# Meta

Meta declares [19 subprocessors](https://thirdpartyindex.com/vendors/meta#subprocessors), plus 13 of its own affiliates, in [its subprocessor list](https://www.meta.com/legal/meta-for-work/subprocessor-list), which we last checked on 2026-11-11 ([evidence](https://thirdpartyindex.com/evidence/107386)). They include [Andale AI](https://thirdpartyindex.com/vendors/andale-ai) and [Vitesse](https://thirdpartyindex.com/vendors/vitesse). No published changes since we first read it on 2026-10-03. [116 tracked vendors](https://thirdpartyindex.com/vendors/meta#used-by) name Meta as a subprocessor, including [Amazon Web Services](https://thirdpartyindex.com/vendors/amazon-web-services), [HubSpot](https://thirdpartyindex.com/vendors/hubspot) and [Twilio](https://thirdpartyindex.com/vendors/twilio).

Meta (meta.com): subprocessors, data processing agreement, security documents and changes, as monitored by Third Party Index.

- Page: https://thirdpartyindex.com/vendors/meta
- Documents last verified: 2026-11-11
- Transparency rating: 57/100 (how much it publishes, not how secure it is): Subprocessor list 30/30; Processing locations 8/8; Purposes 0/7 (partial); Data processing addendum 0/12 (not found); Trust center 0/8 (not found); Privacy policy 6/6; security.txt 0/6 (not found); Security page 0/5 (not found); Status page 0/5 (not found); Vulnerability disclosure 5/5; Pages still reachable 8/8
- Supply chain: relies on 2 tracked vendors directly, 2 within two hops, 2 within three; 116 tracked vendors rely on it directly, 2528 within two hops, 2859 within three
- Cite as: Meta, Third Party Index, https://thirdpartyindex.com/vendors/meta (data CC BY 4.0)

## Documents

| Document | URL | Last verified | Last changed |
|---|---|---|---|
| Subprocessor list | https://www.meta.com/legal/meta-for-work/subprocessor-list | 2026-11-11 | 2026-10-16 |
| Privacy policy | https://www.meta.com/legal/privacy-policy/ | 2026-11-11 | 2026-11-01 |
| Terms | https://www.meta.com/legal/promotional-terms/ | 2026-11-11 | 2026-11-11 |
| Security advisories | https://www.meta.com/legal/security-vulnerability-disclosure-policy/ | 2026-11-11 | 2026-11-06 |

## Subprocessors (19)

As its own list states them.

| Subprocessor | Purpose | Location | Listed since |
|---|---|---|---|
| [Andale, Inc.](https://thirdpartyindex.com/vendors/andale-ai.md) | — | United States | 2026-10-03 |
| Cassin Networks Aps | — | Denmark | 2026-10-03 |
| Goldframe LLC | — | United States | 2026-10-03 |
| Greater Kudu LLC | — | United States | 2026-10-03 |
| Morning Hornet LLC | — | United States | 2026-10-03 |
| Offprints LLC | — | United States | 2026-10-03 |
| Omanyte LLC | — | United States | 2026-10-03 |
| Paile LLC | — | United States | 2026-10-03 |
| Pinnacle Sweden AB | — | Sweden | 2026-10-03 |
| Raven Northbrook LLC | — | United States | 2026-10-03 |
| Runways Information Services Limited | — | Ireland | 2026-10-03 |
| Scout Development LLC | — | United States | 2026-10-03 |
| Siculus Inc. | — | United States | 2026-10-03 |
| Sidecat LLC | — | United States | 2026-10-03 |
| Stadion LLC | — | United States | 2026-10-03 |
| Starbelt LLC | — | United States | 2026-10-03 |
| [Vitesse, LLC](https://thirdpartyindex.com/vendors/vitesse.md) | — | United States | 2026-10-03 |
| Winner LLC d/b/a Ernst LLC | — | United States | 2026-10-03 |
| Woolhawk LLC | — | United States | 2026-10-03 |

Read from ([evidence](https://thirdpartyindex.com/evidence/37287)). CSV: https://thirdpartyindex.com/vendors/meta/subprocessors.csv

