Braze procurement policy evidence
Only topics backed by verified findings appear below. Each row preserves the platform's exact policy words and capture provenance.
| Topic | Plan or tier | Risk | Their words | Source |
|---|---|---|---|---|
| DPA, audit rights & data residency | All applicable tiers | low | “Braze will not be liable in any manner for any Restricted Information received from or on behalf of Customer in breach of this Agreement. 2.6 Protection of Customer Data . Braze will maintain administrative, physical and technical safeguards designed to protect the confidentiality and integrity of Customer Data. Braze will only access, use, process, modify, delete or disclose Customer Data (a) to provide the Services in accordance with this Agreement and the Documentation, (b) to provide support services and prevent or address security, service or technical problems, (c) as compelled by law in accordance with the Confidentiality section below or as required under applicable law, or (d) as expressly permitted in writing by Customer. In order to provide Customer with accurate analytical data and optimal performance of the Services, Customer hereby instructs Braze to remove unused or unusable Customer Data in accordance with the Braze data retention policy set forth in the Documentation. The parties agree to comply with the terms of the data processing addendum at https://www.braze.com/dpa/ (“ DPA ”). 2.7 Protection of the Services . In the event that Customer is in breach of Customer’s obligations under Section 2, Braze may suspend Customer or Dashboard User access to the Services. Braze will notify Customer of any such suspension in advance, except where Braze reasonably believes the violation is willful, or in an urgent or emergency situation, and work with Customer in good faith to resolve the breach. ” | Captured 2026-06-08Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “ EU Data Act. To the extent Customer is subject to the EU Data Act (Regulation (EU) 2023/2854 of the European Parliament and of the Council of 13 December 2023 on harmonised rules on fair access to and use of data), the additional terms available HERE are applicable.” | Captured 2026-06-08Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “ 3.1 PROCESSING OF PERSONAL DATA IN THE U.S. AND ELSEWHERE Braze, Inc. is located in the United States ( "U.S." ) and our group companies operate in Singapore, Germany, Japan, Canada, France, Australia, Indonesia, the United Kingdom ( "UK" ), Ireland, Romania, Brazil, South Korea and the United Arab Emirates. Braze works with vendors and partners who operate predominantly in these countries. From time to time, we may work with vendors and partners in other parts of the world where we do business. This means that when we collect your Personal Data, we may process it in any of these countries. These countries may have data protection laws that are different from the laws of your country (and, in some cases, may not be as protective), but we have in place appropriate safeguards and international transfer mechanisms, and we also implement a number of supplementary measures designed to better protect the Personal Data with which we are entrusted. Where available, Braze, Inc. complies with the EU-U.S. Data Privacy Framework, the UK Extension to the EU-U.S. Data Privacy Framework, and the Swiss-U.S. Data Privacy Framework (collectively, the “Data Privacy Framework” ) as set forth by the U.S. Department of Commerce regarding the collection, use, and retention of Personal Data transferred from the European Union, the UK, and Switzerland, as applicable, to the U.S. in reliance on the Data Privacy Framework. For more details, please read our Data Privacy Framework Notice .” | Captured 2026-06-08Open source →Finding permalink → |
| Data retention | All applicable tiers | medium | “ 3.3 DATA RETENTION We will retain Personal Data we collect from you for so long as we have an ongoing legitimate business need to do so (in connection with the purposes set out in Part II above). We determine the appropriate retention period for Personal Data on the basis of the purpose for which we process the Personal Data, the amount, nature and sensitivity of your Personal Data processed, the potential risk of harm from unauthorized use or disclosure of your Personal Data and whether we can achieve the purposes of the processing through other means, as well as on the basis of applicable legal requirements (such as applicable statutes of limitation). When we have no ongoing legitimate business need to process your Personal Data, we will either delete or anonymize it.” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “We may also disclose Personal Data where we believe it necessary in order to protect or exercise, establish or defend our legal rights. Shared Communities - Any Personal Data or other information you choose to submit in communities, forums, blogs or chat rooms on our Websites may be read, collected and used by others who visit these forums, depending on your account settings. Law Enforcement - We may disclose Personal Data to a third party where we are legally required to do so in order to comply with any applicable law, regulation, legal process or governmental request, including government authorities, law enforcement and others. Corporate Transaction Participants - We may transfer Personal Data in connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company.” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ 4.5 CHAT TECHNOLOGIES We use chat technologies provided by third-party vendors that employ cookies and software code to operate the chat features you can use to communicate with us through our Websites. We and such third-party vendors may monitor, record and use information from your interactions with our Websites. This information includes details you have shared through online chats, data on sections of the Website you have visited, your IP address and your general geographic information (e.g., city, state). This Personal Data may be processed for the purposes outlined in Section 2.2 (Purposes of Processing).” | Captured 2026-07-10Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | unknown | “ 3.1 PROCESSING OF PERSONAL DATA IN THE U.S. AND ELSEWHERE Braze, Inc. is located in the United States ( "U.S." ) and our group companies operate in Brazil, Canada, France, Germany, Ireland, Romania, Spain, the United Kingdom ( “UK” ), Australia, Indonesia, Japan, Singapore, South Korea, and the United Arab Emirates. Braze works with vendors and partners who operate predominantly in these countries. From time to time, we may work with vendors and partners in other parts of the world where we do business. This means that when we collect your Personal Data, we may process it in any of these countries. These countries may have data protection laws that are different from the laws of your country (and, in some cases, may not be as protective), but we have in place appropriate safeguards and