later than your own notice period requires; plan for that.
Use the subprocessor list template for the list itself. Tell customers before the change takes effect: what changes, the new vendor's purpose and location, the date, and how to object.
What changed
- First check: facts recorded from Convex's own DPA and subprocessor pages and its regions documentation. Neither legal page shows a date.
- Re-counted the subprocessor table (read from the page's embedded data, since it is not in the visible text): 23 rows, count confirmed. Re-checked DPA sections 3.5, 6.1 and 6.2: confirmed. Added that the SCCs apply to transfers to a country without an adequate level of protection.
Related vendors
Sources and method
- https://www.convex.dev/legal/dpa checked 2026-10-17
- https://convex.dev/legal/subprocessors checked 2026-10-17
- https://docs.convex.dev/production/regions checked 2026-10-17
Facts come from Convex's own public pages, read by hand, and can change. Read the source before relying on it. The facts and templates here are not legal advice. How we check: methodology, which also says where to report an error. Official site: www.convex.dev.