dotCMS

dotcms.com

dotCMS declares 5 subprocessors in its subprocessor list, which we last checked on Nov 12, 2026 (evidence). They include Amazon Web Services, Google Cloud and GitHub. No published changes since we first read it on Sep 28, 2026.

Subprocessors CSV · Atom DORA draft CSV what's this? · 

5 third parties.

NamePurposeLocationListed since
AWS Cloud Service Provider
GitHub Software development platform
Google Cloud Platform Cloud provider
Keeper Password manager
Strong DM Single sign-on

Web TechnologiesCSV · Atom

dotCMS's homepage made 318 requests to 33 domains, 17 services controlled by another company, and 1 domain not identified.

Analytics (6): HubSpot, LeadBoxer, G2.com, LinkedIn, Meta, BomboraMarketing automation (4): Warmly, GetVector, Inc., Salesloft, ClearbitAdvertising (3): Google Cloud, Reddit, Inc.; usually detected as Advertising: MicrosoftOther (4): Customer data platform: Meiro; Email: LiveIntent; Security: ClickCease™; usually detected as Widgets: Navattic

17 third parties by category: Analytics 6Marketing automation 4Advertising 3Other 4

Third parties 17 · 217 requests
Navattic navattic.com 41% of the page's requests 130
Warmly Warmly 6% of the page's requests 20
Google Cloudsubprocessor DoubleClick Floodlight Google Analytics Google Tag Manager 5% of the page's requests 15
HubSpot HubSpot HubSpot Analytics 3% of the page's requests 9
GetVector, Inc. Vector 2% of the page's requests 7
Microsoft clarity.ms 2% of the page's requests 7
Meiro Meiro 2% of the page's requests 5
LeadBoxer LeadBoxer 1% of the page's requests 4
G2.com G2 Track Your Prospects <1% of the page's requests 3
LinkedIn Linkedin Insight Tag <1% of the page's requests 3
Meta Facebook Pixel 2.9.439 <1% of the page's requests 3
Reddit, Inc. Reddit Ads <1% of the page's requests 3
Salesloft Salesloft <1% of the page's requests 3
Bombora Bombora <1% of the page's requests 2
Clearbit Clearbit <1% of the page's requests 1
ClickCease™ ClickCease <1% of the page's requests 1
LiveIntent LiveIntent <1% of the page's requests 1
Unknown 1 · 1 request

usbrowserspeed.com

First party 1 · 100 requests
dotCMS GSAP Google Font API HSTS HubSpot Cookie Policy Banner Lucide Microsoft Clarity Next.js 16.3.7 Next.js App Router Open Graph Priority Hints React Turbopack Vercel Vercel Speed Insights 1.3.1 Webpack core-js 3.49.0 31% of the page's requests 100

12 tracked companies loaded by the homepage are not in dotCMS's subprocessor list. A website can use a service without it processing customer data.

ComplianceCSV · Atom

Certified

Certifications as dotCMS's trust center lists them; reports are usually shared on request (evidence)

Security recordCSV · Atom

What public security catalogs list for dotCMS, in their words.

Known exploited vulnerabilities

1 vulnerability in dotCMS's software that CISA lists as exploited in the wild.

CVEProductVulnerabilityListed
CVE-2022-26352dotCMSdotCMS Unrestricted Upload of File Vulnerability used by ransomware

Source: CISA Known Exploited Vulnerabilities catalog (evidence)

Incidents reported by dotCMS's subprocessorsCSV · Atom

33 reported incidents in the last 30 days, by 1 of the vendors dotCMS lists as a subprocessor.

A subprocessor list names a company, not the service an incident touched. This does not show that dotCMS was involved.

DateCompanyIncidentImpactLasted
GitHubImpact across multiple GitHub products including Actions, Pages, and Copilot products. critical33 min
GitHubIncident with Webhooks minor4 min
GitHubIncident with Git Operations and Pull Requests critical1 h 44 min
GitHubDegraded availability for GPT-5.3 Codex and GPT-5.6 models in Copilot major49 min
GitHubIncident with Actions and Checks API critical46 min
GitHubIncident with Webhooks and Actions major1 h 50 min
GitHubIncreased timeouts due to surge in anonymous users minor3 h 10 min
GitHubIncrease in timeouts for some unauthenticated users minor1 h 56 min
GitHubDegraded performance for multiple GitHub services minor44 min
GitHubIncident with Actions minor52 min
GitHubIncident with Actions major35 min
GitHubIncident with Actions and Pages major55 min
GitHubIncident with Pull Requests, Git Operations and Issues major2 h
GitHubIncreased task-related errors for Copilot Mission Control minor1 h 16 min
GitHubIncident with Git Operations minor1 h 43 min
GitHubIncident with API, Git, and Copilot requests minor30 min
GitHubElevated errors on GPT-5.4 Nano minor38 min
GitHubIncident with Dependabot minor2 h 29 min
GitHubIncident with Actions, Pages, and Webhooks major1 h 32 min
GitHubDisruption with GitHub services critical31 min
GitHubDisruption with Copilot Cloud services minor2 h 29 min
GitHubDisruption with some Copilot services critical1 h 15 min
GitHubElevated 404s for GitHub App s2s tokens in git/API no impact stated—
GitHubIncident with Actions, Issues, API Requests and Pull Requests minor8 min
GitHubGrok 4.6 and Grok 4.7 Service Issues minor41 min

And 8 more. All of them: CSV · Who is around them.

ChangesCSV · Atom

See the list as we read it on any date: Time machine

None since tracking began.

Rating badge for dotCMS's site

dotCMS transparency rating

It updates with the rating.

<a href="https://thirdpartyindex.com/vendors/dotcms"><img src="https://thirdpartyindex.com/badge/dotcms.svg" alt="dotCMS transparency rating on Third Party Index" height="20"></a>
[![dotCMS transparency rating on Third Party Index](https://thirdpartyindex.com/badge/dotcms.svg)](https://thirdpartyindex.com/vendors/dotcms)