# Heap Heap declares [12 subprocessors](https://thirdpartyindex.com/vendors/heap#subprocessors) in [its subprocessor list](https://www.heap.io/heap-sub-processors), which we last checked on 2026-11-11 ([evidence](https://thirdpartyindex.com/evidence/4562)). They include [Amazon Web Services](https://thirdpartyindex.com/vendors/amazon-web-services), [Google Cloud](https://thirdpartyindex.com/vendors/google-cloud) and [OpenAI](https://thirdpartyindex.com/vendors/openai). No published changes since we first read it on 2026-09-22. [35 tracked vendors](https://thirdpartyindex.com/vendors/heap#used-by) name Heap as a subprocessor, including [Vanta](https://thirdpartyindex.com/vendors/vanta), [Deepgram](https://thirdpartyindex.com/vendors/deepgram) and [Fireflies.AI](https://thirdpartyindex.com/vendors/fireflies-ai-2). Heap (heap.io): subprocessors, data processing agreement, security documents and changes, as monitored by Third Party Index. - Page: https://thirdpartyindex.com/vendors/heap - Documents last verified: 2026-11-11 - Transparency rating: 89/100 (how much it publishes, not how secure it is): Subprocessor list 30/30; Processing locations 8/8; Purposes 7/7; Data processing addendum 12/12; Trust center 8/8; Privacy policy 6/6; security.txt 0/6 (not found); Security page 5/5; Status page 5/5; Vulnerability disclosure 0/5 (not found); Pages still reachable 8/8 - Part of: [Contentsquare](https://thirdpartyindex.com/vendors/contentsquare) - Supply chain: relies on 10 tracked vendors directly, 79 within two hops, 265 within three; 35 tracked vendors rely on it directly, 338 within two hops, 1963 within three - Cite as: Heap, Third Party Index, https://thirdpartyindex.com/vendors/heap (data CC BY 4.0) ## Documents | Document | URL | Last verified | Last changed | |---|---|---|---| | Trust center | https://trust.contentsquare.com/?product=heapio | 2026-11-11 | 2026-11-09 | | Subprocessor list | https://www.heap.io/heap-sub-processors | 2026-11-11 | 2026-09-22 | | Data processing addendum | https://contentsquare.com/privacy-center/data-processing-agreement/ | 2026-11-11 | 2026-10-13 | | Privacy policy | https://www.heap.io/privacy | 2026-11-11 | 2026-09-22 | | Terms | https://www.heap.io/terms | 2026-11-11 | 2026-09-22 | | Security page | https://www.heap.io/platform/security | 2026-11-11 | 2026-09-22 | | Status page | https://status.heap.io/ | 2026-11-11 | 2026-11-11 | | security.txt (parent company's) | https://contentsquare.com/.well-known/security.txt | 2026-11-11 | 2026-09-22 | ## Subprocessors (12) As its own list states them. | Subprocessor | Purpose | Location | Listed since | |---|---|---|---| | [Ada Support, Inc.](https://thirdpartyindex.com/vendors/ada-support.md) | Providers a customer service ticket management tool | Toronto, Canada | 2026-09-22 | | [Amazon Web Services (AWS)](https://thirdpartyindex.com/vendors/amazon-web-services.md) | Hosts the Heap AI and Customer Data and backups; Hosts the Services and Customer Data and backups | Europe: Ireland (AWS-EU-West-1); USA: Virginia (primary) and Oregon (backup) | 2026-09-22 | | Auryc | Performs analytics and reporting on Customer Data within the Session Replay add-on; Performs analytics and reporting on Customer Data within the VOC add-on | Wilmington, USA | 2026-09-22 | | [Contentsquare](https://thirdpartyindex.com/vendors/contentsquare.md) | Consulting, support, maintenance, implementation, and development | Paris, France | 2026-09-22 | | [Google Cloud Platform](https://thirdpartyindex.com/vendors/google-cloud.md) | Hosts the Session Replay add-on and Customer Data and backups; Hosts the VOC add-on and Customer Data and backups | For more information