Snapshot 19863
Normalized text
Scripts and page chrome removed; this is what change detection compares.
LIST OF SUB-PROCESSORS
INTRODUCTION
At OutSystems, security, privacy, and regulatory compliance are foundational to how we deliver value to our customers and to how we empower organizations to serve their customers. We
are proud to be recognized as a leader in the low-code platform market, a position built on the trust our customers place in us.
To meet the high standards our customers expect from a global technology provider, OutSystems collaborates with carefully selected third-party companies. These partners bring specialized
capabilities that enable us to innovate and scale. In certain cases these partners may, when providing services to us, process various categories of data, including Controller’s Personal Data, as
defined in our Data Processing Agreement (available here).
When such third parties are engaged to perform services that involve the processing of Controller’s Personal Data in connection with our Services (as defined in our Data Processing Agreement
and governed by our Master Subscription Agreement, available here), they are designated as sub-processors, in accordance with the terminology and requirements set forth in the General
Data Protection Regulation (GDPR). OutSystems ensures that all sub-processors are engaged pursuant to rigorous due diligence procedures and are bound by robust contractual and security
safeguards, as outlined in our Data Processing Agreement.
This document outlines the sub-processors currently engaged by OutSystems, to provide Services to our customers, in accordance with our Data Processing Agreement. Where applicable, we
also describe herein the personal data transfer mechanisms implemented to ensure an adequate level of protection when personal data is transferred internationally.
OutSystems maintains an up-to-date list of its sub-processors, which is always available here. This list may evolve over time as our operational and service delivery needs change. In accordance
with our Data Processing Agreement, customers will be notified of the appointment of any new sub-processors as determined therein.
Sub-processors relevant to an individual customer will depend on the particular OutSystems Services the customer has subscribed to. Section I. below outlines our sub-processors for ODC &
O11. Section II. below applies solely to our O11 FedRAMP offer.
To have more information on the topic, please check our FAQs available here. For any inquiries related to sub-processor engagements or data protection more broadly, customers may contact
our Data Privacy Office at [email protected].
TYPES OF SUB-PROCESSORS
OutSystems sub-processors include third-parties and OutSystems affiliates. OutSystems has designated the following categories of sub-processors:
• Infrastructure: These sub-processors provide us with cloud services and infrastructure;
• Ancillary: These sub-processors provide ancillary services to help support, operate, and maintain OutSystems Services; and
• Support and professional services: These sub-processors (OutSystems affiliates) provide support and professional services within the context of specific OutSystems Services.
SECTION I – ODC & O11 general information
1. THIRD-PARTY SUB-PROCESSORS
The tables below include information on our third-party sub-processors belonging to each of the categories mentioned above. The column on Product/Service identifies OutSystems products
and/or services for which the services of each sub-processor are used.
1.1. Infrastructure sub-processors
Product/Service Sub- Sub-processor Nature of Personal data processed Data Hosting Transfer Security measures and
processor details processing/ location mechanism additional information
name service provided
ODC & O11 AWS Europe: Amazon Hosting and cloud Customer’s application data, For application data Normally not The relevant security
(cloud) Web Services EMEA infrastructure (including customer’s application log see the information applicable, but this measures can be found in
SARL; 38 Avenue services, including data and, when AI functionalities are available here depends on the annex 1 available here.
John F. Kennedy, L- the provision of AI activated by the Customer, personal (section region chosen by Information on AWS’ sub-
1855, Luxembourg; functionalities data included in prompts and provisioning) for the customer. processors can be found
US: Amazon Web activated by the outputs). O11 and here Where applicable: here.
Services, Inc.; 410 Customer (such as (section adequacy decision
Terry Avenue North, AI Guardrails). Infrastructure (EU-U.S. Data
Seattle, WA 98109- geography) for ODC. Privacy
5210, U.S.A. For application log Framework, the UK
(depending on data see the Extension to the
location). information EU-U.S. DPF, and
available here. the Swiss-U.S. Data
Privacy
Framework).
1.2. Ancillary sub-processors
Product/Service Sub- Sub-processor Nature of Personal data processed Data Hosting Transfer Security measures and
processor details processing/ location mechanism additional information
name service provided
ODC & O11 Zendesk Zendesk, Inc. Management of Zendesk will only act as a sub- Ireland Adequacy decision The relevant security
(cloud and self- 181 Fremont St 17th support tickets - processor insofar as the customer (EU-U.S. Data measures can be found in
managed) Floor San Francisco, Helpdesk includes personal data that Privacy annex 2 available here
CA 94105 software for OutSystems processes on its behalf in Framework, the and here.
USA customer support the tickets sent to OutSystems. The UK Extension to Information on Zendesk’s
customer therefore controls what the EU-U.S. DPF, sub-processors can be
personal data will be processed by and the Swiss-U.S. found here.
