# PCI Pal

PCI Pal declares [10 subprocessors](https://thirdpartyindex.com/vendors/pci-pal#subprocessors) in [its subprocessor list](https://trust.pcipal.com/), which we last checked on 2026-11-11 ([evidence](https://thirdpartyindex.com/evidence/231789)). They include [Microsoft](https://thirdpartyindex.com/vendors/microsoft), [Salesforce](https://thirdpartyindex.com/vendors/salesforce) and [Datadog](https://thirdpartyindex.com/vendors/datadog). No published changes since we first read it on 2026-11-07. [1 tracked vendor](https://thirdpartyindex.com/vendors/pci-pal#used-by), [8x8](https://thirdpartyindex.com/vendors/8x8), names PCI Pal as a subprocessor.

PCI Pal (pcipal.com): subprocessors, data processing agreement, security documents and changes, as monitored by Third Party Index.

- Page: https://thirdpartyindex.com/vendors/pci-pal
- Documents last verified: 2026-11-12
- Transparency rating: 85/100 (how much it publishes, not how secure it is): Subprocessor list 30/30; Processing locations 8/8; Purposes 7/7; Data processing addendum 12/12; Trust center 8/8; Privacy policy 6/6; security.txt 6/6; Security page 0/5 (not found); Status page 0/5 (not found); Vulnerability disclosure 0/5 (not found); Pages still reachable 8/8
- Supply chain: relies on 10 tracked vendors directly, 151 within two hops, 473 within three; 1 tracked vendors rely on it directly, 3 within two hops, 4 within three
- Cite as: PCI Pal, Third Party Index, https://thirdpartyindex.com/vendors/pci-pal (data CC BY 4.0)

## Documents

| Document | URL | Last verified | Last changed |
|---|---|---|---|
| Trust center | https://www.pcipal.com/trust-center/ | 2026-11-12 | 2026-11-06 |
| Subprocessor list | https://trust.pcipal.com/ | 2026-11-11 | 2026-11-07 |
| Data processing addendum | https://legal.pcipal.com/privacy-center.html | 2026-11-11 | 2026-11-07 |
| Privacy policy | https://www.pcipal.com/privacy-policy/ | 2026-11-12 | 2026-11-06 |
| Terms | https://www.pcipal.com/terms-of-use/ | 2026-11-12 | 2026-11-06 |
| security.txt | https://www.pcipal.com/.well-known/security.txt | 2026-11-12 | 2026-11-06 |

## Subprocessors (10)

As its own list states them.