about Google’s data center locations, visit; Mountain View, USA; Mountain View, USA For more information about Google’s data center locations, visit; this link | 2026-09-22 | | [Hotjar](https://thirdpartyindex.com/vendors/hotjar.md) | Consulting, support, maintenance, implementation, and development | Malta | 2026-09-22 | | [IBM](https://thirdpartyindex.com/vendors/ibm.md) | Performs analytics and reporting on Customer Data within the VOC | Armonk, USA | 2026-09-22 | | [Looker Studio (Google)](https://thirdpartyindex.com/vendors/google-cloud.md) | Performs analytics and reporting on Customer Data within the Session Replay add-on | Mountain View, USA | 2026-09-22 | | [OpenAI](https://thirdpartyindex.com/vendors/openai.md) (AI model provider: OpenAI) | Provides large language model | San Francisco, USA | 2026-09-22 | | [Scaletrix](https://thirdpartyindex.com/vendors/scaletrix-com.md) | Professional services partner | Gurgaon, India | 2026-09-22 | | [Snowflake](https://thirdpartyindex.com/vendors/snowflake.md) | Gives access to data analytics and reports of Customer Data in their Snowflake instance (“Snowflake integration”); Hosts the Services and Customer Data and backups (“Heap-Hosted Snowflake”) | Bozeman, USA | 2026-09-22 | | [Zendesk, Inc.](https://thirdpartyindex.com/vendors/zendesk.md) | Provides a customer service platform | San Francisco, USA | 2026-09-22 | Read from ([evidence](https://thirdpartyindex.com/evidence/4562)). CSV: https://thirdpartyindex.com/vendors/heap/subprocessors.csv AI model providers (or a cloud provider's AI model service) among these entries: 1. All vendors that list one: https://thirdpartyindex.com/ai ## Compliance As its trust center lists them. - Audited: SOC 2 Type II, ISO/IEC 27001, ISO/IEC 27017, ISO/IEC 27018, ISO/IEC 27701, ISO 9001 ([evidence](https://thirdpartyindex.com/evidence/1991)) ## Web Technologies Heap's homepage made 149 requests to 33 domains, 16 services controlled by another company, and 1 domain not identified. Loaded on 2026-11-04 by a browser that accepted nothing; other visits may load more or less. What a page loads is not a list of who receives customer data. 16 third parties by category: Analytics 4 (Meta, LinkedIn, G2.com, Rampmetrics); Marketing automation 4 (6Sense Insights, Inc., Clearbit, Adobe, Apollo); Advertising 2 (Google Cloud, Reddit, Inc.); Security 2 (FingerprintPro; usually detected as Security: Amazon Web Services); Cookie compliance 1 (OneTrust); CDN 1 (jsDelivr); Appointment scheduling 1 (Chili Piper); Personalisation 1 (usually detected as Personalisation: Contentful). Each company that appears controlled by another organization is counted once, under the main category of the technologies detected from it on this homepage or, when none was, the category recorded from the company's own page (marked reviewed) or else the one it is usually detected as on other published homepages (marked as such); unclassified: none of these. ### Third parties (16) - Google Cloud: 22 requests to google.com, doubleclick.net, googletagmanager.com, google-analytics.com; DoubleClick Floodlight, Google Analytics, Google Tag Manager (its subprocessor list names it too) - 6Sense Insights, Inc.: 18 requests to 6sc.co, 6sense.com; 6sense - Contentful: 16 requests to ctfassets.net - OneTrust: 13 requests to cookielaw.org, onetrust.com; OneTrust - Clearbit: 8 requests to clearbitjs.com, clearbit.com, clearbitscripts.com; Clearbit - Meta: 5 requests to facebook.net, facebook.com; Facebook Pixel 2.9.435 - LinkedIn: 4 requests to linkedin.com, licdn.com; Linkedin Insight Tag - Reddit, Inc.: 4 requests to reddit.com, redditstatic.com; Reddit Ads - FingerprintPro: 