Zendesk as a sub-processor. Data Privacy
Framework).
Atlassian Atlassian Pty Ltd Atlassian provides Atlassian and Adaptavist will only act Germany Standard The relevant security
Level 6, 341 George Jira, a project as sub-processors in limited contractual measures can be found in
Street management and situations: clauses here.
Sydney NSW 2000 issue-tracking (1) Where the customer requests Information on Atlassian’s
Australia software, and the provision of end-to-end sub-processors can be
Adaptavist professional services by found here.
Adaptavist Adaptavist UK provides an add- OutSystems, does not have its Germany UK adequacy The relevant security
Services Ltd, on for Jira. These own project management tool
decision issued by measures and
Adaptavist, 25 are used by and decides to share certain
the European information on relevant
Wilton Road, OutSystems for personal data that OutSystems
Commission. sub-processors can be
Victoria, London, the management processes on the customer’s
found here.
United Kingdom of support tickets behalf within this context;
SW1V 1LW escalated to (2) Where the customer includes
engineering personal data that OutSystems
teams and for the processes on its behalf in the
management of tickets sent to OutSystems and
end-to-end this ticket must be escalated to
professional one of OutSystems engineering
services, when teams to solve the issue
customers do not reported.
have their own In both cases, the customer controls
project what personal data will be processed
management by Atlassian and Adaptavist as sub-
tool. processors.
ODC & O11 Rootly Rootly Inc 1390 Management of Rootly will only act as a sub-processor USA Standard All data is encrypted at
(cloud) Market Street, Unit support tickets - in very limited situations in which (i) contractual rest using AES-256 and in
2126 San Francisco, Engineering the customer includes personal data clauses transit using TLS 1.3.
CA 94102 software for that OutSystems processes on its Rootly enforces strict
customer support behalf in the tickets sent to tenant-level data isolation
OutSystems and (ii) this ticket has to and access controls. More
be escalated to the SRE (engineering) details can be found here.
team. The customer therefore
controls what personal data will be
processed by Rootly as a sub-
processor.
II. OUTSYSTEMS GROUP SUB-PROCESSORS (SUPPORT AND PROFESSIONAL SERVICES)
OutSystems Group companies below may also act as sub-processors to the extent that these OutSystems Group companies process Controller’s Personal Data when providing (1) technical and
operational support to customers for all products (ODC and O11, including services on-premises) or (2) professional services requested by customers. The exact teams/subsidiaries to be
involved vary depending on the services to be provided.
Affiliate Affiliate details Nature of processing/ Personal data processed Processing Transfer Security measures
details (registered address) service provided location mechanism and additional
(name) information
OutSystems - (1) technical and OutSystems affiliates will only Portugal Not applicable. More details can be
Rua Central Park, Ed. 2 - 2 A, 2795-242 Linda-a-
Software em operational support to act as sub-processors in found here.
Velha, Portugal
Rede S.A. customers for all limited situations:
OutSystems, 800 Delaware Avenue, Wilmington, DE 19801, products (ODC and (1) Where the customer USA Standard
Inc. U.S.A. O11, including services requests the provision of contractual clauses.
OutSystems 3 Warners Mill, Silks Way, Braintree, Essex CM7 on-premises) and/or end-to-end professional United Adequacy decision.
Limited 3GB, United Kingdom (2) professional services by OutSystems; Kingdom
OutSystems Groenewoudsedijk 61, 3528 BG, Utrecht, services requested by (2) Where the customer Netherlands Not applicable.
Benelux B.V. Netherlands customers includes personal data
OutSystems 8 Temasek Boulevard #09-04/05 that OutSystems Singapore Standard
Singapore Pte. Suntec Three Singapore 038988, Singapore processes on its behalf in contractual clauses.
Ltd. the tickets sent to
OutSystems PO Box: 336353, Dubai Marina, Dubai, UAE OutSystems. UAE Standard
Software LLC contractual clauses.
OutSystems Ark Hills South Tower 9th floor, 1-4-5 Roppongi, In both cases, the customer Japan Adequacy decision.
Japan KK Minato-ku, Tokyo 106-0032, Japan controls what personal data
OutSystems will be processed by Germany Not applicable.
Spaces Tower One, Bruesseler Strasse 1-3, 60327
Germany OutSystems affiliates as sub-
Frankfurt, Germany
GmbH processors.
OutSystems Piper Alderman, Governor Macquarie Tower, Australia Standard
Software Pty Level 23, 1 Farrer Place, Sydney NSW 2000, contractual clauses.
Ltd Australia
OutSystems Unit 27-07, Level 27, Q Sentral, 2A, Jalan Stesen Malaysia Standard
Malaysia Sdn. Sentral 2, Kuala Lumpur Sentral, 50470 Kuala contractual clauses.
