Sentry: DPA, subprocessors and data location
Where to find the Sentry DPA and subprocessor list, how much notice you get of new subprocessors, where data is stored and how it leaves the EU. Each fact has a source link and the date we checked it. Typical use: error and performance monitoring. The table is the short version; the sections below add detail.
Sentry at a glance
| DPA and how it is accepted | |
|---|---|
| Subprocessor list | |
| Notice of new subprocessors | |
| Objection window and remedy | Not stated in the source we checked (2026-10-17). |
| Data regions |
You can choose the region. |
| Transfer mechanism |
|
| Vendor role | Processor: it handles your customers' data on your instructions. Details on its role |
| Checked on | (the oldest check date of any fact on this page) |
Notes on Sentry
Sentry's DPA is accepted electronically and takes effect on the date you accept. You choose US or EU data storage when you create an organization, and you cannot change it later. Sentry's docs list data that stays in the US regardless of the choice, such as user accounts and access tokens.
The DPA gives 30 days' prior written notice of subprocessor changes (section 7.2). You can object during that period, but the DPA gives no separate day count for objections. The subprocessor page offers an RSS feed for change alerts.
Sentry DPA: where to find it and how it is accepted
Read the DPA on sentry.io. Accepted electronically or by otherwise agreeing or opting in; effective from the date you accept (preamble). Latest version we saw: 5.1.0, May 29, 2024..
Source: sentry.io, checked 2026-10-16Sentry subprocessors: the list and how change notices reach you
Sentry's subprocessor list (8 entries on the check date).
Source: sentry.io, checked 2026-10-168 third-party subprocessors in the "General" table; 3 Sentry affiliates are listed separately and not counted. Last updated June 1, 2026.
Source: sentry.io, checked 2026-10-16How changes are announced: Written notice by email or other means specified on the subprocessor page, which also offers an RSS feed.
Source: sentry.io, checked 2026-10-16Notice before a new subprocessor starts: 30 days.
Section 7.2: thirty (30) days' prior written notice by email or other means specified on the subprocessor page.
Source: sentry.io, checked 2026-10-17You may object to the appointment or replacement of a subprocessor prior to it, on reasonable grounds that it does not or cannot comply with the DPA's requirements. If Sentry does not remedy or provide a reasonable workaround within a reasonable time, your sole remedy (and Sentry's sole liability) is to terminate the Agreement for convenience without further liability to either party (section 7.3).
Source: sentry.io, checked 2026-10-17Where Sentry stores data
- United States (Iowa)
- European Union (Frankfurt, Germany)
You can choose the region.
You pick US or EU storage when creating an organization and cannot change it later. Some data stays in the US regardless (for example user accounts, access tokens, support tickets), and uptime-check data may be stored outside the selected region. DPA section 6: Sentry may store and process Customer Data in the United States and any other country where it or its subprocessors operate.
Source: docs.sentry.io, checked 2026-10-16How Sentry moves data outside the EU and UK
- DPF
- SCCs (Modules 2 and 3, fallback)
- UK Addendum
- Swiss FADP modifications
Schedule 3: Sentry relies on the DPF for transfers to the US; the SCCs apply if the DPF is invalidated or does not apply. UK Addendum version B1.0 and Swiss modifications are incorporated.
Source: sentry.io, checked 2026-10-16EU-U.S. Data Privacy Framework list: listed.
Listed on the Data Privacy Framework participant list as "Sentry.io (legal name Functional Software Inc.)": EU-U.S. DPF, UK Extension and Swiss-U.S. DPF all shown as Active. The DPA (Schedule 3) says Sentry complies with the Data Privacy Framework. Read from the list's own participant data on 2026-10-17.
Source: www.dataprivacyframework.gov, checked 2026-10-17Is Sentry a processor or a controller?
Processor: it handles your customers' data on your instructions.
Section 3: Sentry is a processor and you are the controller, or a processor acting for a third-party controller.
