marimo
marimo declares 10 subprocessors in its subprocessor list, which we last checked on Nov 11, 2026 (evidence). They include Cloudflare, Sentry and posthog. No published changes since we first read it on Sep 23, 2026.
Not listed by any tracked vendor.
Not loaded by any published homepage.
Subprocessors CSV of marimo's subprocessors · Atom feed of marimo's subprocessors DORA draft CSV of marimo's subprocessors as declared by marimo what's this? ·
10 third parties.
| Name | Purpose | Location | Listed since |
|---|---|---|---|
| Clerk, Inc. | User authentication, session management, and organization membership | United States | |
| Cloudflare, Inc. | Edge workers, CDN, DNS, R2 object storage for notebooks and artifacts, and database connectivity | United States | |
| CoreWeave | Notebook execution, kernel runtime, and application hosting for molab | United States | |
| Functional Software, Inc. (Sentry) | Error monitoring, performance tracing, and debugging | United States | |
| GitHub, Inc. | OAuth sign-in and importing notebooks from public repositories | United States | |
| Loops, Inc. | Transactional and marketing email delivery | United States | |
| Notion Labs, Inc. | Collection of feedback and waitlist submissions | United States | |
| PostHog, Inc. | Product analytics and feature flagging | United States | |
| Vercel Inc. | Hosting for the marimo.io marketing site, Community Cloud, and playground | United States | |
| Weights & Biases, Inc. | AI-assisted code completion and notebook generation | United States |
Web TechnologiesCSV of marimo's web technologies · Atom feed of marimo's web technologies
marimo's homepage made 158 requests to 5 domains, 2 services controlled by another company, and 2 domains not identified.
2 third parties by category: Marketing automation 1Other 1
cr-relay.comusbrowserspeed.com
Security recordCSV of marimo's security record · Atom feed of marimo's security record
What public security catalogs list for marimo, in their words.
Known exploited vulnerabilities
1 vulnerability in marimo's software that CISA lists as exploited in the wild.
| CVE | Product | Vulnerability | Listed |
|---|---|---|---|
| CVE-2026-39987 | Marimo | Marimo Remote Code Execution Vulnerability |
Source: CISA Known Exploited Vulnerabilities catalog (evidence)
Incidents reported by marimo's subprocessorsCSV of incidents reported by vendors marimo lists · Atom feed of incidents reported by vendors marimo lists
65 reported incidents in the last 30 days, by 7 of the vendors marimo lists as subprocessors.
A subprocessor list names a company, not the service an incident touched. This does not show that marimo was involved.
And 40 more. All of them: CSV · Who is around them.
ChangesCSV of marimo's changes · Atom feed of marimo's changes
See the list as we read it on any date: Time machine
None since tracking began.
Rating badge for marimo's site
It updates with the rating.
<a href="https://thirdpartyindex.com/vendors/marimo"><img src="https://thirdpartyindex.com/badge/marimo.svg" alt="marimo transparency rating on Third Party Index" height="20"></a>[](https://thirdpartyindex.com/vendors/marimo)