Weaviate procurement policy evidence
Only topics backed by verified findings appear below. Each row preserves the platform's exact policy words and capture provenance.
| Topic | Plan or tier | Risk | Their words | Source |
|---|---|---|---|---|
| DPA, audit rights & data residency | All applicable tiers | low | “ Weaviate Cloud. ” | Captured 2026-06-08Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “ We may, for instance, conclude so-called European Model Agreements for the transfer of personal data with our service providers. We may also supply personal data to recipients established in the US if they have a valid EU-US Data Privacy Framework certification. ” | Captured 2026-06-08Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “ For more information on how we protect your data in this context, please see Section 8 . Please note that some of these third-party providers may process your personal data outside the EU/EEA. Where this is the case, we ensure that appropriate safeguards (such as the European Commission’s Standard Contractual Clauses) are in place to protect your data in accordance with applicable data protection laws. You may object to the use of your personal data for certification purposes at any time (see Section 10 ). Please note, however, that if you withdraw your consent, you may no longer be able to participate in the certification program or receive its associated credentials.” | Captured 2026-06-08Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “ Weaviate has implemented various measures to protect your personal data. For instance, our internal procedures concerning your personal data are compliant with our internal security policy, we have obtained and commit to obtaining various data security certifications (such as SOC2 Type 1, SOC2 Type 2, and ISO27001), and we use end-to-end encryption to protect any stored personal data.” | Captured 2026-06-08Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | medium | “ These third parties may be located outside the European Economic Area. The regulations in these countries do not always provide the same level of protection of personal data as the regulations in the Netherlands. Where required, Weaviate takes appropriate measures to comply with the requirements that the applicable privacy regulations impose on the international transfer of personal data.” | Captured 2026-06-08Open source →Finding permalink → |
| Data retention | All applicable tiers | medium | “ We retain your personal data for a period of 5 years or as long as required to realize the objectives as described in this privacy policy. If we no longer require personal data, then we delete this personal data or anonymize it in order that they can no longer be linked to you.” | Captured 2026-06-08Open source →Finding permalink → |
| Data retention | All applicable tiers | low | “ 9. How do we secure your personal data and how long do we retain it? ” | Captured 2026-06-08Open source →Finding permalink → |
| Data retention | All applicable tiers | low | “ Upon expiration or termination of this Agreement, all rights and obligations will immediately terminate except that any terms or conditions that by their nature should survive such expiration or termination will survive, including the License Restrictions and terms and conditions relating to proprietary rights and confidentiality, technology restrictions, disclaimers, indemnification, limitations of liability, and termination, and the general provisions below. Upon expiration or termination of an Order Form, Customer will destroy any copies of Client Software provided under such Order Form. Upon expiration or termination of this Agreement, each party will return or destroy, at the other party’s option, any Confidential Information of such party in the other party’s possession or control.” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ Zapier : to support workflow automation related to exam scheduling, notifications, and credential delivery.” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ Zendesk, for technical support inquiry management and communications;” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ Beehiiv, for sending our newsletter;” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ For these purposes, we may share your personal data with third-party providers that support us in managing certification activities:” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ For the purposes mentioned in this Section, we may share your personal information with third parties that help us to automate and analyze our mailings. For more information on the protection of your personal data in this regard, please refer to Section 8 .” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ Stripe, for payment processing;” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ Zapier, for workflow automation.” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ 8. What parties have access to your personal data? ” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ When you register for and take an exam through our platform, we work with trusted service providers who deliver remote proctoring and security services on our behalf. Proctoring is the remote monitoring of an online exam, usually by recording a combination of your computer screen, webcam, and microphone for the duration of your exam. We remain the controller of your personal data, and video proctoring of exams is optional. Our service providers act strictly as processors and process your data only in accordance with our instructions.” