Mixpanel: DPA, subprocessors and data location
Where to find the Mixpanel DPA and subprocessor list, how much notice you get of new subprocessors, where data is stored and how it leaves the EU. Each fact has a source link and the date we checked it. Typical use: product analytics. The table is the short version; the sections below add detail.
Mixpanel at a glance
| DPA and how it is accepted | |
|---|---|
| Subprocessor list | |
| Notice of new subprocessors | |
| Objection window and remedy | Window: 30 days Details on objecting |
| Data regions |
You can choose the region. |
| Transfer mechanism |
|
| Vendor role | Processor: it handles your customers' data on your instructions. Details on its role |
| Checked on | (the oldest check date of any fact on this page) |
Notes on Mixpanel
Mixpanel hosts in the US by default. EU hosting depends on your selection and configuration, and India applies only if you purchase it (section 8.1). Each residency has its own subprocessor list.
Mixpanel updates the list at least 30 days before a new subprocessor starts processing. You have 30 calendar days to object by email to compliance@mixpanel.com, or you are deemed to consent (section 7.1). To receive updates you complete a form.
Mixpanel DPA: where to find it and how it is accepted
Read the DPA on mixpanel.com. Incorporated into the agreement between you and Mixpanel covering the Application Services; effective from the Agreement's effective date (sections 12 and 14). Last updated June 2, 2026..
Source: mixpanel.com, checked 2026-10-16Not stated in the source we checked (2026-10-16).
The DPA states no plan limits. It applies to the Application Services under your Agreement.
Source: mixpanel.com, checked 2026-10-16Mixpanel subprocessors: the list and how change notices reach you
Source: mixpanel.com, checked 2026-10-16How changes are announced: Updates to the subprocessor list; to receive updates you complete a form (DPA section 7.1.1).
Source: mixpanel.com, checked 2026-10-16Notice before a new subprocessor starts: 30 days.
Section 7.1.1: Mixpanel updates the list at least thirty (30) days before a new subprocessor starts processing. To receive updates you complete a form.
Source: mixpanel.com, checked 2026-10-16You can object within 30 days.
Section 7.1.2: email compliance@mixpanel.com within thirty (30) calendar days of the update or receipt of notice, whichever is later; no timely objection means deemed consent.
Source: mixpanel.com, checked 2026-10-16Where Mixpanel stores data
- US (default)
- EU (European servers, if selected)
- India (if purchased)
You can choose the region.
Section 8.1: Mixpanel hosts on US servers by default or on European servers based on your selection and configuration, or in India if you purchase it. Each residency has its own subprocessor list.
Source: mixpanel.com, checked 2026-10-16How Mixpanel moves data outside the EU and UK
- DPF
- SCCs (Modules 1, 2 and 3)
- UK Addendum
- Swiss SCCs
Section 8.1: Mixpanel relies on the EU-U.S. DPF, the UK Extension and the Swiss-U.S. DPF, and also enters into SCCs (Modules 2 and 3 as processor, Module 1 where it acts as controller).
Source: mixpanel.com, checked 2026-10-16EU-U.S. Data Privacy Framework list: listed.
Listed on the Data Privacy Framework participant list as "Mixpanel, Inc.": EU-U.S. DPF, UK Extension and Swiss-U.S. DPF all shown as Active. The DPA (section 8.1.1) says Mixpanel relies on the DPF. Read from the list's own participant data on 2026-10-17.
Source: www.dataprivacyframework.gov, checked 2026-10-17Is Mixpanel a processor or a controller?
Processor: it handles your customers' data on your instructions.
Section 3.1: you are the controller and Mixpanel is the processor or sub-processor of Customer Content. Section 8.1.2.2 adds Module One for the cases where Mixpanel is itself a controller.
Source: mixpanel.com, checked 2026-10-16Is Mixpanel GDPR compliant?
We don't give a compliance verdict, and no vendor can be 'GDPR compliant' on its own; compliance depends on how you use it. Here is what Mixpanel's own documents say:
- A DPA is published: Incorporated into the agreement between you and Mixpanel covering the Application Services; effective from the Agreement's effective date (sections 12 and 14). Last updated June 2, 2026.
- A subprocessor list is published.
- Notice of new subprocessors: 30 days. Section 7.1.1: Mixpanel updates the list at least thirty (30) days before a new subprocessor starts processing. To receive updates you complete a form.
- Transfer mechanisms named: DPF, SCCs (Modules 1, 2 and 3), UK Addendum, Swiss SCCs.
- Data locations named: US (default), EU (European servers, if selected), India (if purchased).
What stays with you: accepting or signing the DPA where it needs that, choosing and setting the region, your own records of processing, and any consent or notices your own users need.
Add Mixpanel to your own subprocessor list
This row uses the facts above. Change the purpose to match how you use Mixpanel, then paste it into your list, or open it in the generator to add your other vendors.
| Vendor | Purpose | Data location | Transfer mechanism | Vendor DPA | Vendor subprocessor list |
|---|---|---|---|---|---|
| Mixpanel | Product analytics | US (default); EU (European servers, if selected); India (if purchased) | DPF; SCCs (Modules 1, 2 and 3); UK Addendum; Swiss SCCs | DPA | List |
Same row as Markdown
| Vendor | Purpose | Data location | Transfer mechanism | Vendor DPA | Vendor subprocessor list |
| --- | --- | --- | --- | --- | --- |
| Mixpanel | Product analytics | US (default); EU (European servers, if selected); India (if purchased) | DPF; SCCs (Modules 1, 2 and 3); UK Addendum; Swiss SCCs | [DPA](https://mixpanel.com/legal/dpa/) | [Subprocessors](https://mixpanel.com/legal/subprocessor-list/) |
If you add or replace Mixpanel: what to tell your customers
Under Art. 28(2) GDPR, a processor that engages another processor needs its customer's authorisation. Where that authorisation is general, the processor must tell the customer about intended additions or replacements and give it a chance to object. The GDPR sets no fixed number of days. Customer DPAs usually set one, so check the number you agreed to.
Mixpanel states 30 days of notice before it adds a subprocessor. Section 7.1.1: Mixpanel updates the list at least thirty (30) days before a new subprocessor starts processing. To receive updates you complete a form. If your own customers were promised a longer notice, you have a gap to plan for.
Use the subprocessor list template for the list itself. Tell customers before the change takes effect: what changes, the new vendor's purpose and location, the date, and how to object.
What changed
- Checked the Data Privacy Framework list: "Mixpanel, Inc." is listed (EU-U.S. DPF, UK Extension and Swiss-U.S. DPF all shown as Active). dpf_listed set to true.
- First check: facts recorded from Mixpanel's own DPA (June 2, 2026) and subprocessor lists.
Related vendors
Sources and method
- https://mixpanel.com/legal/dpa/ checked 2026-10-16
- https://mixpanel.com/legal/subprocessor-list/ checked 2026-10-16
- https://www.dataprivacyframework.gov/participant/7814 checked 2026-10-17
Facts come from Mixpanel's own public pages, read by hand, and can change. Read the source before relying on it. The facts and templates here are not legal advice. How we check: methodology, which also says where to report an error. Official site: mixpanel.com.