Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The document states that while Regional Twilio allows customers to select Ireland or Australia for Customer Content storage and processing, all other account and service usage data continues to be processed in the United States, with additional exceptions for fraud and abuse investigations that may apply even to regionally stored Customer Content.
This analysis describes what Twilio's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision discloses a material limitation on Regional Twilio's data residency scope: non-content account and usage data remains subject to US processing regardless of the region selected, creating a residual cross-border transfer exposure that customers relying on regional data residency for GDPR compliance should evaluate against their transfer mechanism and accountability obligations.
Interpretive note: The scope of 'all other data relating to your account and use of the Twilio Services' is not further defined in the document, creating uncertainty about the precise categories of data subject to residual US processing.
Under these terms, customers selecting Regional Twilio for Ireland or Australia processing retain US-based processing for all account and usage data outside of Customer Content, and Customer Content may also be transferred to the United States in fraud and abuse investigations; this disclosure affects the scope of data residency assertions customers can make to their own regulators or data subjects.
Cross-platform context
See how other platforms handle Residual US Processing for Regional Twilio Customers and similar clauses.
Compare across platforms →Monitoring
Twilio has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"If using Regional Twilio for supported products, Customer Content is stored and processed in the region selected (Ireland or Australia). Exceptions will occur as necessary to investigate issues of fraud and abuse. At this time, all other data relating to your account and use of the Twilio Services will continue to be processed in the United States to allow Twilio to continue to provide and improve our Services to you.Excerpt from Twilio's Sub-Processors
1) REGULATORY LANDSCAPE: This provision engages GDPR Chapter V and the accountability requirements under GDPR Article 5(2) for EU-based customers or customers processing EU personal data. The disclosure that non-content account data and fraud investigation data is processed in the US requires evaluation against the EU-US Data Privacy Framework, Standard Contractual Clauses, or other applicable transfer mechanisms. UK GDPR and the UK International Data Transfer Agreement impose parallel obligations for UK-directed data. Relevant enforcement authorities include EU member state supervisory authorities and the UK ICO. 2) GOVERNANCE EXPOSURE: High. Customers who have represented to data subjects, regulators, or internal governance bodies that their Twilio processing is fully regionalized may need to revisit those representations in light of this disclosure. The scope of 'all other data relating to your account and use of the Twilio Services' is not further defined in the document, creating uncertainty about which data categories remain subject to US processing alongside Customer Content. 3) JURISDICTION FLAGS: EU/EEA customers contracting with Twilio Ireland Ltd. face the highest exposure, as the residual US processing of account and usage data by Twilio Inc. (which is listed as a Twilio Group sub-processor) requires a valid transfer mechanism. UK customers face parallel exposure under UK GDPR. Customers in sectors with strict data localization requirements (healthcare, financial services, public sector) should assess whether the residual US transfer is consistent with their sector-specific obligations. 4) CONTRACT AND VENDOR IMPLICATIONS: The DPA between the customer and Twilio should be reviewed to confirm that the residual US processing disclosed in this footnote is covered by appropriate transfer mechanisms, including Standard Contractual Clauses or EU-US Data Privacy Framework certification for Twilio Inc. The fraud and abuse exception for Customer Content transfers to the US is not further defined in terms of scope, duration, or notification, which may require contractual clarification. 5) COMPLIANCE CONSIDERATIONS: Compliance teams should update data processing records and privacy notices to reflect that account and usage data is processed in the United States even under Regional Twilio configurations. Data Protection Impact Assessments should be reviewed to ensure the residual US transfer is assessed and documented. Legal teams should confirm what transfer mechanisms Twilio relies upon for the US processing of non-content data and whether those mechanisms are referenced in the applicable DPA.
This provision discloses a material limitation on Regional Twilio's data residency scope: non-content account and usage data remains subject to US processing regardless of the region selected, creating a residual cross-border transfer exposure that customers relying on regional data residency for GDPR compliance should evaluate against their transfer mechanism and accountability obligations.
Under these terms, customers selecting Regional Twilio for Ireland or Australia processing retain US-based processing for all account and usage data outside of Customer Content, and Customer Content may also be transferred to the United States in fraud and abuse investigations; this disclosure affects the scope of data residency assertions customers can make to their own regulators or data subjects.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Twilio.