MinIO
Transparency
Breakdown
| Subprocessor list | 30 / 30 | |
| Processing locations | 8 / 8 | |
| Purposes | 7 / 7 | |
| Data processing addendum | 12 / 12 | |
| Trust center | 8 / 8 | |
| Privacy policy | 6 / 6 | |
| security.txt | not found | 0 / 6 |
| Security page | not found | 0 / 5 |
| Status page | 5 / 5 | |
| Vulnerability disclosure | not found | 0 / 5 |
| Pages still reachable | 8 / 8 | |
| Total | 84 / 100 |
Only documents we can retrieve count: a page behind a login or a broken link scores nothing.
Badge
For MinIO's own site; it updates with the rating.
<a href="https://thirdpartyindex.com/vendors/minio"><img src="https://thirdpartyindex.com/badge/minio.svg" alt="MinIO transparency rating on Third Party Index" height="20"></a>[](https://thirdpartyindex.com/vendors/minio)Not listed by any tracked vendor.
Documents
| Document | Verified | Changed | Evidence |
|---|---|---|---|
| Trust center safebase | snapshot | ||
| Subprocessor list | snapshot | ||
| Data processing addendum | snapshot | ||
| Privacy policy | snapshot | ||
| Terms | snapshot | ||
| Status page | snapshot |
Subprocessors
| Name | Purpose | Location | Listed since |
|---|---|---|---|
| 360Learning, Inc. | Learning management system; processes partner and external learner names, email addresses, training completion records, and course engagement data | New York, New York, United States | |
| Anthropic, PBC (Claude API) | AI model API; processes software usage data for internal development and operational purposes | San Francisco, California, United States | |
| Chargebee, Inc. | Subscription and billing management; processes customer names, email addresses, billing addresses, subscription plan details, and invoice records | North Bethesda, Maryland, United States | |
| Chatlio LLC | Live chat widget; captures prospect names, email addresses, and chat messages from MinIO's website | Seattle, Washington, United States | |
| Chili Piper, Inc. | Meeting scheduling platform; processes prospect names, email addresses, phone numbers, and calendar availability | New York, New York, United States | |
| Clay | Data enrichment platform; processes prospect names, email addresses, phone numbers, company names, job titles, and LinkedIn profile data | New York, New York, United States | |
| Crazy Egg, Inc. | Website heatmaps and session recordings; processes visitor IP addresses, browser data, mouse movements, and any personal data visible in recorded form interactions | La Mirada, California, United States | |
| Crossbeam, Inc. | Partner ecosystem platform; processes customer and partner company names, account identifiers, and contact names shared for overlap analysis | Philadelphia, Pennsylvania, United States | |
| Databricks, Inc. | Data and AI analytics platform with embedded ML/AI capabilities; may process business and usage data depending on deployment | San Francisco, California, United States | |
| Dealfront Group GmbH (Leadfeeder) | Website visitor identification; processes visitor IP addresses and company identifiers to identify organizations visiting MinIO's website | Karlsruhe, Germany | |
| Drata, Inc. | Compliance automation platform (SOC 2, ISO 27001); processes employee names, email addresses, system access logs, and security configuration evidence collected from connected infrastructure | San Francisco, California, United States | |
| Functional Software, Inc. dba Sentry | Application monitoring and error tracking; may process end-user IP addresses, browser data, and interaction data captured in error reports and session logs | San Francisco, California, United States | |
| General Counsel AI, Inc. (GC AI) | AI-powered legal and contract review; processes confidential business documents for internal legal operations | San Mateo, California, United States | |
| GetEmails, LLC dba RB2B | Website visitor de-anonymization; processes visitor names, email addresses, company names, job titles, and IP addresses identified from anonymous website traffic | Austin, Texas, United States | |
| GitHub, Inc. | Source code repository; processes contributor names, email addresses, and source code | San Francisco, California, United States | |
| Global RADAR Solutions, Inc. | Compliance screening; processes customer and partner names, addresses, dates of birth, nationality, and identity data for sanctions, PEP, and adverse media screening | Miami, Florida, United States | |
| Google LLC (Google Cloud Platform) | Cloud infrastructure; hosts and processes customer data including names, email addresses, and any data stored in MinIO's cloud-hosted services; Productivity suite (Gmail, Drive, Docs, Calendar); processes customer and partner names, email addresses, phone numbers, and any personal data contained in emails, documents, and shared files | Mountain View, California, United States | |
| Greenhouse Software, Inc. | Applicant tracking system; processes candidate names, email addresses, phone numbers, home addresses, resumes, cover letters, interview notes, and hiring decision records | New York, New York, United States | |
| HubSpot, Inc. (including Breeze AI) | CRM and marketing automation with embedded AI (Breeze); processes customer and partner names, email addresses, phone numbers, company names, job titles, website activity, and marketing engagement records | Cambridge, Massachusetts, United States | |
| Internet Security Research Group (Let's Encrypt) | SSL/TLS certificate provisioning; processes domain names and server IP addresses | San Francisco, California, United States | |
| Intuit Inc. dba Mailchimp | Email marketing platform; processes customer and partner names, email addresses, and email engagement data (opens, clicks) | Atlanta, Georgia, United States | |
