# Ortto

Ortto (ortto.com): subprocessors, data processing agreement, security documents and changes, as monitored by Third Party Index.

- Page: https://thirdpartyindex.com/vendors/ortto
- Documents last verified: 2026-09-30
- Transparency rating: 83/100 (how much it publishes, not how secure it is)
- Cite as: Ortto, Third Party Index, https://thirdpartyindex.com/vendors/ortto (data CC BY 4.0)

## Documents

| Document | URL | Last verified | Last changed |
|---|---|---|---|
| Trust center | https://trust.ortto.com/ | 2026-09-30 | 2026-09-30 |
| Subprocessor list | https://trust.ortto.com/subprocessors | 2026-09-30 | 2026-09-30 |
| Privacy policy | https://ortto.com/privacy/ | 2026-09-30 | 2026-09-30 |
| Terms | https://ortto.com/terms/ | 2026-09-30 | 2026-09-30 |
| Security page | https://ortto.com/security-privacy/ | 2026-09-30 | 2026-09-30 |
| security.txt | https://ortto.com/.well-known/security.txt | 2026-09-30 | 2026-09-30 |
| Status page | https://www.orttostatus.com/ | 2026-09-30 | 2026-09-30 |

## Subprocessors (12)

As its own list states them.

| Subprocessor | Purpose | Location | Listed since |
|---|---|---|---|
| [Amazon Web Services](https://thirdpartyindex.com/vendors/amazon-web-services.md) | AWS provides the core cloud infrastructure that powers Ortto's platform, including compute, networking, and storage resources.; Cloud Infrastructure | United States, European Union, Australia | 2026-09-30 |
| ApiFlash | ApiFlash generates visual previews of web pages and email content for display within the Ortto interface.; Web Page Screenshot Rendering | United States | 2026-09-30 |
| [Beefree](https://thirdpartyindex.com/vendors/beefree.md) | Beefree powers Ortto's drag-and-drop email editor and stores images uploaded by customers while building email templates.; Email Template Asset Storage | United States, European Union, Australia | 2026-09-30 |
| [Canny](https://thirdpartyindex.com/vendors/canny.md) | Canny is used by Ortto to collect and manage product feedback and feature requests submitted by customers.; Product Feedback Management | United States | 2026-09-30 |
| ChartMogul | ChartMogul processes Ortto's subscription and account-level data to provide internal visibility into revenue metrics such as MRR, churn, and customer lifetime value.; Revenue and Subscription Analytics | European Union | 2026-09-30 |
| EHAWK | E-Hawk is used by Ortto during the sign-up process to validate email addresses and assess the risk of incoming registrations, helping to detect fraudulent or invalid accounts before they are created. In doing so, E-Hawk processes personal data including email addresses and IP addresses submitted by prospective users. | Sign-up Fraud and Risk Validation | 2026-09-30 |
| [Elastic Cloud](https://thirdpartyindex.com/vendors/elasticsearch.md) | Application Log Management; Elastic Cloud stores and indexes Ortto's application and system logs, supporting platform debugging, performance monitoring, and security auditing. | United States, European Union, Australia | 2026-09-30 |
| [Google Cloud Platform](https://thirdpartyindex.com/vendors/google-cloud.md) | Backup Storage; Google Cloud Platform is used exclusively by Ortto for backup storage, ensuring customer data can be restored in the event of data loss or a system failure. | United States, European Union, Australia | 2026-09-30 |
| [MongoDB Atlas](https://thirdpartyindex.com/vendors/mongodb.md) | MongoDB Atlas is Ortto's primary database, storing customer profiles, activity histories, campaign configurations, and audience segments.; Primary Database Storage | United States, European Union, Australia | 2026-09-30 |
| [Recurly](https://thirdpartyindex.com/vendors/recurly.md) | Recurly manages Ortto's subscription billing lifecycle, including invoicing, payment processing, and renewals.; Subscription Billing and Management | United States | 2026-09-30 |
| [SendGrid](https://thirdpartyindex.com/vendors/sendgrid.md) | Email Delivery; SendGrid handles the delivery of all customer-facing emails sent through Ortto, including campaigns, automated journeys, and transactional messages. | United States | 2026-09-30 |
| [Twilio](https://thirdpartyindex.com/vendors/twilio.md) | SMS Delivery; Twilio provides the telecommunications infrastructure that powers Ortto's SMS messaging capabilities, routing messages through its global carrier network on Ortto's behalf. | United States, European Union, Australia | 2026-09-30 |

Read from ([evidence](https://thirdpartyindex.com/evidence/20858)). CSV: https://thirdpartyindex.com/vendors/ortto/subprocessors.csv

## Compliance

As its trust center lists them.

- Audited: SOC 2 Type II, ISO/IEC 27001, ISO/IEC 27701 ([evidence](https://thirdpartyindex.com/evidence/20857))
- Claimed: HIPAA, GDPR, CCPA/CPRA ([evidence](https://thirdpartyindex.com/evidence/20857))

## Listed as a subprocessor by (0)

No tracked vendor lists it.

## Service status

Incidents it reported on its own status page.

- Last 90 days: 0 reported incidents (0 major or critical, 0 minor, 0 with no impact stated)
- 2026-04-09: Service Disruption (minor)
- 2026-03-19: Knowledge Base Feature Outage (help.ortto.com) (minor)
- 2026-01-27: Autopilot Journeys Web Application loading and email editor issues (minor)
- 2026-01-26: Intermittent loading issues on Autopilot Journey subcomponent (minor)
- 2026-01-23: \[Autopilot Journeys\] - Smart Segment Degradation (minor)
- 2025-12-01: Partial Outage of Ortto Web Interface and API (major)

## Security contact

From its security.txt (https://ortto.com/.well-known/security.txt):

- Contact: mailto:security@canva.com
- Contact: mailto:help@ortto.com
- Disclosure policy: https://ortto.com/policies/ResponsibleDisclosure.pdf

---

Third Party Index (https://thirdpartyindex.com) monitors vendors' public security and privacy documents and keeps each version as evidence. Data CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/); vendors' own documents are theirs. API: https://thirdpartyindex.com/api