Vendor profile
OneTrust: where is customer data stored and processed?
OneTrust stores and runs customer environments in Germany (Frankfurt) and France (Paris), with disaster recovery in Berlin and Marseille, according to its hosting table; these locations are documented but not confirmed in the data supplied. Customers choose region, and the vendor also has regions outside the EU/EEA that can be chosen away. Identity location is not stated. Support (Salesforce) and notifications and e-mail (Twilio/SendGrid) are listed as hosted in the United States, as are analytics (Pendo) and bot detection (Cloudflare Turnstile). AI agents (LangChain) are listed as hosted in the United States and the European Union. Google reCAPTCHA is global with no stated location.
See the map and sourcesWhere data is stored and processed
| Activity | In the EU/EEA | Outside the EU/EEA |
|---|---|---|
| Storage | Germany, France | – |
| Processing | Germany, France | – |
| Backup | Germany, France | – |
| Logs and telemetry | – | USA |
| Analytics and metadata | – | USA |
| Notifications and email | – | USA |
| Support | – | USA |
| AI features | Europe (country not stated) | USA |
Ownership and agreements
| Headquarters | USA |
|---|---|
| Data processing agreement | Not found on the vendor's website |
| Certifications | ISO/IEC 27001, ISO/IEC 27701, ISO/IEC 27017, ISO 9001, SOC 2, PCI DSS, HITRUST, TISAX, ENS |