# Plex.tv

We have not found a subprocessor list published by Plex.tv. We monitor 4 of its documents, which we last checked on 2026-11-11.

Plex.tv (plex.tv): subprocessors, data processing agreement, security documents and changes, as monitored by Third Party Index.

- Page: https://thirdpartyindex.com/vendors/plex-tv
- Documents last verified: 2026-11-11
- Transparency rating: 25/100 (how much it publishes, not how secure it is): Subprocessor list 0/30 (not found); Processing locations 0/8 (no list); Purposes 0/7 (no list); Data processing addendum 0/12 (not found); Trust center 0/8 (not found); Privacy policy 6/6; security.txt 6/6; Security page 0/5 (not found); Status page 5/5; Vulnerability disclosure 0/5 (not found); Pages still reachable 8/8
- Supply chain: relies on 0 tracked vendors directly, 0 within two hops, 0 within three; 0 tracked vendors rely on it directly, 0 within two hops, 0 within three
- Cite as: Plex.tv, Third Party Index, https://thirdpartyindex.com/vendors/plex-tv (data CC BY 4.0)

## Documents

| Document | URL | Last verified | Last changed |
|---|---|---|---|
| Privacy policy | https://www.plex.tv/about/privacy-legal/ | 2026-11-11 | 2026-10-06 |
| Terms | https://www.plex.tv/about/privacy-legal/plex-terms-of-service | 2026-11-11 | 2026-10-06 |
| security.txt | https://plex.tv/.well-known/security.txt | 2026-11-11 | 2026-09-21 |
| Status page | https://status.plex.tv/ | 2026-11-11 | 2026-11-01 |

## Subprocessors (0)

No subprocessor list has been found or read for this vendor.

## Web Technologies

Plex.tv's homepage made 360 requests to 51 domains, 33 services controlled by another company, and 6 domains not identified. Loaded on 2026-10-12 by a browser that accepted nothing; other visits may load more or less. What a page loads is not a list of who receives customer data.

33 third parties by category: Advertising 16 (Google Cloud, OpenX; reviewed: Criteo, Equativ, FreeWheel, LoopMe Limited, Media.net Advertising FZ-LLC, MediaMath, Nexxen, OneTag Limited, TripleLift, Viant Technology; usually detected as Advertising: Magnite, Inc., The Trade Desk, Inc., Seedtag Advertising, S.L., Sovrn); Analytics 4 (Fullstory, TikTok, TikTok; usually detected as Analytics: LinkedIn); Cookie compliance 1 (usually detected as Cookie compliance: InMobi); Issue trackers 1 (Sentry); Miscellaneous 1 (reviewed: Yahoo); Retargeting 1 (usually detected as Retargeting: RTB House); Widgets 1 (usually detected as Widgets: Outbrain); Unclassified 8 (Venatus Media Limited, AdTheorent, AgenticX, Appier, Moloco, Onfocus (Adagio), Rise (Risecodes), Tappx). Each company that appears controlled by another organization is counted once, under the main category of the technologies detected from it on this homepage or, when none was, the category recorded from the company's own page (marked reviewed) or else the one it is usually detected as on other published homepages (marked as such); unclassified: none of these.

