Vendasta now participates in the EU-U.S. Data Privacy Framework (DPF). The DPF gives a legal basis for transferring EU and UK customer data to Vendasta's participating U.S. entities.
Anyone can verify the listing on the public Data Privacy Framework List. Vendasta says DPF covers the transfer of data, not where the data is stored. Clients who require EU data residency should contact Vendasta before making any commitment.
The DPF sits alongside Vendasta's SOC 2 Type II report and its existing GDPR compliance program. Partners selling into the EU or UK can cite both in proposals, security questionnaires and procurement reviews. UK coverage applies through the UK Extension, as described in Vendasta's DPF Privacy Notice.