PostHog: DPA, subprocessors and data location
Where to find the PostHog DPA and subprocessor list, how much notice you get of new subprocessors, where data is stored and how it leaves the EU. Each fact has a source link and the date we checked it. Typical use: product analytics. The table is the short version; the sections below add detail.
PostHog at a glance
| DPA and how it is accepted | |
|---|---|
| Subprocessor list | |
| Notice of new subprocessors | |
| Objection window and remedy | Window: 7 days Details on objecting |
| Data regions |
You can choose the region. |
| Transfer mechanism |
|
| Vendor role | Processor: it handles your customers' data on your instructions. Details on its role |
| Checked on | (the oldest check date of any fact on this page) |
Notes on PostHog
PostHog's DPA is generated and countersigned in the app (app.posthog.com/legal), and the page says it is available on any plan, including the free one. The copy on posthog.com/dpa is for reading and is not binding on its own.
You choose US Cloud or EU Cloud. The subprocessor list shows AWS processing in the USA for US Cloud and in Germany for EU Cloud. The DPA gives at least 14 days' notice of a subprocessor list update (section 5.3) and 7 days to object (section 5.4), and does not say how notice is delivered.
The subprocessor page groups subprocessors under tabs labelled core services, AI features and internal.
PostHog DPA: where to find it and how it is accepted
Read the DPA on posthog.com. Generated and countersigned inside the PostHog app (app.posthog.com/legal); PostHog's signature is already applied and you sign through PandaDoc. The copy on posthog.com/dpa is a reading copy and not binding on its own..
Source: posthog.com, checked 2026-10-16Plans covered: Any plan, including the free one
Stated on the DPA page: "Any plan, including the free one."
Source: posthog.com, checked 2026-10-16PostHog subprocessors: the list and how change notices reach you
Source: posthog.com, checked 2026-10-16How changes are announced: Updates posted on the subprocessors page; notice under DPA section 5.3 (delivery method not specified).
Source: posthog.com, checked 2026-10-16Notice before a new subprocessor starts: 14 days.
Section 5.3: notice of an update to the subprocessor list, with an opportunity to object, at least fourteen (14) days in advance. The DPA does not say how notice is delivered.
Source: posthog.com, checked 2026-10-17You can object within 7 days. PostHog uses efforts to address the objection (cancel the plan or offer an alternative, or take the corrective steps you request). If none of those options is reasonably available and the objection has not been sufficiently addressed within 30 days after PostHog receives it, you may terminate the affected Service with reasonable prior written notice (section 5.4).
Section 5.4: written objection within seven (7) days after receipt of the updated list.
Source: posthog.com, checked 2026-10-17Source: posthog.com, checked 2026-10-17Where PostHog stores data
- USA (PostHog US Cloud)
- Germany (PostHog EU Cloud)
You can choose the region.
The subprocessor list shows AWS processing in the USA for US Cloud and in Germany for EU Cloud. PostHog's docs describe EU Cloud as hosted in Frankfurt. DPA section 10.1: data is housed in the Data Center Location set out in the Principal Agreement. Cloudflare handles traffic at global edge locations.
Source: posthog.com, checked 2026-10-16How PostHog moves data outside the EU and UK
- DPF
- SCCs (Module 2)
- UK Addendum
- Swiss FADP modifications
Section 10.3: PostHog confirms it participates in the EU-U.S. DPF, the UK Extension and the Swiss-U.S. DPF. Section 10.4 ("Notwithstanding 10.3"): the SCCs also apply, as module 2 only (defined in 1.1.16.2), with the UK Addendum (10.6) and Swiss amendments (10.7). Section 10.9: if PostHog ceases to participate in the DPF the parties agree an alternative transfer solution.
Source: posthog.com, checked 2026-10-17EU-U.S. Data Privacy Framework list: listed.
Listed on the Data Privacy Framework participant list as "PostHog Inc": EU-U.S. DPF, UK Extension and Swiss-U.S. DPF all shown as Active. The DPA (section 10.3) says PostHog participates in the DPF. Read from the list's own participant data on 2026-10-17.