3 requests to fpjs.io, fpjscdn.net; Fingerprint - G2.com: 2 requests to g2.com, g2crowd.com; G2 Track Your Prospects - jsDelivr: 2 requests to jsdelivr.net; jsDelivr - Adobe: 1 request to marketo.net; Marketo - Amazon Web Services: 1 request to on.aws (its subprocessor list names it too) - Apollo: 1 request to apollo.io; Apollo.io - Chili Piper: 1 request to chilipiper.com; Chili Piper - Rampmetrics: 1 request to rampmetrics.com; Rampmetrics ### Affiliates (1) - Contentsquare: 6 requests to contentsquare.com (its subprocessor list names it too) ### Unknown (1) Domains not identified yet: rm-api.com ### First party (1) - Heap: 40 requests to heap.io, heap-api.com, heapanalytics.com; Contentful, HSTS, Heap, HockeyStack, Netlify Create, Next.js 16.4.2, Open Graph, PWA, React, Sentry, Stackbit, Vercel, Webpack, core-js 3.50.0 10 tracked companies loaded by the homepage are not in Heap's subprocessor list. A website can use a service without it processing customer data. ## Subprocessor of (35) Tracked vendors whose own subprocessor lists name it, and what they say they use it for. - [ActiveState](https://thirdpartyindex.com/vendors/activestate.md): Customer Conversion, Activation, and Retention - [Addepar](https://thirdpartyindex.com/vendors/addepar.md): Operation of a digital insights and usage analytics platform on behalf of Addepar. - [Anaconda](https://thirdpartyindex.com/vendors/anaconda.md): Digital insights platform - [APPZEN](https://thirdpartyindex.com/vendors/appzen.md): Usage analytics - [Auvik](https://thirdpartyindex.com/vendors/auvik.md): Product analytics - [Badge](https://thirdpartyindex.com/vendors/trybadge-com.md): Data analytics - [Bitfount](https://thirdpartyindex.com/vendors/bitfount.md): Website and product usage analytics - [Bugcrowd](https://thirdpartyindex.com/vendors/bugcrowd.md): IP and browsing history on-site - [Captain Data](https://thirdpartyindex.com/vendors/captain-data.md): Product analytics - [ChurnKey](https://thirdpartyindex.com/vendors/churnkey.md) - [Credo AI](https://thirdpartyindex.com/vendors/credo-ai.md): Product analytics - [Crosschq](https://thirdpartyindex.com/vendors/crosschq.md): Heap is a system used by our product team to better understand how users are using and interacting with our applications. We use this data to improve our produc… - [DataCamp](https://thirdpartyindex.com/vendors/datacamp.md): Data analytics; Web Analytics - [Deepgram](https://thirdpartyindex.com/vendors/deepgram.md): Provides web and mobile app analytics solutions to help businesses understand user behavior and improve their digital experiences. - [EAB](https://thirdpartyindex.com/vendors/eab.md): Product Analytics; Website analytics and tracking - [Fireflies.AI](https://thirdpartyindex.com/vendors/fireflies-ai-2.md): Analytics service - [Harvest](https://thirdpartyindex.com/vendors/harvest.md): Product Analytics - [InMoment](https://thirdpartyindex.com/vendors/inmoment.md): System monitoring - [Level AI](https://thirdpartyindex.com/vendors/level-ai.md) - [Matillion](https://thirdpartyindex.com/vendors/matillion.md) - [Orb](https://thirdpartyindex.com/vendors/orb.md): In-product analytics - [Persado](https://thirdpartyindex.com/vendors/persado.md): Digital insight for Persado Portal usage. - [Pluralsight](https://thirdpartyindex.com/vendors/pluralsight.md): Data Analytics Tool - [Precisely Software](https://thirdpartyindex.com/vendors/precisely-software.md): Customer Support - [Quo](https://thirdpartyindex.com/vendors/quo.md): Behavioral analytics; Data analytics - [SalesHood](https://thirdpartyindex.com/vendors/saleshood.md): Engagement tracking - [Skedda](https://thirdpartyindex.com/vendors/skedda.md): Heap