### Its own affiliates (13)

- Meta Canada Ltd (Canada)
- Meta France Sarl (France)
- Meta Germany GmbH (Germany)
- Meta Italy S.R.L. (Italy)
- Meta Netherlands B.V. (Netherlands)
- Meta Operations, LLC (United States)
- Meta Platforms, Inc. (United States)
- Meta Platforms International Operations Philippines (Philippines)
- Meta Platforms Ireland Limited (Ireland)
- Meta Poland Sp. zoo (Poland)
- Meta Singapore Pte. Ltd. (Singapore)
- Meta Spain SL (Spain)
- Meta UK Limited (United Kingdom)

## Security program

What Meta Platforms, Inc.'s Form 10-K for fiscal 2025, filed Jan 29, 2026 (Item 1C) says, in its words (https://www.sec.gov/Archives/edgar/data/1326801/000162828026003942/0001628280-26-003942-index.htm).

- Led by: Chief Information Security Officer
- Board oversight: Board of Directors
- Practices named: Bug bounty, Threat intelligence, Security training
- Engages outside assessors or consultants
- Reviews its suppliers' security
- Says no cybersecurity incident has materially affected it
- Since the fiscal 2024 report: board oversight by the Board of Directors (was the Risk Oversight Committee).

## Web Technologies

Meta's homepage made 161 requests to 10 domains, 2 services controlled by another company, and 1 domain not identified. Loaded on 2026-11-04 by a browser that accepted nothing; other visits may load more or less. What a page loads is not a list of who receives customer data.

2 third parties by category: Analytics 1 (Google Cloud); Tag managers 1 (Tealium). Each company that appears controlled by another organization is counted once, under the main category of the technologies detected from it on this homepage or, when none was, the category recorded from the company's own page (marked reviewed) or else the one it is usually detected as on other published homepages (marked as such); unclassified: none of these.

### Third parties (2)

- Tealium: 5 requests to tiqcdn.com; Tealium
- Google Cloud: 2 requests to google.com, googletagmanager.com; Google Analytics, Google Tag Manager

### Unknown (1)

Domains not identified yet: conversionsapigateway.com

### First party (1)

- Meta: 153 requests to fbcdn.net, meta.com, fbsbx.com, facebook.com, facebook.net, fbthirdpartypixel.com; Cart Functionality, Facebook Pixel 2.9.435, HSTS, HTTP/3, Open Graph, Priority Hints, RSS, core-js 3.32.2

2 tracked companies loaded by the homepage are not in Meta's subprocessor list. A website can use a service without it processing customer data.

## Subprocessor of (116)

Tracked vendors whose own subprocessor lists name it, and what they say they use it for.

