Resend: DPA, subprocessors and data location
Where to find the Resend DPA and subprocessor list, how much notice you get of new subprocessors, where data is stored and how it leaves the EU. Each fact has a source link and the date we checked it. Typical use: transactional email delivery. The table is the short version; the sections below add detail.
Resend at a glance
| DPA and how it is accepted | |
|---|---|
| Subprocessor list | |
| Notice of new subprocessors | |
| Objection window and remedy | Window: 14 days Details on objecting |
| Data regions |
You can choose the region. |
| Transfer mechanism |
|
| Vendor role | Both: processor for some data, controller for other data. Details on its role |
| Checked on | (the oldest check date of any fact on this page) |
Notes on Resend
The DPA binds when you accept Resend's Terms of Service; the signature blocks are for reference only. It names the SCCs, plus UK and Swiss variants, and states that Resend complies with the EU-U.S. DPF and its UK Extension.
You choose the sending region per domain. Resend's docs say that choice controls where emails are sent from, not where account data is stored: all account data is stored in the United States. If you choose an EU sending region, your own subprocessor list should still say that account data is in the US.
Resend's subprocessor list had 22 entries on the check date, and the notice is 14 days with a 14-day objection window, after which a new subprocessor is deemed authorised (sections 4.2 and 4.4).
Resend DPA: where to find it and how it is accepted
Read the DPA on resend.com. Binding on acceptance of the Terms of Service; the signature blocks are for reference only.
Source: resend.com, checked 2026-10-16Not stated in the source we checked (2026-10-16).
The DPA states no plan limits. Section 12 says the executed copy is available in the Resend dashboard.
Source: resend.com, checked 2026-10-16Resend subprocessors: the list and how change notices reach you
Resend's subprocessor list (22 entries on the check date).
Source: resend.com, checked 2026-10-16Entries counted on the page on the check date; the page shows a last-updated date of 2026-08-27.
Source: resend.com, checked 2026-10-16How changes are announced: Written notice at least 14 days before changes (DPA section 4.2).
Source: resend.com, checked 2026-10-16Notice before a new subprocessor starts: 14 days.
Section 4.2: written notice at least 14 days in advance.
Source: resend.com, checked 2026-10-16You can object within 14 days. You may stop using the affected service by written notice (section 4.3). Fees owed under the agreement still apply.
Section 4.4: you must object within 14 days of notice, otherwise the new subprocessor is deemed authorised.
Source: resend.com, checked 2026-10-16Source: resend.com, checked 2026-10-16Where Resend stores data
- US (account data)
- US East (N. Virginia)
- EU (Ireland)
- Brazil (Sao Paulo)
- Japan (Tokyo)
You can choose the region.
You choose the sending region per domain. The docs say region selection controls where emails are sent from, not where account data is stored: all account data is stored in the United States.
Source: resend.com, checked 2026-10-16How Resend moves data outside the EU and UK
- SCCs
- UK Addendum
- Swiss modifications
- DPF
EU-U.S. Data Privacy Framework list: listed.
Listed on the Data Privacy Framework participant list as "Resend (legal name PLUS FIVE FIVE)": EU-U.S. DPF and UK Extension both shown as "Active - Re-certification under Review"; no Swiss-U.S. DPF entry. The DPA (section 11.1) says Resend complies with the EU-U.S. DPF and its UK Extension. Read from the list's own participant data on 2026-10-17.
Source: www.dataprivacyframework.gov, checked 2026-10-17Is Resend a processor or a controller?
Both: processor for some data, controller for other data.
Section 2.1: Resend is a processor unless the DPA or agreement says otherwise. Section 9.1: for Resend's own account data and usage data it is an independent controller.
Source: resend.com, checked 2026-10-16Is Resend GDPR compliant?
We don't give a compliance verdict, and no vendor can be 'GDPR compliant' on its own; compliance depends on how you use it. Here is what Resend's own documents say:
- A DPA is published: Binding on acceptance of the Terms of Service; the signature blocks are for reference only.
- A subprocessor list is published.
- Notice of new subprocessors: 14 days. Section 4.2: written notice at least 14 days in advance.
- Transfer mechanisms named: SCCs, UK Addendum, Swiss modifications, DPF.
- Data locations named: US (account data), US East (N. Virginia), EU (Ireland), Brazil (Sao Paulo), Japan (Tokyo).
What stays with you: accepting or signing the DPA where it needs that, choosing and setting the region, your own records of processing, and any consent or notices your own users need.
Add Resend to your own subprocessor list
This row uses the facts above. Change the purpose to match how you use Resend, then paste it into your list, or open it in the generator to add your other vendors.
| Vendor | Purpose | Data location | Transfer mechanism | Vendor DPA | Vendor subprocessor list |
|---|---|---|---|---|---|
| Resend | Transactional email delivery | US (account data); US East (N. Virginia); EU (Ireland); Brazil (Sao Paulo); Japan (Tokyo) | SCCs; UK Addendum; Swiss modifications; DPF | DPA | List |
Same row as Markdown
| Vendor | Purpose | Data location | Transfer mechanism | Vendor DPA | Vendor subprocessor list |
| --- | --- | --- | --- | --- | --- |
| Resend | Transactional email delivery | US (account data); US East (N. Virginia); EU (Ireland); Brazil (Sao Paulo); Japan (Tokyo) | SCCs; UK Addendum; Swiss modifications; DPF | [DPA](https://resend.com/legal/dpa) | [Subprocessors](https://resend.com/legal/subprocessors) |
If you add or replace Resend: what to tell your customers
Under Art. 28(2) GDPR, a processor that engages another processor needs its customer's authorisation. Where that authorisation is general, the processor must tell the customer about intended additions or replacements and give it a chance to object. The GDPR sets no fixed number of days. Customer DPAs usually set one, so check the number you agreed to.
Resend states 14 days of notice before it adds a subprocessor. Section 4.2: written notice at least 14 days in advance. If your own customers were promised a longer notice, you have a gap to plan for.
Use the subprocessor list template for the list itself. Tell customers before the change takes effect: what changes, the new vendor's purpose and location, the date, and how to object.
What changed
- Checked the Data Privacy Framework list: "Resend (legal name PLUS FIVE FIVE)" is listed (EU-U.S. DPF and UK Extension both shown as "Active - Re-certification under Review"; no Swiss-U.S. DPF entry). dpf_listed set to true.
- First check: facts recorded from Resend's own pages.
- Re-checked the DPA (last updated December 31, 2025), subprocessor list (August 27, 2026) and regions docs.
Related vendors
Sources and method
- https://resend.com/legal/dpa checked 2026-10-16
- https://resend.com/legal/subprocessors checked 2026-10-16
- https://resend.com/docs/dashboard/domains/regions checked 2026-10-16
- https://www.dataprivacyframework.gov/participant/8907 checked 2026-10-17
Facts come from Resend's own public pages, read by hand, and can change. Read the source before relying on it. The facts and templates here are not legal advice. How we check: methodology, which also says where to report an error. Official site: resend.com.