is a web analytics and behavioral/event tracking tool. Skedda uses Heap to better understand user behavior on marketing pages (www.skedda.com) and what act… - [SnapLogic](https://thirdpartyindex.com/vendors/snaplogic.md): User Experience Analytics - [Swantide](https://thirdpartyindex.com/vendors/swantide.md): Product Analytics Platform - [Termly](https://thirdpartyindex.com/vendors/termly.md): Analyze user behavior - [Toggl](https://thirdpartyindex.com/vendors/toggl.md): Analytics provider - [Trainual](https://thirdpartyindex.com/vendors/trainual.md): Web page analytics - [True Anthem](https://thirdpartyindex.com/vendors/true-anthem.md): Marketing web site analytics service that captures and reports how users interact with the web site - [Userflow](https://thirdpartyindex.com/vendors/userflow.md) - [Vanta](https://thirdpartyindex.com/vendors/vanta.md): Application Analytics; Data and analytics ## Service status Incidents it reported on its own status page. - Last 90 days: 12 reported incidents (1 major or critical, 7 minor, 4 with no impact stated) - Typical time to resolve: 6 h 8 min - Status page last read: 2026-11-12 - Its status page says now: Minor Service Outage (affected: Integrations - Sources: partial outage) - 2026-11-08: Temporary Data Latency (minor) - 2026-11-05: Temporary Data Latency (minor) - 2026-11-04: Delayed event-data availability in the US (no impact stated) - 2026-11-03: Data latency for some US customers (no impact stated) - 2026-10-14: User property data delayed in Heap connect syncs (US customers only) (minor) - 2026-10-07: User property data delayed in Heap connect syncs (US customers only) (minor) - 2026-10-02: Salesforce integration: data-in not syncing (major) - 2026-09-23: Heap Connect Syncs: Possibility Of Stale Data (minor) ## Incidents reported by Heap's subprocessors Incidents reported in the last 30 days on their own status pages by 4 vendors Heap lists as subprocessors. A subprocessor list names a company, not the service an incident touched. - 2026-11-12: [Snowflake](https://thirdpartyindex.com/vendors/snowflake#status), which Heap lists as a subprocessor, reported INC20000347 (minor) - 2026-11-11: [OpenAI](https://thirdpartyindex.com/vendors/openai#status), which Heap lists as a subprocessor, reported Unable to start new Workspace Agent runs (critical) - 2026-11-11: [OpenAI](https://thirdpartyindex.com/vendors/openai#status), which Heap lists as a subprocessor, reported Elevated errors affecting logins, sign-ups, and ChatGPT features (minor) - 2026-11-10: [Contentsquare](https://thirdpartyindex.com/vendors/contentsquare#status), which Heap lists as a subprocessor, reported Zoning Analysis might remains stuck in an infinite loading state (no impact stated) - 2026-11-10: [OpenAI](https://thirdpartyindex.com/vendors/openai#status), which Heap lists as a subprocessor, reported Incorrect cost data in Costs API exports (no impact stated) - 2026-11-09: [OpenAI](https://thirdpartyindex.com/vendors/openai#status), which Heap lists as a subprocessor, reported Elevated Errors On API (minor) - 2026-11-09: [OpenAI](https://thirdpartyindex.com/vendors/openai#status), which Heap lists as a subprocessor, reported Elevated ChatGPT Conversation Errors (minor) - 2026-11-08: [OpenAI](https://thirdpartyindex.com/vendors/openai#status), which Heap lists as a subprocessor, reported Elevated errors with image generation (minor) - 2026-11-07: [Snowflake](https://thirdpartyindex.com/vendors/snowflake#status), which Heap lists as a subprocessor, reported INC20000337 (minor) - 2026-11-06: [Snowflake](https://thirdpartyindex.com/vendors/snowflake#status), which Heap