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ We may disclose your personal data or make your personal data available to third parties for the purposes mentioned above. This disclosure includes the following third parties for the following purposes:” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ Hubspot, for customer relationship management and marketing automation;” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ For these purposes, we may share your personal data with third-party providers that support us in managing, automating, or analyzing research activities. For more information on how we protect your data in this context, please see Section 8 .” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ HubSpot : to analyze participation and performance of the program, and manage communications regarding the certification program and related activities.” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ Cloud providers (such as AWS and GCP), for sharing cloud metadata collected via our optional telemetry module, to enable them to contact you regarding Weaviate support, maintenance, or hosting services.” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ Condens, for securely storing and analyzing UX research sessions, managing participant information, and organizing research findings.” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ Sendgrid, for helping us with organizing, automating, and analyzing our mailings;” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ Credly : to issue, manage, and validate digital badges and certificates.” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ Google, for email, document storage, and data warehousing;” | Captured 2026-06-08Open source →Finding permalink → |
| Tier differences | All applicable tiers | low | “ Infrastructure Overhead Charge. Operating the Weaviate Dedicated Cloud offering requires the setup and maintenance of dedicated compute resources, referred to as “Infrastructure Overhead.” This overhead is essential for managing and operating Customer clusters within a single-tenant architecture, ensuring that the cluster is always available, secure, and performing optimally. Due to the inherent costs associated with maintaining a single-tenant infrastructure, a minimum charge per hour will apply, irrespective of actual usage. This charge reflects the baseline compute resources required to keep Customer Weaviate cluster operational, even during periods of low activity.” | Captured 2026-06-08Open source →Finding permalink → |
| Tier differences | All applicable tiers | low | “ “ Free Services ” means collectively the no-fee tiers of the Weaviate Offering made available by Weaviate, including the free tier of the Weaviate hosted database, the free tier of the Weaviate Embeddings service, the free tier of the Engram Service, and any other no-fee tier of the Weaviate Offering that Weaviate may make available.” | Captured 2026-06-08Open source →Finding permalink → |
| Tier differences | All applicable tiers | low | “ AIU Pricing. The Weaviate Offering may be subscribed to on an On Demand basis, where usage is invoiced in arrears every month, or on a Fixed Term basis, where a set dollar amount of usage is purchased up front. Pricing depends on whether you are in On Demand or Capacity.” | Captured 2026-06-08Open source →Finding permalink → |
| Tier differences | All applicable tiers | low | “ When Weaviate Offering entails Weaviate Cloud. Details are described in Exhibit A.1” | Captured 2026-06-08Open source →Finding permalink → |
| Tier differences | All applicable tiers | low | “ Storage and Compute. When Weaviate bills for storage and compute using purchasable AI Units, as described herein (“Weaviate AIUs”). Virtual CPUs (“vCPU”) and different types of storage tiers (Hot, warm, and cold storage) use Weaviate AIUs at certain rates based on the effective size of the Customer cluster while in operation, as set forth in the Order Form. Unless otherwise noted, when a Customer cluster is started or resumed, a minimum of one hour worth of Weaivate AIUs will be consumed. In the event Weaviate uses storage and compute resources that are equivalently larger or smaller than the initial estimation, the AIU consumption rate will be adjusted accordingly. For example, if a Customer cluster uses storage and compute resources that go over estimated usage for 30 minutes, such use is measured as one storage- or compute-Hour. Storage and compute-Hours are calculated on a per hour basis, rounded up to the nearest whole hour. Weaviate-managed storage and compute is billed at the rate of the number of Weaviate AIUs per category as listed in the Order Form, multiplied by the applicable Customer AIU price. Storage and compute appears in the usage statement as a single line item per category.” | Captured 2026-06-08Open source →Finding permalink → |
| Tier differences | All applicable tiers | low | “ When Weaviate Offering is charged through Weaviate AI Units, details are described in Exhibit A.2” | Captured 2026-06-08Open source →Finding permalink → |
| Tier differences | All applicable tiers | low | “ Weaviate AIUs. ” | Captured 2026-06-08Open source →Finding permalink → |
Informational only, not legal advice. Terms can change; verify every cited source and capture date during procurement review.
📢 POLICY UPDATES ALERT
AIRIN Brief
Built for compliance officers, legal counsel, and SaaS founders. Subscribe to the email digest — one short brief when a tracked vendor materially changes its terms, training policy, or risk rating. Prefer in-app? Watch platforms in your alerts inbox instead.