### Third parties (33)

- Google Cloud: 50 requests to google.com, doubleclick.net, adtrafficquality.google, googlesyndication.com, googletagmanager.com, gstatic.com, googleadservices.com; DoubleClick Floodlight, Funding Choices, Google Analytics, Google Publisher Tag, Google Sign-in, Google Tag Manager
- Fullstory: 7 requests to fullstory.com; FullStory
- TikTok: 7 requests to tiktok.com; TikTok Pixel
- Criteo: 4 requests to criteo.com, criteo.net
- OpenX: 4 requests to openx.net, openxcdn.net; OpenX
- Venatus Media Limited: 3 requests to venatus.com, venatusmedia.com, vntsm.com
- Magnite, Inc.: 2 requests to rubiconproject.com, tremorhub.com
- RTB House: 2 requests to creativecdn.com
- The Trade Desk, Inc.: 2 requests to adsrvr.org
- AdTheorent: 1 request to adentifi.com
- AgenticX: 1 request to theagenticx.ai
- Appier: 1 request to appier.net
- Equativ: 1 request to smartadserver.com
- FreeWheel: 1 request to bidr.io
- InMobi: 1 request to inmobi.com
- LinkedIn: 1 request to linkedin.com
- LoopMe Limited: 1 request to loopme.me
- Media.net Advertising FZ-LLC: 1 request to media.net
- MediaMath: 1 request to mathtag.com
- Moloco: 1 request to moloco.com
- Nexxen: 1 request to turn.com
- OneTag Limited: 1 request to onetag-sys.com
- Onfocus (Adagio): 1 request to 4dex.io
- Outbrain: 1 request to outbrain.com
- Rise (Risecodes): 1 request to yellowblue.io
- Seedtag Advertising, S.L.: 1 request to seedtag.com
- Sentry: 1 request to sentry-cdn.com; Sentry
- Sovrn: 1 request to lijit.com
- Tappx: 1 request to tappx.com
- TikTok: 1 request to tiktokw.us; TikTok Pixel
- TripleLift: 1 request to 3lift.com
- Viant Technology: 1 request to ipredictive.com
- Yahoo: 1 request to yahoo.com

### Unknown (6)

Domains not identified yet: redfastlabs.com, advolve.io, cognitivlabs.com, hb-vntsm-com.global.ssl.fastly.net, redfast.com, rtbscale.com

### First party (1)

- Plex.tv: 248 requests to plex.tv; Cloudflare, Criteo, HSTS, Next.js 16.3.7, Next.js App Router, Open Graph, PWA, Priority Hints, React, Turbopack, Webpack, reCAPTCHA

14 tracked companies loaded by the homepage are not in Plex.tv's subprocessor list. A website can use a service without it processing customer data.

## Subprocessor of (0)

No tracked vendor lists it.

## Security record

CISA's Known Exploited Vulnerabilities catalog lists 5 vulnerabilities in its software:

- CVE-2026-96652 (Media Server), listed 2026-10-20: Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability
- CVE-2026-96654 (Media Server), listed 2026-10-20: Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability
- CVE-2026-96655 (Media Server), listed 2026-10-20: Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability
- CVE-2026-96656 (Media Server), listed 2026-10-20: Plex Media Server External Control of File Name or Path Vulnerability
- CVE-2020-5741 (Media Server), listed 2023-03-10: Plex Media Server Remote Code Execution Vulnerability

Breaches listed by Have I Been Pwned (CC BY 4.0, haveibeenpwned.com):

- Plex, 2015-07-02: 327314 accounts; data: Email addresses, IP addresses, Passwords, Usernames

## Service status

Incidents it reported on its own status page.

- Last 90 days: 13 reported incidents (4 major or critical, 3 minor, 6 with no impact stated)
- Typical time to resolve: 2 h 22 min
- Status page last read: 2026-11-12
- 2026-10-20: Marketing site is down (no impact stated)
- 2026-10-10: 401 responses for Luma requests with proxy token (no impact stated)
- 2026-10-08: my-plex pods resolved DB's DNS to old/blue DB instead of new/green one (no impact stated)
- 2026-10-06: No AVOD ads on iOS or tvOS (no impact stated)
- 2026-10-02: plex.direct name resolution (no impact stated)
- 2026-10-01: Outbound connection issue from our prod-us-east-1 kubernetes cluster (no impact stated)
- 2026-09-23: Watch-Together - Rooms creation failure (major)
- 2026-09-14: DNS Issues with plex.tv API (critical)

## Security contact

From its security.txt (https://plex.tv/.well-known/security.txt) ([evidence](https://thirdpartyindex.com/evidence/1349)):

- Contact: mailto:security@plex.tv
- Disclosure policy: https://support.plex.tv/articles/reporting-security-issues/
- Encryption key: https://plex-security.s3.amazonaws.com/plex-security-public-key.asc
- Languages: en
- No expiry date

---

Third Party Index (https://thirdpartyindex.com) monitors vendors' public security and privacy documents and keeps each version as evidence. Data CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/); vendors' own documents are theirs. API: https://thirdpartyindex.com/api