Data processing agreements exist with all third-party processors

GDPR Art. 28 requires a written Data Processing Agreement between a controller and any processor that handles personal data on its behalf. This is not optional even when the processor is a major vendor — Stripe, SendGrid, Vercel, Sentry, and Auth0 all offer DPAs, but they must be actively accepted through account settings; they do not apply by default. Without accepted DPAs, there is no contractual basis governing how these processors handle user data, no obligation for them to assist with DSARs or breach notification, and no mechanism to compel data deletion on contract termination. Regulators have fined controllers specifically for missing DPAs with cloud vendors.

Systematically accept DPAs for every service that touches personal data. Most major vendors offer DPA acceptance via account settings — no legal negotiation required.

DPA Checklist — complete for each processor:

Payment:  Stripe — stripe.com/legal/dpa (Dashboard > Settings > Legal)
Email:    Resend — resend.com/legal/dpa
          SendGrid — account settings > Legal
Analytics:Google Analytics — GA Admin > Data Settings > Data Sharing
          Plausible — plausible.io/data-processing-agreement
Auth:     Clerk — clerk.com/legal/dpa
          Auth0 — Dashboard > Settings
Infra:    Vercel — vercel.com/legal/dpa
          Supabase — request via support
Errors:   Sentry — account settings > Legal (sentry.io/legal/dpa)

Document accepted DPAs in docs/compliance/dpa-registry.md with: service name, data processed, DPA acceptance date, and whether SCCs are included. Reference this registry from your privacy policy's subprocessor list.