lists as a subprocessor, reported INC20000336 (minor) - 2026-11-06: [OpenAI](https://thirdpartyindex.com/vendors/openai#status), which Heap lists as a subprocessor, reported Elevated error rates with some U.S. business Mastercards (no impact stated) - 2026-11-05: [OpenAI](https://thirdpartyindex.com/vendors/openai#status), which Heap lists as a subprocessor, reported ChatGPT Work and Dots Errors (minor) - 2026-11-04: [OpenAI](https://thirdpartyindex.com/vendors/openai#status), which Heap lists as a subprocessor, reported Elevated error rates across paid ChatGPT plans (minor) - 2026-11-04: [Ada Support](https://thirdpartyindex.com/vendors/ada-support#status), which Heap lists as a subprocessor, reported Complete ada outage (critical) - 2026-11-03: [OpenAI](https://thirdpartyindex.com/vendors/openai#status), which Heap lists as a subprocessor, reported File upload errors in ChatGPT (minor) - 2026-11-02: [Contentsquare](https://thirdpartyindex.com/vendors/contentsquare#status), which Heap lists as a subprocessor, reported Unable to upgrade to Growth plan (no impact stated) - 2026-10-30: [Snowflake](https://thirdpartyindex.com/vendors/snowflake#status), which Heap lists as a subprocessor, reported INC20000321 (minor) - 2026-10-30: [OpenAI](https://thirdpartyindex.com/vendors/openai#status), which Heap lists as a subprocessor, reported Elevated errors with search in Dots, ChatGPT Work, and certain ChatGPT thinking experiences (minor) - 2026-10-30: [OpenAI](https://thirdpartyindex.com/vendors/openai#status), which Heap lists as a subprocessor, reported Elevated errors for GPT Image 2 API image edits (minor) - 2026-10-29: [Contentsquare](https://thirdpartyindex.com/vendors/contentsquare#status), which Heap lists as a subprocessor, reported Voice of Customer (VoC) Module Not Loading Properly (no impact stated) - 2026-10-29: [Snowflake](https://thirdpartyindex.com/vendors/snowflake#status), which Heap lists as a subprocessor, reported INC20000319 (minor) - 2026-10-27: [OpenAI](https://thirdpartyindex.com/vendors/openai#status), which Heap lists as a subprocessor, reported 6.1 Sol Degraded Model Performance (minor) - 2026-10-27: [OpenAI](https://thirdpartyindex.com/vendors/openai#status), which Heap lists as a subprocessor, reported Elevated error rates for most hosted Code Reviews and Security Reviews on private GitHub repositories (no impact stated) - 2026-10-26: [OpenAI](https://thirdpartyindex.com/vendors/openai#status), which Heap lists as a subprocessor, reported Elevated error rates for Ads POST requests (minor) - 2026-10-23: [OpenAI](https://thirdpartyindex.com/vendors/openai#status), which Heap lists as a subprocessor, reported Degraded experience with ChatGPT app connections using CIMD (minor) - 2026-10-23: [OpenAI](https://thirdpartyindex.com/vendors/openai#status), which Heap lists as a subprocessor, reported Help Center Chat Support Degraded (no impact stated) - 2026-10-23: [OpenAI](https://thirdpartyindex.com/vendors/openai#status), which Heap lists as a subprocessor, reported Delays in customer support responses (no impact stated) - 2026-10-22: [OpenAI](https://thirdpartyindex.com/vendors/openai#status), which Heap lists as a subprocessor, reported New Ad Accounts failing to provision admins (minor) - 2026-10-22: [OpenAI](https://thirdpartyindex.com/vendors/openai#status), which Heap lists as a subprocessor, reported Degraded Performance of Dots on Enterprise (minor) - 2026-10-22: [OpenAI](https://thirdpartyindex.com/vendors/openai#status), which Heap lists as a subprocessor, reported Elevated ChatGPT conversation and Responses API errors (minor) - 2026-10-21: [OpenAI](https://thirdpartyindex.com/vendors/openai#status), which