GDPR, DPA & Security Documentation

Last updated: November 4, 2026

Tavily offers a Data Processing Agreement (DPA) to Enterprise customers and to self-serve customers subject to GDPR; contact sales@tavily.com to request one. Infrastructure is primarily in the United States, with an EU data region that may be available to Enterprise customers only. International transfers are covered by the EU Standard Contractual Clauses and the UK Addendum. The current sub-processor list, security program details, and certifications are published at trust.tavily.com, and the answers below cover incident notification and the remaining details.

Does Tavily offer a Data Processing Agreement (DPA)? On which plans, and how is it signed?

  • Yes. A DPA is available for Enterprise customers and for self-serve customers subject to GDPR. Contact sales@tavily.com to request one.

Which subprocessors receive query or result content?

  • The current sub-processor list is published at trust.tavily.com, where you can subscribe to change notifications. Customers with a DPA or Enterprise agreement also get advance notice of new sub-processors and a right to object, as set out in their agreement.

Where is data processed and stored? Is there an EU region, and is data accessed remotely from other countries?

  • Tavily's infrastructure is primarily in the United States, and may offer an EU data region for Enterprise customers only. Transfers of personal data from the EU and UK are protected by the EU Standard Contractual Clauses and the UK Addendum. Details of our security program and certifications are at trust.tavily.com.

What mechanism covers international data transfers (SCCs, UK/Swiss addenda, EU-US DPF), including for customers based outside the EU?

  • Tavily relies on the European Commission's Standard Contractual Clauses, with the UK Addendum for UK transfers.

How quickly does Tavily notify customers of a security incident or breach?

  • Tavily notifies affected customers of security incidents as required by applicable law and, where you have one, within the timeline in your DPA or Enterprise agreement. More about our security program is at trust.tavily.com.