Where is Snyk's DPA and how much notice does it give?

Snyk's data processing agreement gives 30 days' notice before a new sub-processor is engaged. Here is the clause, from our October 12, 2026 copy: “3.2 Snyk will provide Customer with thirty (30) day notice (the “Notice Period”) prior to adding or replacing any Sub-processor by posting details at https://snyk.io/policies/subprocessors/.”

What does Snyk say about data retention?

We hold no statement about data retention from Snyk's watched pages. The pages we watch: data processing agreement https://snyk.io/dpa; pricing page https://snyk.io/pricing; privacy policy https://snyk.io/privacy; sub-processor list https://snyk.io/policies/subprocessors; terms of service https://snyk.io/policies/terms-of-service/; trust and security page https://snyk.io/security. On training with customer data, Snyk's terms of service (https://snyk.io/policies/terms-of-service/, in the copy read September 20, 2026) says: “Snyk may (i) collect, analyse and otherwise process Usage Data internally for its business purposes, including for the purposes of security and analytics, to improve and enhance the Services, or for other development, diagnostic and corrective purposes in connection with the Services or other Snyk products or services, and (ii) publicly disclose Usage Data only in an aggregated and/or de-identifi…”

Vendor record · snyk.io

What Snyk promises about your data.

Where Snyk publishes its promises, how long it gives you when it adds a sub-processor, and what has changed.

Where it publishes: Snyk lists its sub-processors at snyk.io/policies/subprocessors. We last read it on October 15, 2026.
What has changed: We've recorded no change to its sub-processor list or data processing agreement between August 31, 2026 and September 15, 2026. Subscribers hear about a change the morning we read it; the public record shows it 30 days later.
Its window: When it adds a sub-processor, its clause at snyk.io/dpa (read October 12, 2026) gives you 30 days' notice.

Window: 30
Sub-processors: 44
Pages: 6
Copies: 19

Snyk DPA

Snyk's data processing agreement gives 30 days' notice before a new sub-processor is engaged. Here is the clause, from our October 12, 2026 copy:

days' notice

“3.2 Snyk will provide Customer with thirty (30) day notice (the “Notice Period”) prior to adding or replacing any Sub-processor by posting details at https://snyk.io/policies/subprocessors/.”

Found automatically and not yet checked by a person. The quote is exact, and the link goes to the source. Nothing here says whether the term is good or bad, only that Snyk published it.

snyk.io/dpa · read 2026-10-12 · fingerprint 22999afce9435556…

How it says it sends notice

“To receive notifications of changes to our Sub-processor list, please click the RSS link below. Subscribe to RSS notifications of changes to this page To subscribe to it you'll need a News Reader or other similar device.”

snyk.io/policies/subprocessors · read 2026-10-12

Notice windows across every vendor we watch

Snyk sub-processors

Snyk publishes a sub-processor list at snyk.io/policies/subprocessors; we last read it on October 15, 2026. It names 44 entries. The first 15, as the list prints them: Akamai Technologies Limited and its affiliates; Amazon Web Services, Inc. and Amazon Web Services EMEA SARL; Amplitude, Inc.; BastionX, Inc; Chargebee, Inc.; Chartmogul; Cloudflare, Inc.; Confluent, Inc.; CrowdStrike, Inc.; Datadog, Inc.; DBT Labs, Inc.; Functional Software, Inc. (Sentry); Google Cloud Platform; Google Workspace; Hubspot; and 29 more in the full table below. The public record holds no change to the list read before September 15, 2026. A change we read after September 15, 2026 is published 30 days after we read it.

44 named · full table

Every public change we have recorded · Where vendors publish their lists

How long Snyk keeps your data

We hold no statement about data retention from Snyk's watched pages. The pages we watch: data processing agreement snyk.io/dpa; pricing page snyk.io/pricing; privacy policy snyk.io/privacy; sub-processor list snyk.io/policies/subprocessors; terms of service snyk.io/policies/terms-of-service/; trust and security page snyk.io/security. On training with customer data, Snyk's terms of service (snyk.io/policies/terms-of-service/, in the copy read September 20, 2026) says: “Snyk may (i) collect, analyse and otherwise process Usage Data internally for its business purposes, including for the purposes of security and analytics, to improve and enhance the Services, or for other development, diagnostic and corrective purposes in connection with the Services or other Snyk products or services, and (ii) publicly disclose Usage Data only in an aggregated and/or de-identifi…”

Training on customer data

“Where it is necessary for us to process the information in order pursue our legitimate interests, including: providing and improving our products and services; - maintaining the security and integrity of our offerings; - minimizing claims and financial losses for us, and our customers; - promoting our products, services and brand; and - conducting research and analytics. Additional Rights. In…”

snyk.io/privacy · read 2026-09-07

Retention windows vendors publish · What vendors say about training

Stated

What the pages say

Read automatically from the pages below and shown as printed. A missing row is a gap in our reading, not proof it isn’t there.

