Is Cyberhaven UK GDPR compliant?
answer from its trust card · not checked yet
> short_answer
Cyberhaven handles customer data, so it acts as a supplier under UK GDPR. You’ll want a contract that covers processing, and to check where the data goes. The facts below are from its trust card.
No tool is “compliant” on its own; compliance depends on how you use it. This page shows the facts you need to decide.
The facts that matter for UK GDPR
Data location: United States: every sub-processor it lists is in the US.○ unclaimed
Sub-processors: Google Cloud (hosting), OpenAI (AI features), Anthropic (AI-enabled services and analytics), Pendo (anonymised analytics), WorkOS (directory integration), Salesforce and Atlassian (support), Twilio SendGrid (email); all US.○ unclaimed
Certifications: ISO 27001:2022, ISO 27017, ISO 27701, ISO 42001, SOC 2 Type 2, PCI DSS 4.0.1○ unclaimed
What you still need to do
- Add it to your record of processing. Pre-filled entry
- Check your contract covers processing and any transfers abroad. DPIA starter
- Watch it, so you hear if any of this changes. Watch Cyberhaven