Subprocessor list — SurveyMonkey

Cited by

Facts read from this source

• Document updated Report an error

  “UPDATED: November 3, 2025”

• Dpf certification Report an error

  “SurveyMonkey Inc. also self-certifies under the EU-U.S. Data Privacy Framework, the UK Extension to the EU-U.S. Data Privacy Framework and the Swiss-U.S. Data Privacy Framework Principles.”

• US entity Report an error

  “If you are a US Customer, your contract will include a Data Protection Addendum (“DPA”) with SurveyMonkey's US entity: SurveyMonkey Inc.”

• EU entity Report an error

  “If you are a Customer based in the EEA, UK, or Switzerland your contract will include a Data Protection Addendum (“DPA”) with SurveyMonkey's Irish entity: SurveyMonkey Europe UC.”

• Encryption at rest Report an error

  “SurveyMonkey encrypts all data at rest in our data centres using AES 256 based encryption.”

• Encryption in transit Report an error

  “SurveyMonkey encrypts all data in motion using (i) RSA with 2048 bit key length based certificates generated via a public Certificate Authority, for communications with entities outside SurveyMonkey's data centres, and (ii) RSA 256 certificates generated via Internal Certificate Authority, for all the data within the data centre.”

• EU data residency Report an error

  “Some SurveyMonkey Customers (for example, Customers of GetFeedback Digital) have their data stored only in the European Union.”

• Fisa 702 upstream Report an error

  “SurveyMonkey is not eligible to receive “upstream” or bulk surveillance orders under FISA § 702.”

• Eo 12333 Report an error

  “SurveyMonkey does not assist — and cannot be ordered to assist — US authorities in their collection of information under Executive Order 12333.”

• Access controls Report an error

  “SurveyMonkey uses access controls such as multi-factor authentication, Single Sign On, access on an as-needed basis, strong password controls, and restricted access to administrative accounts.”

• Data minimization Report an error

  “SurveyMonkey implements data minimization techniques to limit the amount of personal data which is transferred from the EU to third party jurisdictions to include, where appropriate, pseudonymization or deidentification of data.”

• Sccs Report an error

  “SurveyMonkey will agree to enter into SCCs with Customers.”

• Aws Report an error

  “Amazon Web Services (“AWS”) Cloud hosting and data storage; generative AI technology for SurveyMonkey's AI features (AWS Bedrock) USA, Canada, Ireland”

• Openai Report an error

  “OpenAI Machine Learning services to support AI product features USA”

• Anthropic Report an error

  “Anthropic AI tool used to provide customer-requested professional services USA”

• Abacus Report an error

  “Abacus.ai Operationalization of machine learning models USA SurveyMonkey”

• Salesforce Report an error

  “Salesforce Customer Support USA SurveyMonkey, Audience/Market Research, SM Apply, GetFeedback Direct, Wufoo”

• Snowflake Report an error

  “Snowflake Storage of usage data for analytics and product development, and quality analysis of de-identified response data USA”

• Sparkpost Report an error

  “Sparkpost (MessageBird) Email delivery service USA”

• Twilio Report an error

  “Twilio SMS delivery service USA”

• Scalegrid Report an error

  “ScaleGrid Database hosting Ireland GetFeedback Digital”

• Google Report an error

  “Google Open-text response translation; hosts survey and respondent assets; NLP for respondent data USA GetFeedback Direct, GetFeedback Digital”

• Heroku Report an error

  “Heroku (Salesforce) Application host and data store USA GetFeedback Direct”

• Sentry Report an error

  “Functional Software Inc. (Sentry.io) Application error capturing and site health monitoring USA GetFeedback Direct”

• Affiliates Report an error

  “SurveyMonkey Affiliates (SurveyMonkey Inc.; SurveyMonkey Australia Pty Limited; SurveyMonkey Canada Inc.; SurveyMonkey UK Ltd.; SurveyMonkey Technology Costa Rica SRL; SurveyMonkey Software India Private Limited) Customer and product support, product development, infrastructure, and technology services USA, Australia, Canada, UK, Costa Rica, India”

• Merge Report an error

  “Merge API, Inc. For customers using the HRIS integration, Merge facilitates the customer-authorized transfer of data from the customer’s chosen HRIS to the the SurveyMonkey platform USA SurveyMonkey”

• Upwork Report an error

  “Upwork Professional services, customer support, and engineering team augmentation (contractors) USA, Australia, Italy, Brazil”

• Segmented by service Report an error

  “Please note that not all subprocessors are used in the provision of all of our Services. Our subprocessor list is segmented into specific SurveyMonkey services.”

• Notifications available Report an error

  “If you wish to receive email notifications of updates to our Subprocessor List, please subscribe here.”

• Pdf download Report an error

  “Download a PDF of our current Subprocessor List here.”

• Tia conducted Report an error

  “When SurveyMonkey transfers personal data to subprocessors, we conduct a Transfer Impact Assessment (“TIA”) similar to the steps outlined above.”

• DPA online self serve Report an error

  “If you are a self-serve Customer, our online DPA contains these transfer mechanisms automatically.”

• Hris integration Report an error

  “For customers using the HRIS integration, Merge facilitates the customer-authorized transfer of data from the customer’s chosen HRIS to the the SurveyMonkey platform”

1 fact read from this page is not shown because it could not be confirmed on the page as captured.

Scores citing this record

• The Academic Researcher Consent, GDPR & respondent data
• The Academic Researcher European sovereignty
• The Data Protection Officer Consent, GDPR & respondent data
• The Data Protection Officer European sovereignty
• The HR Lead Consent, GDPR & respondent data
• The HR Lead European sovereignty
• The Market Researcher Consent, GDPR & respondent data
• The Market Researcher European sovereignty
• The Operations Manager Consent, GDPR & respondent data
• The Operations Manager European sovereignty
• The Skeptic Consent, GDPR & respondent data
• The Skeptic European sovereignty