Sub-processors named · 44 · 1 name an AI provider we list

Akamai Technologies Limited and its affiliates

The nature of the Akamai solution, for optimizing traffic management, means that Akamai processes Snyk’s customer data from the [region](https://www.akamai.com…

Amazon Web Services, Inc. and Amazon Web Services EMEA SARL

SaaS Services hosting provider serving as the backbone of our infrastructure for several of our products and Services. AWS may have access to all Customer Data…

Data can be hosted in the U.S., EU or Australia at Customer’s election. May be …

Amplitude, Inc.

Hosted in the U.S. May be accessed globally by Snyk employees.

BastionX, Inc

Hosted in the Customer’s designated hosting region, but the services, if any, will be remotely performed from (and data may be viewed and processed in) the U.S.

Chargebee, Inc.

Snyk uses Chargebee for subscription management, billing, and invoicing

EU, US

Chartmogul

Snyk uses Chartmogul for subscription analytics

Cloudflare, Inc.

Cloudflare processes Snyk’s customer data from the [region ](https://www.cloudflare.com/network/)closest to where the user is located

Confluent, Inc.

Hosted in the U.S. May be accessed globally by Snyk employees.

CrowdStrike, Inc.

CrowdStrike provides cybersecurity services to Snyk, including threat intelligence and endpoint protection, to safeguard Snyk's digital infrastructure, product…

Hosted in the US or EU (Frankfurt, Germany). May be accessed globally by Snyk e…

Datadog, Inc.

Hosted in the U.S. May be accessed globally by Snyk employees.

DBT Labs, Inc.

Hosted in the U.S. May be accessed globally by Snyk employees.

Functional Software, Inc. (Sentry)

Hosted in the U.S. May be accessed globally by Snyk employees.

Google Cloud Platform

Hosted in the U.S. May be accessed globally by Snyk employees.

Google Workspace

Hosted in the U.S. May be accessed globally by Snyk employees.

Hubspot

Snyk uses Hubspot for marketing and CRM

Intercom, Inc.

Snyk uses Intercom for customer support, marketing, and CRM

Invoiceexpress

Snyk uses Invoiceexpress for invoicing purposes

Looker

Looker is a modern data platform that enables Snyk to explore, analyze, and visualize data. It streamlines data-driven decision-making by providing insights ac…

Hosted in the EU. May be accessed globally by Snyk employees.

MongoDB Ltd.

Snyk’s products and services rely on MongoDB’s Atlas tool to efficiently manage and store diverse data types as part of our data processing pipeline. MongoDB p…

Data can be hosted in the U.S., EU or Australia depending on Customer’s selecti…

Okta, Inc. (Auth0)

Auth0 serves as an identity provider which is used to authenticate users of Snyk’s services. To perform this authentication, Auth0 will have access to personal…

Hosted in the U.S, EU or Australia at Customer’s election. May be accessed glob…

OpenAI, LLCAI · OpenAI

Hosted in the U.S. May be accessed globally by Snyk employees.

Oracle Netsuite

Snyk uses Oracle Netsuite for Enterprise Resource Planning

EU, USA

Orca Security UK Ltd

Orca is a Cloud Security Posture Management tool that facilitates Snyk’s managing and monitoring of its cloud assets which host and process Customer Data.

Hosted in the EU. May be accessed globally by Snyk employees.

Salesforce.com, Inc.

Hosted in the U.S. May be accessed globally by Snyk employees.

Sentry LLC

Hosted in the Customer’s designated hosting region, but the services, if any, will be remotely performed from (and data may be viewed and processed in) Kosovo.

Shoreline Labs, Inc. (d/b/a Nightfall)

Hosted in the U.S. May be accessed globally by Snyk employees.

Slack Technologies Limited

Slack is one of Snyk’s key internal communications systems. Snyk team members use Slack to facilitate service provision and provide customer support expeditiou…

Slack services are hosted in the United States, but processing may occur global…

Snowflake, Inc.

Snowflake is our data warehouse where we host data to facilitate business intelligence and analytics. Personal data is hosted within Snowflake for the purposes…

As embedded in the Snyk Services, data can be hosted in the U.S., EU or Austral…

Snyk, Inc.