Bhd. Lumpur, Malaysia
OutSystems Philippines Standard
21st Floor, LKG Tower, 6801 Ayala Avenue, Bel-
Philippines contractual clauses.
Air, 1226 Makati City, Philippines
Inc.
OutSystems Rua dos Pinheiros, N° 870, 22nd Floor, Cj. 221, Brazil Adequacy decision.
Brasil Ltda. Pinheiros, São Paulo, CEP 05422-001, Brazil
Outsystems WeWork Galaxy, 43, Office 05A119, India Standard
India Private Residency Rd, Shanthala Nagar, contractual clauses.
Limited Ashok Nagar, Bengaluru,
Karnataka 560025
OutSystems Yeouido 1st. 7F Gukjegeumyung-ro 2-gil, Republic of Adequacy decision.
Korea, Ltd. Yeongdeungpo-gu, Seoul, Republic of Korea Korea
OutSystems Avenida Doctor Arce, number 14, 28002 Madrid, Spain Not applicable.
Spain, S.L.U. Spain
LAST UPDATED ON: 7 November 2025.
SECTION II –O11 FedRAMP
1. THIRD-PARTY SUB-PROCESSORS
The tables below include information on our third-party sub-processors belonging to each of the categories mentioned above.
1.1. Infrastructure sub-processors
Sub- Sub-processor Nature of Personal data processed Data Hosting Transfer Security measures and additional
processor details processing/ location mechanism information
name service provided
Knox Knox Systems, Inc. Hosting and cloud Customer’s application data, United States Not applicable for Knox is FedRAMP certified. More information
1606 Headway Cir Infrastructure (including customer’s application log the FedRAMP on this certification, as well as implemented
STE 9793 services. Support data). service offering. security measures and sub-processors can be
Austin, TX 78754 services (Level 1 found here.
U.S.A. support).
1.2. Ancillary sub-processors
Not applicable.
2. OUTSYSTEMS GROUP SUB-PROCESSORS (SUPPORT SERVICES)
OutSystems Group companies below may also act as sub-processors to the extent that these OutSystems Group companies process Controller’s Personal Data when providing technical and
operational support.
Affiliate Affiliate details Nature of processing/ Personal data processed Processing Transfer Security measures
details (registered address) service provided location mechanism and additional
(name) information
OutSystems - Technical and OutSystems affiliates will only Portugal Not applicable for More details can be
Rua Central Park, Ed. 2 - 2 A, 2795-242 Linda-a-
Software em operational support. act as sub-processors in the FedRAMP found here .
Velha, Portugal
Rede S.A. limited situations where service offering.
OutSystems 3 Warners Mill, Silks Way, Braintree, Essex CM7 personal data that OutSystems United
Limited 3GB, United Kingdom processes on behalf of Kingdom
OutSystems Groenewoudsedijk 61, 3528 BG, Utrecht, customers must be processed Netherlands
Benelux B.V. Netherlands to solve a ticket.
OutSystems 8 Temasek Boulevard #09-04/05 Singapore
Singapore Pte. Suntec Three Singapore 038988, Singapore
Ltd.
OutSystems PO Box: 336353, Dubai Marina, Dubai, UAE UAE
Software LLC
OutSystems Ark Hills South Tower 9th floor, 1-4-5 Roppongi, Japan
Japan KK Minato-ku, Tokyo 106-0032, Japan
OutSystems Germany
Spaces Tower One, Bruesseler Strasse 1-3, 60327
Germany
Frankfurt, Germany
GmbH
OutSystems Piper Alderman, Governor Macquarie Tower, Australia
Software Pty Level 23, 1 Farrer Place, Sydney NSW 2000,
Ltd Australia
OutSystems Unit 27-07, Level 27, Q Sentral, 2A, Jalan Stesen Malaysia
Malaysia Sdn. Sentral 2, Kuala Lumpur Sentral, 50470 Kuala
Bhd. Lumpur, Malaysia
OutSystems Philippines
21st Floor, LKG Tower, 6801 Ayala Avenue, Bel-
Philippines
Air, 1226 Makati City, Philippines
Inc.
OutSystems Rua dos Pinheiros, N° 870, 22nd Floor, Cj. 221, Brazil
Brasil Ltda. Pinheiros, São Paulo, CEP 05422-001, Brazil
Outsystems WeWork Galaxy, 43, Office 05A119, India
India Private Residency Rd, Shanthala Nagar,
Limited Ashok Nagar, Bengaluru,
Karnataka 560025
OutSystems Yeouido 1st. 7F Gukjegeumyung-ro 2-gil, Republic of
Korea, Ltd. Yeongdeungpo-gu, Seoul, Republic of Korea Korea
OutSystems Avenida Doctor Arce, number 14, 28002 Madrid, Spain
Spain, S.L.U. Spain
LAST UPDATED ON: 12 May 2026.