# Composio

Composio (composio.dev): subprocessors, data processing agreement, security documents and changes, as monitored by Third Party Index.

- Page: https://thirdpartyindex.com/vendors/composio
- Documents last verified: 2026-10-03
- Transparency rating: 84/100 (how much it publishes, not how secure it is): Subprocessor list 30/30; Processing locations 8/8; Purposes 7/7; Data processing addendum 12/12; Trust center 8/8; Privacy policy 6/6; security.txt 0/6 (not found); Security page 0/5 (not found); Status page 5/5; Vulnerability disclosure 0/5 (not found); Pages still reachable 8/8
- Supply chain: relies on 8 tracked vendors directly, 55 within two hops, 243 within three; 6 tracked vendors rely on it directly, 13 within two hops, 721 within three
- Cite as: Composio, Third Party Index, https://thirdpartyindex.com/vendors/composio (data CC BY 4.0)

## Documents

| Document | URL | Last verified | Last changed |
|---|---|---|---|
| Trust center | https://trust.composio.dev/?cta\_placement=footer-trust | 2026-10-03 | 2026-10-03 |
| Subprocessor list | https://trust.composio.dev/subprocessors | 2026-10-03 | 2026-10-03 |
| Data processing addendum | https://composio.dev/legal/dpa | 2026-10-03 | 2026-10-03 |
| Privacy policy | https://composio.dev/privacy | 2026-10-03 | 2026-10-03 |
| Terms | https://composio.dev/terms | 2026-10-03 | 2026-10-03 |
| Status page | https://status.composio.dev/ | 2026-10-03 | 2026-10-03 |

## Subprocessors (8)

As its own list states them.

| Subprocessor | Purpose | Location | Listed since |
|---|---|---|---|
| [Amazon Web Services](https://thirdpartyindex.com/vendors/amazon-web-services.md) | Cloud infrastructure; Hosts and processes customer request data across AWS cloud infrastructure, including ECS Fargate, Lambda, RDS, S3, Secrets Manager, KMS, and related networking/security services. | us-east-1 N Virginia | 2026-10-03 |
| [ClickHouse](https://thirdpartyindex.com/vendors/clickhouse.md) | Stores trigger logs, delivery callbacks, tool/metering usage logs. | Stores logs and activity | 2026-10-03 |
| [Cloudflare](https://thirdpartyindex.com/vendors/cloudflare.md) | Workers to delivers trigger payloads to customer webhooks; file upload relay downloads third-party files and writes them to R2 storage. | DNS and Workers | 2026-10-03 |
| [E2B](https://thirdpartyindex.com/vendors/e2b.md) | Provides isolated cloud sandboxes for executing customer-requested Python/bash workflows and processing temporary files/artifacts during Tool Router Workbench sessions. | Workbench Sessions | 2026-10-03 |
| [OpenAI](https://thirdpartyindex.com/vendors/openai.md) (AI model provider: OpenAI) | Processes prompts, reranking inputs, and embeddings where OpenAI models are selected or routed. We've \*Disabled\* sharing data for improving models and training on our data. | LLM inferences | 2026-10-03 |
| [OpenRouter](https://thirdpartyindex.com/vendors/openrouter.md) (AI model provider: OpenRouter) | Provides an API gateway for accessing third-party AI models and managing usage. When Composio sends prompts through OpenRouter, OpenRouter routes those requests to the selected model provider, which may also process the content. All requests are sent with \`zdr: true\` | AI model access and inference routing | 2026-10-03 |
| [Pusher](https://thirdpartyindex.com/vendors/pusher.md) | Realtime trigger delivery to SDK/CLI channels; receives trigger event payloads. | Real time Trigger delivery | 2026-10-03 |
| [Vercel](https://thirdpartyindex.com/vendors/vercel.md) | Backend processes all API requests via Vercel hosted service. Additionally, Vercel AI routes selected AI SDK model calls to configured model providers for workbench/runtime flows. We've enabled ZDR on Vercel. | Serves APIs, Vercel AI for LLM routing | 2026-10-03 |

Read from ([evidence](https://thirdpartyindex.com/evidence/35863)). CSV: https://thirdpartyindex.com/vendors/composio/subprocessors.csv

AI model providers (or a cloud provider's AI model service) among these entries: 2. All vendors that list one: https://thirdpartyindex.com/ai

## Compliance

As its trust center lists them.

- Audited: SOC 2 Type II, ISO/IEC 27001 ([evidence](https://thirdpartyindex.com/evidence/35870))

## Subprocessor of (6)

Tracked vendors whose own subprocessor lists name it, and what they say they use it for.

- [Atomicwork](https://thirdpartyindex.com/vendors/atomicwork.md)
- [Kolsetu](https://thirdpartyindex.com/vendors/kolsetu.md)
- [Mintlify](https://thirdpartyindex.com/vendors/mintlify.md)
- [OpenTag](https://thirdpartyindex.com/vendors/opentag.md): Integration platform
- [Sliq](https://thirdpartyindex.com/vendors/sliq.md): OAuth authentication for select third-party integrations
- [Viktor](https://thirdpartyindex.com/vendors/viktor.md): Integration connectivity platform (for certain connected tools)

---

Third Party Index (https://thirdpartyindex.com) monitors vendors' public security and privacy documents and keeps each version as evidence. Data CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/); vendors' own documents are theirs. API: https://thirdpartyindex.com/api