Data processing agreement (dpa) — Amplitude Analytics

Cited by

Facts read from this source

• DPA effective date Report an error

  “Effective: May 13, 2026”

• Dsr forwarding deadline Report an error

  “no later than three (3) business days from receipt if the communication arrives via privacy@amplitude.com”

• Breach notification hours Report an error

  “informing Customer of a Personal Data Breach without undue delay and in any event within 48 hours of becoming aware”

• Destruction certificate days Report an error

  “Amplitude will provide certification of the destruction and/or return of Personal Data within ten (10) business days of completing such destruction or return”

• List URL Report an error

  “listed at https://www.amplitude.com/subprocessor-list”

• Advance notice days Report an error

  “Amplitude will update its list of Subprocessors to include the new Subprocessor at least thirty (30) days prior to giving the Subprocessor access to the Personal Data”

• Audit frequency Report an error

  “Amplitude is audited annually against known, established industry standards performed by external auditors”

• Audit limitation months Report an error

  “a similar audit has not already been conducted less than twelve (12) months prior”

• Scc incorporated Report an error

  “the 2021 Standard Contractual Clauses form part of this DPA”

• Scc governing law Report an error

  “The parties select the law of the Netherlands.”

• UK addendum Report an error

  “the UK Addendum forms part of this DPA”

• Data privacy framework Report an error

  “the EU-U.S. Data Privacy Framework, the UK Extension to the EU-U.S. Data Privacy Framework, and the Swiss-U.S. Data Privacy Framework self-certification programs”

• Provider Report an error

  “Amplitude hosts all Customer Data in Amazon AWS.”

• Encryption standards Report an error

  “Amplitude utilizes encryption consistent with industry standard practices such as Federal Information Processing Standards FIPS 140-2 and/or NIST SP800-52”

• MFA required Report an error

  “Amplitude personnel are required to authenticate through multi-factor authentication to access the Amplitude platform.”

• Penetration testing Report an error

  “engages one or more independent third parties to conduct penetration tests of the Amplitude Services at least annually”

• Monitoring Report an error

  “Amplitude monitors its SaaS environment 24/7/365 and centralizes its logs.”

• Background checks Report an error

  “Amplitude requires criminal background screening on its personnel as part of its hiring process”

• Access reviews quarterly Report an error

  “Amplitude reviews the access privileges of its personnel to the Amplitude platform at least quarterly”

• Statsig tom URL Report an error

  “Information about the technical and organizational measures that are applicable to the Statsig-branded Amplitude Services is available at https://statsig.com/trust/security.”

• Previous DPA versions Report an error

  “October 15, 2025 September 30, 2025 June 9, 2025 June 4, 2024”

• Scc subprocessor notice days Report an error

  “Amplitude shall update the list at least ten (10) business days in advance of any intended additions or replacements of subprocessors.”

• Data returned after termination Report an error

  “Upon termination of the Agreement, Customer may retrieve its Personal Data as set forth in the Agreement and this DPA”

11 facts read from this page are not shown because they could not be confirmed on the page as captured.

Scores citing this record

• The Agency Developer Data access, export & self-hosting
• The Agency Developer European sovereignty
• The Data Protection Officer Data access, export & self-hosting
• The Data Protection Officer European sovereignty
• The E-Commerce Marketing Lead Data access, export & self-hosting
• The E-Commerce Marketing Lead European sovereignty
• The Growth Analyst Data access, export & self-hosting
• The Growth Analyst European sovereignty
• The Public-Sector Site Owner Consent-free operation & data minimisation
• The Public-Sector Site Owner Data access, export & self-hosting
• The Public-Sector Site Owner European sovereignty
• The Skeptic Data access, export & self-hosting
• The Skeptic European sovereignty