# FusionAuth FusionAuth declares [1 subprocessor](https://thirdpartyindex.com/vendors/fusionauth#subprocessors) in [its subprocessor list](https://trust.fusionauth.io/), which we last checked on 2026-11-11 ([evidence](https://thirdpartyindex.com/evidence/256925)). It is [Amazon Web Services](https://thirdpartyindex.com/vendors/amazon-web-services). No published changes since we first read it on 2026-10-29. [6 tracked vendors](https://thirdpartyindex.com/vendors/fusionauth#used-by) name FusionAuth as a subprocessor, including [2NDSITE Inc. (Freshbooks)](https://thirdpartyindex.com/vendors/2ndsite-inc-freshbooks), [Split.io](https://thirdpartyindex.com/vendors/split-io) and [Beyond Work](https://thirdpartyindex.com/vendors/beyond-work). FusionAuth (fusionauth.io): subprocessors, data processing agreement, security documents and changes, as monitored by Third Party Index. - Page: https://thirdpartyindex.com/vendors/fusionauth - Documents last verified: 2026-11-11 - Transparency rating: 68/100 (how much it publishes, not how secure it is): Subprocessor list 30/30; Processing locations 8/8; Purposes 0/7 (partial); Data processing addendum 0/12 (not found); Trust center 0/8 (not found); Privacy policy 6/6; security.txt 6/6; Security page 5/5; Status page 5/5; Vulnerability disclosure 0/5 (not found); Pages still reachable 8/8 - Supply chain: relies on 1 tracked vendors directly, 5 within two hops, 20 within three; 6 tracked vendors rely on it directly, 12 within two hops, 38 within three - Cite as: FusionAuth, Third Party Index, https://thirdpartyindex.com/vendors/fusionauth (data CC BY 4.0) ## Documents | Document | URL | Last verified | Last changed | |---|---|---|---| | Subprocessor list | https://trust.fusionauth.io/ | 2026-11-11 | 2026-11-11 | | Privacy policy | https://fusionauth.io/privacy-policy | 2026-11-11 | 2026-11-11 | | Security page | https://fusionauth.io/platform/security | 2026-11-11 | 2026-11-11 | | security.txt | https://fusionauth.io/.well-known/security.txt | 2026-11-11 | 2026-09-22 | | Status page | https://status.fusionauth.io/ | 2026-11-11 | 2026-11-11 | ## Subprocessors (1) As its own list states them. | Subprocessor | Purpose | Location | Listed since | |---|---|---|---| | [Amazon Web Services (AWS)](https://thirdpartyindex.com/vendors/amazon-web-services.md) | — | Worldwide | 2026-10-29 | Read from ([evidence](https://thirdpartyindex.com/evidence/179814)). CSV: https://thirdpartyindex.com/vendors/fusionauth/subprocessors.csv ## Web Technologies FusionAuth's homepage made 189 requests to 38 domains, 17 services controlled by another company, and 3 domains not identified. Loaded on 2026-11-09 by a browser that accepted nothing; other visits may load more or less. What a page loads is not a list of who receives customer data. 17 third parties by category: Advertising 5 (Google Cloud, StackAdapt, Capterra Inc., Reddit, Inc.; usually detected as Advertising: Vibe Advertising Inc.); Analytics 5 (Adobe, posthog, Clay; usually detected as Analytics: G2.com, Cloudflare); Marketing automation 3 (GetVector, Inc., HubSpot, Apollo); A/B Testing 1 (Webflow); Cookie compliance 1 (CookieYes); CDN 1 (jsDelivr); Email 1 (LiveIntent). Each company that appears controlled by another organization is counted once, under the main category of the technologies detected from it on this homepage or, when none was, the category recorded from the company's own page (marked reviewed) or else the one it is usually detected as on other published homepages (marked as such); unclassified: none of these. ### Third parties (17) - Webflow: 58 requests to website-files.com, intellimize.co, d3e54v103j8qbb.cloudfront.net; Intellimize, Webflow 1.6.0, jQuery 3.5.1 - Google Cloud: 25 requests to google.com, doubleclick.net, google-analytics.com, googlesyndication.com, googletagmanager.com; DoubleClick Floodlight, Google Analytics, Google Tag Manager - jsDelivr: 23 requests to jsdelivr.net; jsDelivr - GetVector, Inc.: 14 requests to vector.co; Vector - Adobe: 13 requests to mktoweb.com, bizible.com, marketo.net, bizibly.com; Adobe Marketo Measure, Marketo - CookieYes: 11 requests to cdn-cookieyes.com, cookieyes.com; CookieYes - posthog: 8 requests to posthog.com; PostHog - HubSpot: 7 requests to hs-scripts.com, hs-analytics.net, hs-banner.com, hsadspixel.net, hubapi.com, hubspot.com; HubSpot - Clay: 4 requests to claydar.com; Clay Web Intent - StackAdapt: 4 requests to stackadapt.com; StackAdapt - Apollo: 3 requests to aplo-evnt.com, apollo.io; Apollo.io - Capterra Inc.: 3 requests to capterra.com; Capterra - G2.com: 3 requests to g2.com - Reddit, Inc.: 3 requests to reddit.com, redditstatic.com; Reddit Ads - Cloudflare: 2 requests to cloudflare.com - LiveIntent: 1 request to liadm.com; LiveIntent - Vibe Advertising Inc.: 1 request to vibe.co ### Unknown (3) Domains not identified yet: cr-relay.com, hubspotonwebflow.com, usbrowserspeed.com ### First party (1) - FusionAuth: 1 request to fusionauth.io; Amazon CloudFront, Amazon Web Services, Cloudflare, Cloudflare Turnstile, Finsweet, HSTS, Open Graph, Swiper, Webpack, core-js 3.49.0 12 tracked companies loaded by the homepage are not in FusionAuth's subprocessor list. A website can use a service without it processing customer data. ## Subprocessor of (6) Tracked vendors whose own subprocessor lists name it, and what they say they use it for. - [2NDSITE Inc. (Freshbooks)](https://thirdpartyindex.com/vendors/2ndsite-inc-freshbooks.md): Cloud Service Provider for FreshBooks features and functionality. - [Beyond Work](https://thirdpartyindex.com/vendors/beyond-work.md): Test identity provider offered during onboarding, before a customer's own identity provider is connected - [Databox](https://thirdpartyindex.com/vendors/databox.md): Identity and access management platform used to authenticate users and manage customer identities using OAuth and OpenID Connect. - [Split.io](https://thirdpartyindex.com/vendors/split-io.md): --- Platform Services and Enablement --- Identity Management - [Truefoundry](https://thirdpartyindex.com/vendors/truefoundry.md) - [Workleap](https://thirdpartyindex.com/vendors/workleap.md): All Products; Security access management tool ## Service status Incidents it reported on its own status page. - Last 90 days: 0 reported incidents (0 major or critical, 0 minor, 0 with no impact stated) - Status page last read: 2026-11-12 - No incidents reported in the last 12 months - 2026-07-16: Investigating outage affecting multiple regions (critical) - 2026-03-02: Outage in Bahrain region (critical) The subprocessor list as we read it on any date: https://thirdpartyindex.com/labs/time-machine/fusionauth ## Security contact From its security.txt (https://fusionauth.io/.well-known/security.txt) ([evidence](https://thirdpartyindex.com/evidence/4293)): - Contact: https://fusionauth.io/security - Languages: en - Valid until 2033-10-28 --- Third Party Index (https://thirdpartyindex.com) monitors vendors' public security and privacy documents and keeps each version as evidence. Data CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/); vendors' own documents are theirs. API: https://thirdpartyindex.com/api