Clay Labs

Yes. Clay Labs's SOC 2 status, frameworks, auditor, and renewal timing are on SOC2C for vendor risk and security reviews. Request the underlying report through SOC2C to complete your third-party risk file.

Yes — Clay Labs undergoes third-party penetration testing as part of its security program. The pentest vendor is listed on its SOC2C profile.

Clay Labs publishes a penetration test summary on its trust center. You can request access to it through SOC2C.

Clay Labs publishes an ISO certificate on its trust center; you can request access through SOC2C.

Security isn't a single yes/no, but Clay Labs is SOC 2 Type II compliant and holds SOC 2 Type II, SOC 2 Type I, GDPR, CCPA, ISO 27001, and undergoes third-party penetration testing. SOC2C verifies its compliance posture and shows how strongly each fact is proven.

Clay Labs hasn't listed a bug bounty or vulnerability disclosure program on SOC2C. Many companies accept security reports at security@clay.com or via a /security page (Clay Labs lists a security contact).

Clay Labs lists 34 subprocessors on its trust center, including Amazon Web Services, Amplitude, Anthropic, Braintrust, Datadog. Buyers use this for fourth-party risk review.

Clay Labs hosts on AWS. Data residency details are on its trust center.

Clay Labs's trust center is at https://trust.clay.com. Its verified SOC 2 status, frameworks, and documents are summarized on its SOC2C profile.

We would not work with data providers who break the law. While we are not in a position to assess each provider’s specific practices, we work with data providers who have established strong reputations and employ industry-standard practices to gather the lead data they provide. If you have questions about a specific provider, we would invite you to reach out to that provider directly.

We work with more than seventy integration partners who use industry-standard practices to collect lead data from a wide array of sources. Some sources are public. Others may be private or proprietary. While we are not in a position to assess each provider’s specific practices, we work with data providers who have established strong reputations and employ industry-standard practices to gather the lead data they provide. If you have questions about a specific provider, we would invite you to reach out to that provider directly.

Clay works with more than seventy third-party data providers. While we are not in a position to monitor each provider’s specific practices, it is possible that some of the data they provide to Clay customers is collected in other countries. Insofar as that is the case, Clay relies on each provider to ensure the lawful transfer of data. To the extent Clay is required to legitimize data transfers pursuant to the GDPR, it does so using Standard Contractual Clauses.

We would only notify people where required to do so by law. When Clay connects its users with third-party data providers, or provides tools that enable its customers to collect data from websites, Clay is acting as a data processor or service provider, not a data controller. In those cases, we would rely on the third-party data provider (or other data controller) to provide any required notifications. Clay customers are, of course, free to provide notifications to people whose data they collect. We leave it to each data provider or customer to make its own assessment about any legal obligations they might have in this regard.

We would only obtain consent where required to do so by law. When Clay connects its users with third-party data providers, or provides tools that enable its customers to collect data from websites, Clay is acting as a data processor or service provider, not a data controller. In those cases, we would rely on the third-party data provider (or other data controller) to obtain any required consent. While we are not in a position to monitor each provider’s specific practices, we expect and assume each of them obtains any permissions they would be required to obtain under the law – if any permission is required at all. In many cases, people may have already acknowledged and agreed their information may be copied when they share it on platforms like LinkedIn based on the User Agreement - https://www.linkedin.com/legal/user-agreement-summary - they accept upon signing up: “When you share information on our Services, you understand that others can see, copy and use that information.” If you have questions about a specific provider, we would invite you to reach out to that provider directly.

We rely on each third-party data provider to determine whether notice may be required, and provide any notice that may be required. If you have questions about a specific provider, we would invite you to reach out to that provider directly.

We rely on each third-party data provider to determine whether any consent would be required, and to obtain any such consent if any consent is required at all. In many cases, people may have already acknowledged and agreed their information may be copied when they share it on platforms like LinkedIn based on the User Agreement - https://www.linkedin.com/legal/user-agreement-summary - they accept upon signing up: “When you share information on our Services, you understand that others can see, copy and use that information." If you have questions about a specific provider, we would invite you to reach out to that provider directly.