international transfer mechanisms, and we also implement a number of supplementary measures designed to better protect the Personal Data with which we are entrusted. Where available, Braze, Inc. complies with the EU-U.S. Data Privacy Framework, the UK Extension to the EU-U.S. Data Privacy Framework, and the Swiss-U.S. Data Privacy Framework (collectively, the “Data Privacy Framework” ) as set forth by the U.S. Department of Commerce regarding the collection, use, and retention of Personal Data transferred from the European Union, the UK, and Switzerland, as applicable, to the U.S. in reliance on the Data Privacy Framework. For more details, please read our Data Privacy Framework Notice .” | Captured 2026-07-10Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ 6.3 THE SALE AND SHARING OF PERSONAL INFORMATION Like many companies, Braze uses services that employ cookies and other technologies to collect Personal Information (including the identifiers and internet activity information described in the CCPA Chart) about your use of our Websites and other online services over time, which are provided to third parties for cross-context behavioral advertising. In addition, we may provide your contact details to our marketing or advertising vendors for cross-context behavioral advertising. This constitutes the “sale” or “sharing” of your Personal Information as defined under the CCPA. Braze provides several methods to opt out of selling or sharing. To opt out of all selling and sharing, you may click on the "Do Not Sell or Share my Personal Information" link in the footer of our Websites and follow the instructions therein. You can also opt out of advertising cookies by visiting our Cookie Consent Manager , or by enabling Global Privacy Control ( “GPC” ) in your web browser or browser extension, which we recognize to the extent required by applicable law. Enabling GPC will automatically set your cookie settings to opt out of the sharing of Personal Information for behavioral advertising. If you choose to use GPC, you will need to turn it on for each supported browser or browser extension you use. Other than GPC, we do not recognize any “do not track” signals. You can opt out of other types of behavioral advertising that are not associated with cookies by visiting our Marketing Communications Preference Center. ” | Captured 2026-07-10Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ 2.3 DISCLOSURE OF INFORMATION TO THIRD PARTIES We may disclose Personal Data to the following types of third parties and for the following purposes: Braze Affiliates - We may disclose Personal Data to Braze corporate group affiliates in connection with customer or technical support, marketing, business development, operations, account management, events or webinars, for general business purposes, in order to protect, exercise, establish or defend legal rights, where we are legally required to do so and to receive professional advice. Partners - If you use our Websites to register for an event or webinar organized by one of our partners, we may disclose your Personal Data to these partners to process your registration and manage your participation in the event. In such instances, our partner will process the relevant Personal Data as a separate controller and the partner’s use and control over your Personal Data will be governed by their privacy policy. We may also disclose your Personal Data to technology and solutions partners in connection with customer or technical support, marketing, business development and account management, and to our partners for marketing and personalized advertising purposes. Vendors – We may disclose Personal Data to third party vendors and service providers for general business purposes and to support our internal operations, including IT solutions vendors, AI vendors, marketing vendors, advertising vendors, consultants, and professional advisers acting as processors or controllers, including lawyers, bankers, auditors and insurers. ” | Captured 2026-07-10Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “We may also disclose Personal Data where we believe it necessary in order to protect or exercise, establish or defend our legal rights. Online Communities - Any Personal Data or other information you choose to submit in communities, forums, blogs or chat rooms on our Websites may be read, collected and used by others who visit these forums, depending on your account settings. Law Enforcement - We may disclose Personal Data to a third party where we are legally required to do so in order to comply with any applicable law, regulation, legal process or governmental request, including government authorities, law enforcement and others. Corporate Transaction Participants - We may transfer Personal Data in connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company.” | Captured 2026-07-10Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ 7.1 PERSONAL DATA DISCLOSURE Braze K.K. ( “Braze Japan” ) may disclose your Personal Data to Braze group affiliates and other third parties for the purposes described in Section 2.3 (Disclosure of Information to Third Parties). A list of the Braze office locations may be found at www.braze.com . The categories or items of the Personal Data that Braze Japan may disclose to a third party are the same as those described in Section 2.1 (Data Collection). When Braze Japan discloses your Personal Data to entrusted third parties, Braze Japan shall be the entity that is responsible for processing and managing your Personal Data.” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ 6.2 CATEGORIES OF PERSONAL DATA THAT WE COLLECT AND THIRD PARTIES TO WHOM THE DATA MAY BE DISCLOSED This chart ( “CCPA Chart” )describes our practices currently in use and in use during the past 12 months. The CCPA Chart summarizes the Personal Information we collect by reference to the statutory categories specified in the CCPA, and the categories of third parties to whom we may disclose it for a business purpose. These third parties are defined in Section 2.3 (Disclosure of Information to Third Parties). Information you voluntarily provide to us, such as in free-form webforms or via email, may contain other categories of Personal Information not described below. The business/commercial purposes for which we use these categories of Personal Information listed in the CCPA Chart are described above in Section 2.2 (Purposes of Processing). Our relevant data retention practices are addressed in Section 3.3 (Data Retention).” | Captured 2026-07-10Open source →Finding permalink → |
Informational only, not legal advice. Terms can change; verify every cited source and capture date during procurement review.
📢 POLICY UPDATES ALERT
AIRIN Brief
Built for compliance officers, legal counsel, and SaaS founders. Subscribe to the email digest — one short brief when a tracked vendor materially changes its terms, training policy, or risk rating. Prefer in-app? Watch platforms in your alerts inbox instead.