| Subprocessor | Purpose | Location | Listed since |
|---|---|---|---|
| [Allego](https://thirdpartyindex.com/vendors/allego.md) | PCI Pal uses Allego as a sub-processor to support sales enablement activities, including training content delivery and sales call/presentation review. Allego operates under its own compliance certifications and maintains documentation governing the processing of any personal data involved. Further detail on Allego's compliance posture is available via the Allego Trust Centre. | US | 2026-11-07 |
| [Amplemarket](https://thirdpartyindex.com/vendors/amplemarket.md) | PCI Pal uses Amplemarket as a sub-processor to support sales prospecting and outreach activities, including identifying, enriching, and engaging prospective customer contacts. Amplemarket operates under its own compliance certifications and maintains documentation governing the processing of any personal data involved. Further detail on Amplemarket's compliance posture is available via the Amplemarket Trust Centre. | US | 2026-11-07 |
| [Datadog](https://thirdpartyindex.com/vendors/datadog.md) | Real-time cloud monitoring and observability platform that tracks metrics, logs, and traces across applications, servers, and infrastructure. | US, EU | 2026-11-07 |
| [DocuSign](https://thirdpartyindex.com/vendors/docusign.md) | PCI Pal uses DocuSign as a sub-processor to facilitate secure electronic signature and document execution processes. This supports the handling of contracts, agreements, and related documentation as part of PCI Pal's business operations. DocuSign operates under its own extensive compliance certifications (including ISO 27001 and SOC 2) and maintains a Data Processing Agreement (DPA) governing the processing of any personal data involved. Further detail on DocuSign's compliance posture is available via the DocuSign Trust Centre. | US, EU | 2026-11-07 |
| [Elastic](https://thirdpartyindex.com/vendors/elasticsearch.md) | PCI Pal uses Elastic as a sub-processor to support logging, search, and monitoring functions within its technical infrastructure. Elastic operates under its own compliance certifications and provides a Data Processing Agreement (DPA) governing the processing of any personal data involved. Further detail on Elastic's compliance posture is available via Elastic's Trust and security documentation. | EU, US, UK | 2026-11-07 |
| [Ironclad](https://thirdpartyindex.com/vendors/ironclad.md) | PCI Pal uses Ironclad as a sub-processor to support contract lifecycle management, including the drafting, review, approval, and archiving of contracts and related agreements. Ironclad operates under its own compliance certifications and maintains documentation governing the processing of any personal data involved. Further detail on Ironclad's compliance posture is available via the Ironclad Trust Centre. | US | 2026-11-07 |
| [LinkedIn](https://thirdpartyindex.com/vendors/linkedin.md) | PCI Pal uses LinkedIn Sales Navigator as a sub-processor to support sales prospecting and business development activities, including identifying and researching prospective customer contacts. LinkedIn operates under its own compliance certifications and maintains a Data Processing Agreement (DPA) governing the processing of any personal data involved. Further detail on LinkedIn's compliance posture is available via the LinkedIn Trust Centre. | US | 2026-11-07 |
| [Microsoft 365](https://thirdpartyindex.com/vendors/microsoft.md) | PCI Pal uses Microsoft 365 as a sub-processor to support core business operations, including email, collaboration, and document storage (via Teams and related services). Microsoft operates under its own extensive compliance certifications (including ISO 27001, SOC 2, and PCI DSS) and provides a documented Service Level Agreement (99.9% availability). Further detail on Microsoft's compliance posture is available via the Microsoft Service Trust Portal. | Global | 2026-11-07 |
| [SafeBase](https://thirdpartyindex.com/vendors/drata.md) | PCI Pal uses SafeBase (Advanced package) as a sub-processor to operate its Trust Centre and to automate responses to customer and prospect security questionnaires. The platform maintains a trust content library of approved question-and-answer pairs and matches incoming questionnaire questions against this library to generate draft responses for human review. SafeBase is a vendor-hosted, cloud-based platform — PCI Pal does not provision or maintain any underlying infrastructure — and integrates with Salesforce to verify account and NDA/commercial status as part of the Trust Centre access process. Further detail on SafeBase's compliance posture is available via the SafeBase Trust Centre. | US | 2026-11-07 |
| [Salesforce](https://thirdpartyindex.com/vendors/salesforce.md) | PCI Pal uses Salesforce as a sub-processor to support customer relationship management (CRM) activities, including the storage and management of customer and prospect data. Salesforce operates under its own extensive compliance certifications (including ISO 27001, SOC 2, and PCI DSS) and maintains a Data Processing Agreement (DPA) and Transfer Agreement governing the processing and international transfer of any personal data involved. Further detail on Salesforce's compliance posture is available via the Salesforce Trust site. | Global | 2026-11-07 |

Read from ([evidence](https://thirdpartyindex.com/evidence/231789)). CSV: https://thirdpartyindex.com/vendors/pci-pal/subprocessors.csv

## Web Technologies

PCI Pal's homepage made 219 requests to 7 domains, and 3 services controlled by another company. Loaded on 2026-11-07 by a browser that accepted nothing; other visits may load more or less. What a page loads is not a list of who receives customer data.

3 third parties by category: Analytics 2 (Google Cloud, Fathom Analytics); Cookie compliance 1 (CookieYes). Each company that appears controlled by another organization is counted once, under the main category of the technologies detected from it on this homepage or, when none was, the category recorded from the company's own page (marked reviewed) or else the one it is usually detected as on other published homepages (marked as such); unclassified: none of these.

