# Nango

Nango (nango.dev): subprocessors, data processing agreement, security documents and changes, as monitored by Third Party Index.

- Page: https://thirdpartyindex.com/vendors/nango-dev
- Documents last verified: 2026-10-02
- Transparency rating: 83/100 (how much it publishes, not how secure it is): Subprocessor list 30/30; Processing locations 8/8; Purposes 7/7; Data processing addendum 0/12 (not found); Trust center 8/8; Privacy policy 6/6; security.txt 6/6; Security page 5/5; Status page 5/5; Vulnerability disclosure 0/5 (not found); Pages still reachable 8/8
- Supply chain: relies on 19 tracked vendors directly, 157 within two hops, 392 within three; 11 tracked vendors rely on it directly, 58 within two hops, 878 within three
- Cite as: Nango, Third Party Index, https://thirdpartyindex.com/vendors/nango-dev (data CC BY 4.0)

## Documents

| Document | URL | Last verified | Last changed |
|---|---|---|---|
| Trust center | https://trust.nango.dev/ | 2026-10-02 | 2026-10-02 |
| Subprocessor list | https://nango.dev/subprocessors | 2026-10-02 | 2026-10-02 |
| Privacy policy | https://nango.dev/privacy-policy | 2026-10-02 | 2026-10-02 |
| Terms | https://nango.dev/terms | 2026-10-02 | 2026-10-02 |
| Security page | https://nango.dev/docs/guides/platform/security | 2026-10-02 | 2026-10-02 |
| security.txt | https://nango.dev/.well-known/security.txt | 2026-10-02 | 2026-10-02 |
| Status page | https://status.nango.dev/ | 2026-10-02 | 2026-10-02 |

## Subprocessors (20)

As its own list states them.

| Subprocessor | Purpose | Location | Listed since |
|---|---|---|---|
| [AWS](https://thirdpartyindex.com/vendors/amazon-web-services.md) | Cloud computing | USA | 2026-10-02 |
| [Betterstack](https://thirdpartyindex.com/vendors/better-stack.md) | Incident management | USA | 2026-10-02 |
| [Clickhouse](https://thirdpartyindex.com/vendors/clickhouse.md) | Logs & Metrics | USA | 2026-10-02 |
| [Datadog](https://thirdpartyindex.com/vendors/datadog.md) | Monitoring & alerting | USA | 2026-10-02 |
| [Elastic Cloud](https://thirdpartyindex.com/vendors/elasticsearch.md) | Log management | USA | 2026-10-02 |
| [GCP](https://thirdpartyindex.com/vendors/google-cloud.md) | Data warehousing | USA | 2026-10-02 |
| [Google](https://thirdpartyindex.com/vendors/google-cloud.md) | Email support | USA | 2026-10-02 |
| [Hubspot](https://thirdpartyindex.com/vendors/hubspot.md) | CRM | USA | 2026-10-02 |
| [Mailgun](https://thirdpartyindex.com/vendors/mailgun.md) | Transactional emails | USA | 2026-10-02 |
| [Metabase](https://thirdpartyindex.com/vendors/metabase.md) | Business intelligence | USA | 2026-10-02 |
| [Orb](https://thirdpartyindex.com/vendors/orb.md) | Billing | USA | 2026-10-02 |
| [Plain](https://thirdpartyindex.com/vendors/plain.md) | Customer support | UK | 2026-10-02 |
| [Posthog](https://thirdpartyindex.com/vendors/posthog.md) | Product analytics | USA | 2026-10-02 |
| [Resend](https://thirdpartyindex.com/vendors/resend.md) | Marketing emails | USA | 2026-10-02 |
| [Retool](https://thirdpartyindex.com/vendors/retool.md) | Workflow automation | USA | 2026-10-02 |
| [Sentry](https://thirdpartyindex.com/vendors/sentry.md) | Error reporting | USA | 2026-10-02 |
| [Slack](https://thirdpartyindex.com/vendors/slack.md) | Communication | USA | 2026-10-02 |
| [Stripe](https://thirdpartyindex.com/vendors/stripe.md) | Payment processing | USA | 2026-10-02 |
| [WorkOS](https://thirdpartyindex.com/vendors/workos.md) | SSO & SAML | USA | 2026-10-02 |
| [Zapier](https://thirdpartyindex.com/vendors/zapier.md) | Workflow automation | USA | 2026-10-02 |

Read from ([evidence](https://thirdpartyindex.com/evidence/34845)). CSV: https://thirdpartyindex.com/vendors/nango-dev/subprocessors.csv

## Compliance

As its trust center lists them.

- Audited: SOC 2 ([evidence](https://thirdpartyindex.com/evidence/34847))
- Claimed: HIPAA, GDPR ([evidence](https://thirdpartyindex.com/evidence/34847))

## Subprocessor of (11)

Tracked vendors whose own subprocessor lists name it, and what they say they use it for.

- [ClickTime](https://thirdpartyindex.com/vendors/clicktime.md): App Integration; Engineering
- [CodeSignal](https://thirdpartyindex.com/vendors/codesignal.md): Integration Infrastructure; Managed integrations and credential storage for connected sources.
- [EverTrue](https://thirdpartyindex.com/vendors/evertrue.md): API Integration Service
- [Instantly](https://thirdpartyindex.com/vendors/instantly.md): Engineering; Third-party integration and connection management services
- [Lago](https://thirdpartyindex.com/vendors/lago.md): Integration platform — Lago builds connectors on top of the Nango API to sync customer account data, invoice data, and CRM records with third-party systems (e…
- [Outlit](https://thirdpartyindex.com/vendors/outlit.md): Integration platform, API orchestration
- [Plain](https://thirdpartyindex.com/vendors/plain.md): Integrations
- [Sched](https://thirdpartyindex.com/vendors/sched.md): OAuth token management for Slack integration
- [Spara](https://thirdpartyindex.com/vendors/spara.md): Used as a PaaS, specifically for quickly creating authentication for our third-party integrations. Because of this, Nango will process customer-provided documen…
- [Wolfia](https://thirdpartyindex.com/vendors/wolfia.md): Unified OAuth broker that proxies authentication and data sync for customer-side integrations
- [zig.ai](https://thirdpartyindex.com/vendors/zig-ai.md): Security Software

## Security contact

From its security.txt (https://nango.dev/.well-known/security.txt) ([evidence](https://thirdpartyindex.com/evidence/34831)):

- Contact: mailto:security@nango.dev
- Contact: https://github.com/NangoHQ/nango/security/advisories
- Disclosure policy: https://www.nango.dev/security
- Languages: en
- Valid until 2027-12-31

---

Third Party Index (https://thirdpartyindex.com) monitors vendors' public security and privacy documents and keeps each version as evidence. Data CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/); vendors' own documents are theirs. API: https://thirdpartyindex.com/api