- [Agilysys](https://thirdpartyindex.com/vendors/agilysys.md)
- [Amazon Web Services](https://thirdpartyindex.com/vendors/amazon-web-services.md): WhatsApp messaging; ———————————————
- [Antavo](https://thirdpartyindex.com/vendors/antavo.md): Social Media Platform
- [AWeber](https://thirdpartyindex.com/vendors/aweber.md): Business Analytics; Facebook Privacy
- [Bird](https://thirdpartyindex.com/vendors/bird.md): Provision of, WhatsApp for, Business services; WhatsApp for Business Service Provider
- [Bluecore](https://thirdpartyindex.com/vendors/bluecore.md): Media Integration for Advertising
- [BulkSMS](https://thirdpartyindex.com/vendors/bulksms.md)
- [Bullhorn](https://thirdpartyindex.com/vendors/bullhorn.md): WhatsApp business API
- [Bullseye](https://thirdpartyindex.com/vendors/bullseye.md): Advertising platform integration, custom audience management
- [Calilio](https://thirdpartyindex.com/vendors/calilio.md)
- [Chatra](https://thirdpartyindex.com/vendors/chatra.md): Business analytics
- [Clerk Chat](https://thirdpartyindex.com/vendors/clerk-chat.md)
- [CleverTap](https://thirdpartyindex.com/vendors/clevertap.md): Digital Advertising Tech
- [Cometly](https://thirdpartyindex.com/vendors/cometly.md): Integration with Facebook/Meta Ads platform for attribution data. Potentially includes hashed emails, IP addresses, click IDs, and location data. Meta Privacy
- [Convertful](https://thirdpartyindex.com/vendors/convertful.md)
- [Cursor](https://thirdpartyindex.com/vendors/cursor.md): Inference Provider; Provider of proprietary AI models via API. See \[here\]( for more information.
- [Cygnvs](https://thirdpartyindex.com/vendors/cygnvs.md): Mass Alert function delivery via WhatsApp messaging (Only used when the WhatsApp channel of the “Mass Alert” functionality of the Service is enabled)
- [Deepgram](https://thirdpartyindex.com/vendors/deepgram.md): Website analytics and advertising attribution via Meta Pixel on public-facing pages.
- [Digicert](https://thirdpartyindex.com/vendors/digicert.md): Facilitate company messaging
- [Digify](https://thirdpartyindex.com/vendors/digify.md)
- [Digistorm AU](https://thirdpartyindex.com/vendors/digistorm-au.md): Internal Business Operations - Sales & Marketing; Social media
- [Domo](https://thirdpartyindex.com/vendors/domo.md): Artificial intelligence and machine learning services
- [EAB](https://thirdpartyindex.com/vendors/eab.md): Pixel Tracking
- [Education Perfect](https://thirdpartyindex.com/vendors/education-perfect.md): Marketing (teachers and parents)
- [eesel AI](https://thirdpartyindex.com/vendors/eesel-ai.md)
- [Encore Digital Media](https://thirdpartyindex.com/vendors/encore-digital-media.md)
- [Encyro](https://thirdpartyindex.com/vendors/encyro.md): User authentication (only if user signs in with Facebook )
- [Enzuzo](https://thirdpartyindex.com/vendors/enzuzo.md): SSO
- [Experian](https://thirdpartyindex.com/vendors/experian.md): Experian Marketing Services has a direct API integration to Meta which enables us to create campaign audiences on behalf of our clients, in the same way we do f…
- [Extensis](https://thirdpartyindex.com/vendors/extensis.md)
- [Fakturownia](https://thirdpartyindex.com/vendors/fakturownia.md)
- [Fast Thinking](https://thirdpartyindex.com/vendors/fast-thinking.md): Ad performance pixel (Fast Thinking site)
- [Flaree](https://thirdpartyindex.com/vendors/flaree.md): Meta Pixel (advertising, conversion measurement)
- [Flipsnack](https://thirdpartyindex.com/vendors/flipsnack.md): To target marketing campaigns at relevant audiences
- [Flowvenue](https://thirdpartyindex.com/vendors/flowvenue.md): WhatsApp Business and related messaging services, where enabled by the Controller
- [Funnel](https://thirdpartyindex.com/vendors/funnel.md): Ad Serving, Ad Targeting, Analytics/Measurement, Content Customization, Optimization, Cross Device Tracking
- [Girikon AI](https://thirdpartyindex.com/vendors/girikon-ai.md): SMS & WhatsApp messaging delivery; Voice calling, transcription, automated tasks
- [Grayn](https://thirdpartyindex.com/vendors/grayn.md): Advertising data retrieval & analytics
- [Hilos](https://thirdpartyindex.com/vendors/hilos.md): Allows the customer to interact with their clients, prospects and message recipients through Hilos via the WhatsApp platform
- [HubDo](https://thirdpartyindex.com/vendors/hubdo.md): Social media channel — native posting and tracking via HubSpot integration