Source: sentry.io, checked 2026-10-16Is Sentry GDPR compliant?
We don't give a compliance verdict, and no vendor can be 'GDPR compliant' on its own; compliance depends on how you use it. Here is what Sentry's own documents say:
- A DPA is published: Accepted electronically or by otherwise agreeing or opting in; effective from the date you accept (preamble). Latest version we saw: 5.1.0, May 29, 2024.
- A subprocessor list is published.
- Notice of new subprocessors: 30 days. Section 7.2: thirty (30) days' prior written notice by email or other means specified on the subprocessor page.
- Transfer mechanisms named: DPF, SCCs (Modules 2 and 3, fallback), UK Addendum, Swiss FADP modifications.
- Data locations named: United States (Iowa), European Union (Frankfurt, Germany).
What stays with you: accepting or signing the DPA where it needs that, choosing and setting the region, your own records of processing, and any consent or notices your own users need.
Add Sentry to your own subprocessor list
This row uses the facts above. Change the purpose to match how you use Sentry, then paste it into your list, or open it in the generator to add your other vendors.
| Vendor | Purpose | Data location | Transfer mechanism | Vendor DPA | Vendor subprocessor list |
|---|---|---|---|---|---|
| Sentry | Error and performance monitoring | United States (Iowa); European Union (Frankfurt, Germany) | DPF; SCCs (Modules 2 and 3, fallback); UK Addendum; Swiss FADP modifications | DPA | List |
Same row as Markdown
| Vendor | Purpose | Data location | Transfer mechanism | Vendor DPA | Vendor subprocessor list |
| --- | --- | --- | --- | --- | --- |
| Sentry | Error and performance monitoring | United States (Iowa); European Union (Frankfurt, Germany) | DPF; SCCs (Modules 2 and 3, fallback); UK Addendum; Swiss FADP modifications | [DPA](https://sentry.io/legal/dpa/) | [Subprocessors](https://sentry.io/legal/subprocessors/) |
If you add or replace Sentry: what to tell your customers
Under Art. 28(2) GDPR, a processor that engages another processor needs its customer's authorisation. Where that authorisation is general, the processor must tell the customer about intended additions or replacements and give it a chance to object. The GDPR sets no fixed number of days. Customer DPAs usually set one, so check the number you agreed to.
Sentry states 30 days of notice before it adds a subprocessor. Section 7.2: thirty (30) days' prior written notice by email or other means specified on the subprocessor page. If your own customers were promised a longer notice, you have a gap to plan for.
Use the subprocessor list template for the list itself. Tell customers before the change takes effect: what changes, the new vendor's purpose and location, the date, and how to object.
What changed
- Re-checked DPA sections 7.2 and 7.3 against the raw text (numbering confirmed by the DPA's own cross-references to "Section 7.2 (List of Subprocessors)"). Added the objection ground: "reasonable grounds that the Subprocessor does not or cannot comply with the requirements set forth in this DPA". Notice and remedy unchanged.
- Checked the Data Privacy Framework list: "Sentry.io (legal name Functional Software Inc.)" is listed (EU-U.S. DPF, UK Extension and Swiss-U.S. DPF all shown as Active). dpf_listed set to true.
- First check: facts recorded from Sentry's own DPA (version 5.1.0), subprocessor list (June 1, 2026) and data storage docs.
Related vendors
Sources and method
- https://sentry.io/legal/dpa/ checked 2026-10-16
- https://sentry.io/legal/subprocessors/ checked 2026-10-16
- https://docs.sentry.io/organization/data-storage-location/ checked 2026-10-16
- https://www.dataprivacyframework.gov/participant/5869 checked 2026-10-17
Facts come from Sentry's own public pages, read by hand, and can change. Read the source before relying on it. The facts and templates here are not legal advice. How we check: methodology, which also says where to report an error. Official site: sentry.io.