Heap lists as a subprocessor, reported Authentication errors for some users (major) - 2026-10-21: [Ada Support](https://thirdpartyindex.com/vendors/ada-support#status), which Heap lists as a subprocessor, reported Messages not being delivered (US region) (major) - 2026-10-21: [Snowflake](https://thirdpartyindex.com/vendors/snowflake#status), which Heap lists as a subprocessor, reported INC20000301 (critical) - 2026-10-21: [OpenAI](https://thirdpartyindex.com/vendors/openai#status), which Heap lists as a subprocessor, reported Elevated error rates for gpt-5.6-luna API requests (minor) - 2026-10-21: [OpenAI](https://thirdpartyindex.com/vendors/openai#status), which Heap lists as a subprocessor, reported Elevated FedRAMP API error rates for Astra and Sol (minor) - 2026-10-21: [Snowflake](https://thirdpartyindex.com/vendors/snowflake#status), which Heap lists as a subprocessor, reported INC20000299 (minor) - 2026-10-21: [OpenAI](https://thirdpartyindex.com/vendors/openai#status), which Heap lists as a subprocessor, reported Degraded performance in ChatGPT, Codex, and APIs (minor) - 2026-10-20: [Snowflake](https://thirdpartyindex.com/vendors/snowflake#status), which Heap lists as a subprocessor, reported INC20000294 (critical) - 2026-10-19: [OpenAI](https://thirdpartyindex.com/vendors/openai#status), which Heap lists as a subprocessor, reported File Download errors (minor) - 2026-10-19: [Snowflake](https://thirdpartyindex.com/vendors/snowflake#status), which Heap lists as a subprocessor, reported INC20000290 (minor) - 2026-10-16: [Ada Support](https://thirdpartyindex.com/vendors/ada-support#status), which Heap lists as a subprocessor, reported Issues with a ticketing integration (minor) - 2026-10-16: [Snowflake](https://thirdpartyindex.com/vendors/snowflake#status), which Heap lists as a subprocessor, reported INC20000287 (critical) - 2026-10-15: [OpenAI](https://thirdpartyindex.com/vendors/openai#status), which Heap lists as a subprocessor, reported Widespread feature degradation (major) - 2026-10-14: [OpenAI](https://thirdpartyindex.com/vendors/openai#status), which Heap lists as a subprocessor, reported Delayed Costs data in the Compliance API (minor) - 2026-10-14: [OpenAI](https://thirdpartyindex.com/vendors/openai#status), which Heap lists as a subprocessor, reported Limited availability on gpt-image-2.5-flare and gpt-image-2.5-sunburst (minor) - 2026-10-14: [OpenAI](https://thirdpartyindex.com/vendors/openai#status), which Heap lists as a subprocessor, reported Degraded performance in Codex and ChatGPT Work (minor) - 2026-10-13: [Snowflake](https://thirdpartyindex.com/vendors/snowflake#status), which Heap lists as a subprocessor, reported INC20000277 (minor) The subprocessor list as we read it on any date: https://thirdpartyindex.com/labs/time-machine/heap ## Security contact From its security.txt (https://contentsquare.com/.well-known/security.txt) ([evidence](https://thirdpartyindex.com/evidence/4575)): - Contact: mailto:security@contentsquare.com - Disclosure policy: https://contentsquare.com/disclosure - Encryption key: https://contentsquare.com/gpg/security-at-contentsquare-publickey.txt - Acknowledgments: https://yeswehack.com/programs/contentsquare-bug-bounty-program - Security jobs: https://jobs.lever.co/contentsquare - Languages: en - Valid until 2028-01-31 - Signed - The parent company's file --- Third Party Index (https://thirdpartyindex.com) monitors vendors' public security and privacy documents and keeps each version as evidence. Data CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/); vendors' own documents are theirs. API: https://thirdpartyindex.com/api