- [HubSpot](https://thirdpartyindex.com/vendors/hubspot.md): Conversation Functionality
- [Hubstaff](https://thirdpartyindex.com/vendors/hubstaff.md): Advertising; Digital advertising platform for campaigns across Meta properties.
- [InMotion Hosting](https://thirdpartyindex.com/vendors/inmotion-hosting.md): Targeted advertising and user analytics
- [Jatheon](https://thirdpartyindex.com/vendors/jatheon.md): Social media services and digital advertising
- [JFrog](https://thirdpartyindex.com/vendors/jfrog.md)
- [Jimdo](https://thirdpartyindex.com/vendors/jimdo.md)
- [Klaviyo](https://thirdpartyindex.com/vendors/klaviyo.md): WhatsApp Messaging
- [Knorex](https://thirdpartyindex.com/vendors/knorex.md): Programmatic services
- [Kolsetu](https://thirdpartyindex.com/vendors/kolsetu.md)
- [Kudosity](https://thirdpartyindex.com/vendors/kudosity.md): Customer messaging and natural language processing
- [Leadjourney](https://thirdpartyindex.com/vendors/leadjourney.md): Meta Pixel and Conversions API: ad performance measurement, retargeting and conversion optimisation for Meta and Instagram Ads. A demo request is reported with …
- [Lokalise](https://thirdpartyindex.com/vendors/lokalise.md): Marketing
- [Lovable](https://thirdpartyindex.com/vendors/lovable.md): \*\*Add-on Service provider\*\*
- [Loyalty Juggernaut](https://thirdpartyindex.com/vendors/loyalty-juggernaut.md): WhatsApp is used by GRAVTY® as a conversational messaging channel to deliver and receive loyalty-related communications between Clients and their Members. GRAV…
- [Luma](https://thirdpartyindex.com/vendors/luma.md): WhatsApp Business messaging
- [Luma AI](https://thirdpartyindex.com/vendors/luma-ai.md): User tracking provider
- [Macha AI](https://thirdpartyindex.com/vendors/macha-ai.md): Advertising measurement
- [Macroscope](https://thirdpartyindex.com/vendors/macroscope.md): For running AI inference of Meta models; We use Meta for inference of their proprietary models. Effective November 9
- [Mailgun](https://thirdpartyindex.com/vendors/mailgun.md): Delivery of messages
- [MakeForms](https://thirdpartyindex.com/vendors/makeforms.md): WhatsApp Verification
- [MangoApps](https://thirdpartyindex.com/vendors/mangoapps.md): AI Notepad cloud transcription — live meeting audio to text with speaker labels (optional: the admin's engine choice; on-device keeps audio on the laptop)
- [Marker.io](https://thirdpartyindex.com/vendors/marker-io.md): Ads
- [Matillion](https://thirdpartyindex.com/vendors/matillion.md)
- [meetergo](https://thirdpartyindex.com/vendors/meetergo.md): Messaging (connected via your own WhatsApp Business account)
- [Moogsoft](https://thirdpartyindex.com/vendors/moogsoft.md)
- [One Step GPS](https://thirdpartyindex.com/vendors/one-step-gps.md): Analytics and Tracking
- [Overloop](https://thirdpartyindex.com/vendors/overloop.md): Marketing
- [Panintelligence](https://thirdpartyindex.com/vendors/panintelligence.md): Messaging Service
- [ParentSquare](https://thirdpartyindex.com/vendors/parentsquare.md): Connection to social media accounts for districts using social sharing feature within the application.
- [Paved](https://thirdpartyindex.com/vendors/paved.md): Social Data
- [Pax](https://thirdpartyindex.com/vendors/pax.md): API oficial do WhatsApp Business usada para entregar notificações informativas de mudanças na plataforma.; WhatsApp Business Cloud API (Opcional)
- [Phonovation](https://thirdpartyindex.com/vendors/phonovation.md): WhatsApp message delivery infrastructure.
- [Pin](https://thirdpartyindex.com/vendors/pin.md): Facebook ad targeting and tracking
- [Plivo](https://thirdpartyindex.com/vendors/plivo.md): WhatsApp Cloud API provider
- [Reelist](https://thirdpartyindex.com/vendors/reelist.md): Ad manager and social posting APIs
- [Relay Commerce](https://thirdpartyindex.com/vendors/relay-commerce.md)
- [Ringostat](https://thirdpartyindex.com/vendors/ringostat.md): Authentication Service Module, Facebook messenger
- [Route Mobile](https://thirdpartyindex.com/vendors/route-mobile.md)
- [SalesBlink](https://thirdpartyindex.com/vendors/salesblink.md): Conversion tracking and advertising retargeting
- [Savio](https://thirdpartyindex.com/vendors/savio.md): Analytics
- [Segment](https://thirdpartyindex.com/vendors/segment.md): Meta Routes, transmits and delivers messages for specific Twilio Products and Services
- [SemantiqWall](https://thirdpartyindex.com/vendors/semantiqwall.md): Optional approval messages