### Third parties (3)

- CookieYes: 10 requests to cdn-cookieyes.com, cookieyes.com; CookieYes
- Google Cloud: 5 requests to googletagmanager.com, google-analytics.com, googlesyndication.com; Google Analytics, Google Tag Manager
- Fathom Analytics: 2 requests to usefathom.com; Fathom

### First party (1)

- PCI Pal: 202 requests to pcipal.com; Cloudflare, GSAP, Google Font API, HSTS, HTTP/3, MySQL, Open Graph, PHP, Priority Hints, RSS, Swiper, WP Engine, WP Rocket, WordPress, WordPress Block Editor, WordPress Site Editor, jQuery 3.7.1, jQuery Migrate 3.4.1

3 tracked companies loaded by the homepage are not in PCI Pal's subprocessor list. A website can use a service without it processing customer data.

## Subprocessor of (1)

Tracked vendors whose own subprocessor lists name it, and what they say they use it for.

- [8x8](https://thirdpartyindex.com/vendors/8x8.md): PCI Card data \[This sub processor is only used if Securepay is ordered\]; Software Provider \[as a Service Provider\]

## Incidents reported by PCI Pal's subprocessors

Incidents reported in the last 30 days on their own status pages by 4 vendors PCI Pal lists as subprocessors. A subprocessor list names a company, not the service an incident touched.

- 2026-11-04: [Elasticsearch](https://thirdpartyindex.com/vendors/elasticsearch#status), which PCI Pal lists as a subprocessor, reported mOLTP PrivateLink connectivity issue (major)
- 2026-10-28: [Datadog](https://thirdpartyindex.com/vendors/datadog#status), which PCI Pal lists as a subprocessor, reported Metrics query are disrupted (major)
- 2026-10-26: [Datadog](https://thirdpartyindex.com/vendors/datadog#status), which PCI Pal lists as a subprocessor, reported Elevated Error Rates for Workflow Automation, App Builder, Bits Code, Bits Agent Builder (major)
- 2026-10-23: [Elasticsearch](https://thirdpartyindex.com/vendors/elasticsearch#status), which PCI Pal lists as a subprocessor, reported Elastic Support Portal is unavailable (major)
- 2026-10-22: [Amplemarket](https://thirdpartyindex.com/vendors/amplemarket#status), which PCI Pal lists as a subprocessor, reported Dialer - Potential Issue with Transcriptions (no impact stated)
- 2026-10-22: [Elasticsearch](https://thirdpartyindex.com/vendors/elasticsearch#status), which PCI Pal lists as a subprocessor, reported 403 error when trying to access Autoops in newly created serverless projects (major)
- 2026-10-21: [Ironclad](https://thirdpartyindex.com/vendors/ironclad#status), which PCI Pal lists as a subprocessor, reported Third-party Signature Platform (Dropbox Sign) is currently experiencing an issue. (major)
- 2026-10-20: [Elasticsearch](https://thirdpartyindex.com/vendors/elasticsearch#status), which PCI Pal lists as a subprocessor, reported Elastic Cloud scaling issues in Azure (major)
- 2026-10-20: [Elasticsearch](https://thirdpartyindex.com/vendors/elasticsearch#status), which PCI Pal lists as a subprocessor, reported Degraded availability for some Elastic Cloud Hosted and Serverless deployments in GCP europe-west2 (London) (major)

The subprocessor list as we read it on any date: https://thirdpartyindex.com/labs/time-machine/pci-pal

## Security contact

From its security.txt (https://www.pcipal.com/.well-known/security.txt) ([evidence](https://thirdpartyindex.com/evidence/223402)):

- Contact: https://www.pcipal.com/trust-center/
- Disclosure policy: https://www.pcipal.com/trust-center/
- Valid until 2027-10-01

---

Third Party Index (https://thirdpartyindex.com) monitors vendors' public security and privacy documents and keeps each version as evidence. Data CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/); vendors' own documents are theirs. API: https://thirdpartyindex.com/api