Source: www.dataprivacyframework.gov, checked 2026-10-17Is PostHog a processor or a controller?
Processor: it handles your customers' data on your instructions.
Recitals and section 2: you are the controller and PostHog, Inc. is the processor.
Source: posthog.com, checked 2026-10-16Is PostHog GDPR compliant?
We don't give a compliance verdict, and no vendor can be 'GDPR compliant' on its own; compliance depends on how you use it. Here is what PostHog's own documents say:
- A DPA is published: Generated and countersigned inside the PostHog app (app.posthog.com/legal); PostHog's signature is already applied and you sign through PandaDoc. The copy on posthog.com/dpa is a reading copy and not binding on its own.
- A subprocessor list is published.
- Notice of new subprocessors: 14 days. Section 5.3: notice of an update to the subprocessor list, with an opportunity to object, at least fourteen (14) days in advance. The DPA does not say how notice is delivered.
- Transfer mechanisms named: DPF, SCCs (Module 2), UK Addendum, Swiss FADP modifications.
- Data locations named: USA (PostHog US Cloud), Germany (PostHog EU Cloud).
What stays with you: accepting or signing the DPA where it needs that, choosing and setting the region, your own records of processing, and any consent or notices your own users need.
Add PostHog to your own subprocessor list
This row uses the facts above. Change the purpose to match how you use PostHog, then paste it into your list, or open it in the generator to add your other vendors.
| Vendor | Purpose | Data location | Transfer mechanism | Vendor DPA | Vendor subprocessor list |
|---|---|---|---|---|---|
| PostHog | Product analytics | USA (PostHog US Cloud); Germany (PostHog EU Cloud) | DPF; SCCs (Module 2); UK Addendum; Swiss FADP modifications | DPA | List |
Same row as Markdown
| Vendor | Purpose | Data location | Transfer mechanism | Vendor DPA | Vendor subprocessor list |
| --- | --- | --- | --- | --- | --- |
| PostHog | Product analytics | USA (PostHog US Cloud); Germany (PostHog EU Cloud) | DPF; SCCs (Module 2); UK Addendum; Swiss FADP modifications | [DPA](https://posthog.com/dpa) | [Subprocessors](https://posthog.com/subprocessors) |
If you add or replace PostHog: what to tell your customers
Under Art. 28(2) GDPR, a processor that engages another processor needs its customer's authorisation. Where that authorisation is general, the processor must tell the customer about intended additions or replacements and give it a chance to object. The GDPR sets no fixed number of days. Customer DPAs usually set one, so check the number you agreed to.
PostHog states 14 days of notice before it adds a subprocessor. Section 5.3: notice of an update to the subprocessor list, with an opportunity to object, at least fourteen (14) days in advance. The DPA does not say how notice is delivered. If your own customers were promised a longer notice, you have a gap to plan for.
Use the subprocessor list template for the list itself. Tell customers before the change takes effect: what changes, the new vendor's purpose and location, the date, and how to object.
What changed
- Re-checked DPA sections 5.3, 5.4 and 10.3 to 10.5 against the legal version of the text. Notice (14 days), objection (7 days) and DPF participation confirmed. Refined two notes: the 30-day termination right applies only if none of the remedy options is reasonably available and the objection is not sufficiently addressed within 30 days; the SCCs (module 2 only, defined in 1.1.16.2) apply in addition to the DPF under 10.4 ("Notwithstanding 10.3"), with 10.9 covering loss of DPF participation.
- Checked the Data Privacy Framework list: "PostHog Inc" is listed (EU-U.S. DPF, UK Extension and Swiss-U.S. DPF all shown as Active). dpf_listed set to true.
- First check: facts recorded from PostHog's own DPA and subprocessor pages (subprocessor list last updated October 14, 2026).
Related vendors
Sources and method
- https://posthog.com/dpa checked 2026-10-16
- https://posthog.com/subprocessors checked 2026-10-16
- https://www.dataprivacyframework.gov/participant/2915 checked 2026-10-17
Facts come from PostHog's own public pages, read by hand, and can change. Read the source before relying on it. The facts and templates here are not legal advice. How we check: methodology, which also says where to report an error. Official site: posthog.com.