- [SendGrid](https://thirdpartyindex.com/vendors/sendgrid.md): Meta Routes, transmits and delivers messages for specific Twilio Products and Services
- [Signable](https://thirdpartyindex.com/vendors/signable.md): Paid Advertising
- [Sinch](https://thirdpartyindex.com/vendors/sinch.md): Delivery of messages
- [Social Intents](https://thirdpartyindex.com/vendors/social-intents.md): WhatsApp Business messaging and media retrieval, where the channel runs on our WhatsApp Business account
- [SocialPilot](https://thirdpartyindex.com/vendors/socialpilot.md): Social Media and Advertising
- [SocialWeaver](https://thirdpartyindex.com/vendors/socialweaver.md): Social media integration and content sharing.
- [sparkpost](https://thirdpartyindex.com/vendors/sparkpost.md): Provision of, WhatsApp for, Business services; WhatsApp for Business Service Provider
- [Spond](https://thirdpartyindex.com/vendors/spond.md)
- [StoryChief](https://thirdpartyindex.com/vendors/storychief.md): Advertising
- [Superchat](https://thirdpartyindex.com/vendors/superchat.md)
- [Tellent Recruitee](https://thirdpartyindex.com/vendors/tellent-recruitee.md): WhatsApp Provider
- [Textkernel](https://thirdpartyindex.com/vendors/textkernel.md): WhatsApp business API
- [Tiger Pistol](https://thirdpartyindex.com/vendors/tiger-pistol.md): Advertising platform services for Facebook and Instagram.
- [Time Doctor](https://thirdpartyindex.com/vendors/time-doctor.md): Ads
- [TimelinesAI](https://thirdpartyindex.com/vendors/timelinesai.md): WhatsApp Business API (workspaces that use WABA only)
- [Town](https://thirdpartyindex.com/vendors/town.md): WhatsApp message delivery, receipt handling, and channel operations.
- [Trustmary](https://thirdpartyindex.com/vendors/trustmary.md): Customer relationship marketing
- [Twilio](https://thirdpartyindex.com/vendors/twilio.md): Meta Routes, transmits and delivers messages for specific Twilio Products and Services
- [UltraDNS](https://thirdpartyindex.com/vendors/ultradns.md): Facilitate company messaging
- [Viktor](https://thirdpartyindex.com/vendors/viktor.md): Ads integration (if enabled by customer)
- [Volantio](https://thirdpartyindex.com/vendors/volantio.md): Messaging Provider
- [Vonage](https://thirdpartyindex.com/vendors/vonage.md): Message and Call Detail Record (CDR) processing.; Processing and sending of messages, including phone numbers and message content.; Processing of phone numbers …
- [VoxisLive](https://thirdpartyindex.com/vendors/voxislive.md)
- [WATI](https://thirdpartyindex.com/vendors/wati.md): Cloud Providers
- [WebEngage](https://thirdpartyindex.com/vendors/webengage.md)
- [WebFX](https://thirdpartyindex.com/vendors/webfx.md): Digital Marketing; Used for digital marketing.
- [WeTravel](https://thirdpartyindex.com/vendors/wetravel.md): User sign-ins and analytics.
- [WhatsAble](https://thirdpartyindex.com/vendors/whatsable.md): WhatsApp Cloud API message transport (required for core Service)
- [windsor.ai](https://thirdpartyindex.com/vendors/windsor-ai.md): Advertising, Analytics, and Marketing
- [XMReality](https://thirdpartyindex.com/vendors/xmreality.md)
- [Zapier](https://thirdpartyindex.com/vendors/zapier.md): WhatsApp chat sending capabilities per customer queries; Artificial intelligence provider
- [Zeplin](https://thirdpartyindex.com/vendors/zeplin.md): Zeplin uses Facebook cookies to collect user information to engage in marketing efforts.
- [ZeroBounce](https://thirdpartyindex.com/vendors/zerobounce.md): Ad placement
- [zkipster](https://thirdpartyindex.com/vendors/zkipster.md)

## Security record

CISA's Known Exploited Vulnerabilities catalog lists 4 vulnerabilities in its software:

- CVE-2025-55182 (React Server Components), listed 2025-12-05: Meta React Server Components Remote Code Execution Vulnerability (known ransomware use)
- CVE-2025-55177 (WhatsApp), listed 2025-09-02: Meta Platforms WhatsApp Incorrect Authorization Vulnerability
- CVE-2019-18426 (WhatsApp), listed 2022-05-23: WhatsApp Cross-Site Scripting Vulnerability
- CVE-2019-3568 (WhatsApp), listed 2022-04-19: WhatsApp VOIP Stack Buffer Overflow Vulnerability

The subprocessor list as we read it on any date: https://thirdpartyindex.com/labs/time-machine/meta

---

Third Party Index (https://thirdpartyindex.com) monitors vendors' public security and privacy documents and keeps each version as evidence. Data CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/); vendors' own documents are theirs. API: https://thirdpartyindex.com/api