| Livestorm SAS | Webinar platform; processes registrant and attendee names, email addresses, company names, and engagement data | Paris, France | |
| Lucky Orange LLC | Session recordings and form analytics; processes visitor IP addresses, browser data, session recordings, and any personal data captured in form interactions | Overland Park, Kansas, United States | |
| Midjourney, Inc. | AI image generation; processes text prompts submitted by marketing for visual content creation | South San Francisco, California, United States | |
| NeverBounce (ZoomInfo Technologies, Inc.) | Email verification; processes prospect email addresses to validate deliverability | Vancouver, Washington, United States | |
| Okta, Inc. (including Auth0) | Identity and access management for SUBNET; processes customer names, email addresses, and authentication tokens (JWTs); does not store passwords | San Francisco, California, United States | |
| OpenAI, LLC (ChatGPT / API) | AI model API; processes software usage data for internal development and operational purposes | San Francisco, California, United States | |
| Oracle Corporation (NetSuite) | Cloud ERP and accounting platform; processes customer and partner names, email addresses, billing addresses, phone numbers, financial transaction data, and invoice records | Austin, Texas, United States | |
| Osano, Inc. | Privacy and consent management; processes visitor IP addresses, cookie identifiers, and consent preference records | Austin, Texas, United States | |
| Otter.ai, Inc. | AI meeting transcription; processes voice recordings, meeting transcripts, and attendee names which may contain confidential business or customer information | Mountain View, California, United States | |
| Outreach Corporation (including AI features) | Sales engagement platform with embedded AI; processes customer and partner names, email addresses, phone numbers, company names, job titles, and email content | Seattle, Washington, United States | |
| PathFactory Corp. | Content engagement platform; processes prospect names, email addresses, company names, and content engagement behavior | Toronto, Ontario, Canada | |
| ProfitSoft B.V. dba Expandi.io | LinkedIn outreach automation; processes prospect names, email addresses, LinkedIn profile URLs, company names, and job titles | Eindhoven, Netherlands | |
| Qualified.com, Inc. | Conversational marketing platform; processes prospect names, email addresses, company names, job titles, IP addresses, and chat messages | San Francisco, California, United States | |
| RainFocus, LLC | Event management platform; processes attendee names, email addresses, phone numbers, company names, and job titles | Lehi, Utah, United States | |
| Rippling, Inc. | HR, payroll, and IT management; processes employee names, home addresses, email addresses, phone numbers, Social Security numbers, tax IDs, bank account numbers, salary, and compensation data | San Francisco, California, United States | |
| SafeBase, Inc. (a Drata company) | Trust center platform; processes customer and partner names, email addresses, company names, and NDA acceptance records submitted through MinIO's security review portal | San Francisco, California, United States | |
| Salesforce, Inc. (including Einstein / Agentforce) | CRM platform with embedded AI (Einstein, Agentforce); processes customer and partner names, email addresses, phone numbers, company names, job titles, mailing addresses, deal history, and engagement records | San Francisco, California, United States | |
| Slack Technologies, LLC | Workplace messaging; may process customer and partner names, email addresses, phone numbers, and any personal data shared in support or sales channels | San Francisco, California, United States | |
| Smartlead (521 Products Pty Ltd) | Cold email outreach; processes prospect names, email addresses, and email content | Sydney, NSW, Australia | |
| Sprout Social, Inc. | Social media management; processes prospect and customer social media handles, names, and direct message content | Chicago, Illinois, United States | |
| Stripe, Inc. | Payment processing; processes customer names, email addresses, billing addresses, payment card numbers, and transaction records | South San Francisco, California, United States | |
| Twilio Inc. (including SendGrid) | Communication services (SMS, voice, email); processes customer and partner names, email addresses, phone numbers, and message content | San Francisco, California, United States | |
| Webflow, Inc. | Website hosting; processes visitor IP addresses, browser data, and any personal data submitted through website forms (names, email addresses, phone numbers) | San Francisco, California, United States | |
| Wistia, Inc. | Video hosting and analytics; processes viewer email addresses (when gated), IP addresses, and video engagement data | Cambridge, Massachusetts, United States | |
| X.AI Corp. (Grok API) | AI model API; processes software usage data submitted via API for internal development purposes | Palo Alto, California, United States | |
| Zoom Video Communications, Inc. (including AI Companion) | Video conferencing with embedded AI (AI Companion); processes customer and partner names, email addresses, voice recordings, video recordings, meeting transcripts, and chat messages | San Jose, California, United States |
Security record
What public security catalogs list for MinIO, in their words.
Known exploited vulnerabilities
2 vulnerabilities in MinIO's software that CISA lists as exploited in the wild.
| CVE | Product | Vulnerability | Listed |
|---|---|---|---|
| CVE-2023-28434 | MinIO | MinIO Security Feature Bypass Vulnerability | evidence |
| CVE-2023-28432 | MinIO | MinIO Information Disclosure Vulnerability | evidence |
Changes
None since tracking began.