# Corpay

[1 tracked vendor](https://thirdpartyindex.com/vendors/corpay#used-by), [Expensify](https://thirdpartyindex.com/vendors/expensify), names Corpay as a subprocessor. We have not found a subprocessor list published by Corpay. We monitor 1 of its documents, which we last checked on 2026-10-26.

Corpay (corpay.com): subprocessors, data processing agreement, security documents and changes, as monitored by Third Party Index.

- Page: https://thirdpartyindex.com/vendors/corpay
- Documents last verified: 2026-10-26
- Transparency rating: 14/100 (how much it publishes, not how secure it is): Subprocessor list 0/30 (not found); Processing locations 0/8 (no list); Purposes 0/7 (no list); Data processing addendum 0/12 (not found); Trust center 0/8 (not found); Privacy policy 6/6; security.txt 0/6 (not found); Security page 0/5 (not found); Status page 0/5 (not found); Vulnerability disclosure 0/5 (not found); Pages still reachable 8/8
- Supply chain: relies on 0 tracked vendors directly, 0 within two hops, 0 within three; 1 tracked vendors rely on it directly, 1 within two hops, 1 within three
- Cite as: Corpay, Third Party Index, https://thirdpartyindex.com/vendors/corpay (data CC BY 4.0)

## Documents

| Document | URL | Last verified | Last changed |
|---|---|---|---|
| Privacy policy | https://www.corpay.com/privacy-policy | 2026-10-26 | 2026-10-18 |

## Subprocessors (0)

No subprocessor list has been found or read for this vendor.

## Security program

What CORPAY, INC.'s Form 10-K for fiscal 2025, filed Feb 27, 2026 (Item 1C) says, in its words (https://www.sec.gov/Archives/edgar/data/1175454/000117545426000018/0001175454-26-000018-index.htm).

- Led by: Chief Information Security Officer, reporting to the Chief Information Officer
- Board oversight: Technology and Security Committee
- Frameworks named: NIST CSF, PCI DSS
- Practices named: Incident response plan, Tabletop exercises, Security training, Cyber insurance
- Engages outside assessors or consultants
- Reviews its suppliers' security
- Since the fiscal 2024 report: ISO 27001 no longer named.

## Subprocessor of (1)

Tracked vendors whose own subprocessor lists name it, and what they say they use it for.

- [Expensify](https://thirdpartyindex.com/vendors/expensify.md): Financial Features; Payment Processor

---

Third Party Index (https://thirdpartyindex.com) monitors vendors' public security and privacy documents and keeps each version as evidence. Data CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/); vendors' own documents are theirs. API: https://thirdpartyindex.com/api