# Liferay DXP

We have not found a subprocessor list published by Liferay DXP. We monitor 7 of its documents, which we last checked on 2026-11-11.

Liferay DXP (liferay.com): subprocessors, data processing agreement, security documents and changes, as monitored by Third Party Index.

- Page: https://thirdpartyindex.com/vendors/liferay-dxp
- Documents last verified: 2026-11-11
- Transparency rating: 50/100 (how much it publishes, not how secure it is): Subprocessor list 0/30 (not found); Processing locations 0/8 (no list); Purposes 0/7 (no list); Data processing addendum 12/12; Trust center 8/8; Privacy policy 6/6; security.txt 6/6; Security page 5/5; Status page 5/5; Vulnerability disclosure 0/5 (not found); Pages still reachable 8/8
- Supply chain: relies on 0 tracked vendors directly, 0 within two hops, 0 within three; 0 tracked vendors rely on it directly, 0 within two hops, 0 within three
- Cite as: Liferay DXP, Third Party Index, https://thirdpartyindex.com/vendors/liferay-dxp (data CC BY 4.0)

## Documents

| Document | URL | Last verified | Last changed |
|---|---|---|---|
| Trust center | https://www.liferay.com/trust-center | 2026-11-11 | 2026-11-02 |
| Data processing addendum | https://www.liferay.com/documents/d/guest/data-processing-addendum-3002310\_gl\_en | 2026-11-11 | 2026-09-27 |
| Privacy policy | https://www.liferay.com/privacy-policy | 2026-11-11 | 2026-09-27 |
| Terms | https://www.liferay.com/documents/10182/510001423/Terms+of+Service+1302111\_GL.pdf/5b3613d1-83a1-dd22-4ae4-29dbd1214bb2?version=1.0&t=1718637225546 | 2026-11-11 | 2026-09-27 |
| Security page | https://www.liferay.com/capabilities/security | 2026-11-11 | 2026-11-02 |
| security.txt | https://www.liferay.com/.well-known/security.txt | 2026-11-11 | 2026-09-27 |
| Status page | https://status.liferay.cloud/ | 2026-11-11 | 2026-11-11 |

## Subprocessors (0)

No subprocessor list has been found or read for this vendor.

## Web Technologies

Liferay DXP's homepage made 210 requests to 10 domains, and 5 services controlled by another company. Loaded on 2026-11-10 by a browser that accepted nothing; other visits may load more or less. What a page loads is not a list of who receives customer data.

5 third parties by category: Analytics 2 (Google Cloud, Cloudflare); Live chat 1 (Qualified.com, Inc.); Cookie compliance 1 (OneTrust); Issue trackers 1 (usually detected as Issue trackers: Sentry). Each company that appears controlled by another organization is counted once, under the main category of the technologies detected from it on this homepage or, when none was, the category recorded from the company's own page (marked reviewed) or else the one it is usually detected as on other published homepages (marked as such); unclassified: none of these.

### Third parties (5)

- Qualified.com, Inc.: 36 requests to qualified.com; Qualified
- OneTrust: 13 requests to cookielaw.org, onetrust.com; OneTrust
- Google Cloud: 6 requests to googletagmanager.com, googlesyndication.com, google-analytics.com; Google Analytics, Google Tag Manager
- Cloudflare: 1 request to cloudflareinsights.com; Cloudflare Browser Insights
- Sentry: 1 request to sentry.io

### First party (1)

- Liferay DXP: 153 requests to liferay.com, lfr.cloud; AlloyUI, Bootstrap, HSTS, Java, Liferay, Open Graph, Sentry, Varnish, YUI patched-v3.20.8, YUI Doc, ZURB Foundation, core-js 2.6.12

4 tracked companies loaded by the homepage are not in Liferay DXP's subprocessor list. A website can use a service without it processing customer data.

## Subprocessor of (0)

No tracked vendor lists it.

## Security record

CISA's Known Exploited Vulnerabilities catalog lists 1 vulnerability in its software:

- CVE-2020-7961 (Liferay Portal), listed 2021-11-03: Liferay Portal Deserialization of Untrusted Data Vulnerability

## Service status

Incidents it reported on its own status page.

- Last 90 days: 1 reported incidents (0 major or critical, 0 minor, 1 with no impact stated)
- Typical time to resolve: 9 days
- Status page last read: 2026-11-12
- 2026-08-17: Incorrect Auto-Scaling Email Notification for Search Service (no impact stated)
- 2026-05-27: Issues to display logs on the Cloud Console (major)
- 2026-05-15: Security Update: Critical Kubernetes Maintenance (CVE-2026-31431 in the Linux kernel) (no impact stated)
- 2026-05-14: Incident: Extended Maintenance for Liferay Kubernetes Upgrade (no impact stated)
- 2026-03-20: Instability in the Australia Southeast clusters impacting customer projects (minor)
- 2025-12-08: Issues when retrieving logs (minor)
- 2025-12-03: OKTA Instability (no impact stated)
- 2025-11-18: Cloudflare Instability (no impact stated)

## Security contact

From its security.txt (https://www.liferay.com/.well-known/security.txt) ([evidence](https://thirdpartyindex.com/evidence/10958)):

- Contact: mailto:security@liferay.com
- Disclosure policy: https://liferay.dev/portal/security/reporting
- Encryption key: https://www.liferay.com/.well-known/pgp-key.txt
- Acknowledgments: https://liferay.dev/portal/security/hall-of-fame
- Languages: en
- Valid until 2026-12-31
- Signed

---

Third Party Index (https://thirdpartyindex.com) monitors vendors' public security and privacy documents and keeps each version as evidence. Data CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/); vendors' own documents are theirs. API: https://thirdpartyindex.com/api