# Red Hat

[8 tracked vendors](https://thirdpartyindex.com/vendors/red-hat#used-by) name Red Hat as a subprocessor, including [Microsoft](https://thirdpartyindex.com/vendors/microsoft), [Mailgun](https://thirdpartyindex.com/vendors/mailgun) and [Deepgram](https://thirdpartyindex.com/vendors/deepgram). We have not found a subprocessor list published by Red Hat. We monitor 7 of its documents, which we last checked on 2026-11-11.

Red Hat (redhat.com): subprocessors, data processing agreement, security documents and changes, as monitored by Third Party Index.

- Page: https://thirdpartyindex.com/vendors/red-hat
- Documents last verified: 2026-11-11
- Transparency rating: 50/100 (how much it publishes, not how secure it is): Subprocessor list 0/30 (not found); Processing locations 0/8 (no list); Purposes 0/7 (no list); Data processing addendum 12/12; Trust center 8/8; Privacy policy 6/6; security.txt 6/6; Security page 5/5; Status page 5/5; Vulnerability disclosure 0/5 (not found); Pages still reachable 8/8
- Supply chain: relies on 0 tracked vendors directly, 0 within two hops, 0 within three; 8 tracked vendors rely on it directly, 1306 within two hops, 2755 within three
- Cite as: Red Hat, Third Party Index, https://thirdpartyindex.com/vendors/red-hat (data CC BY 4.0)

## Documents

| Document | URL | Last verified | Last changed |
|---|---|---|---|
| Trust center | https://www.redhat.com/en/trust | 2026-11-11 | 2026-10-10 |
| Data processing addendum | https://www.redhat.com/en/about/agreements | 2026-11-11 | 2026-10-10 |
| Privacy policy | https://www.redhat.com/en/about/privacy-policy | 2026-11-11 | 2026-10-10 |
| Terms | https://www.redhat.com/en/about/terms-use | 2026-11-11 | 2026-10-10 |
| Security page | https://www.redhat.com/en/topics/security | 2026-11-11 | 2026-10-10 |
| security.txt | https://www.redhat.com/.well-known/security.txt | 2026-11-11 | 2026-09-22 |
| Status page | https://status.redhat.com/ | 2026-11-11 | 2026-11-11 |

## Subprocessors (0)

No subprocessor list has been found or read for this vendor.

## Compliance

As its trust center lists them.

- FedRAMP Marketplace: High · 4 agency authorizations · since Aug 9, 2023

## Web Technologies

Red Hat's homepage made 226 requests to 32 domains, 19 services controlled by another company, and 1 domain not identified. Loaded on 2026-11-05 by a browser that accepted nothing; other visits may load more or less. What a page loads is not a list of who receives customer data.

19 third parties by category: Advertising 7 (Google Cloud, MNTN, Inc., Basis Technologies (Basis; formerly Centro); reviewed: Claritas, LLC, FreeWheel; usually detected as Advertising: The Trade Desk, Inc., X Corp.); Analytics 6 (ZoomInfo, Contentsquare, LinkedIn, Meta, Cloudflare; usually detected as Analytics: Bombora); Marketing automation 1 (Adobe); Live chat 1 (Qualified.com, Inc.); A/B Testing 1 (UserTesting); Cookie compliance 1 (TrustArc); Issue trackers 1 (usually detected as Issue trackers: Sentry); Surveys 1 (Qualtrics). Each company that appears controlled by another organization is counted once, under the main category of the technologies detected from it on this homepage or, when none was, the category recorded from the company's own page (marked reviewed) or else the one it is usually detected as on other published homepages (marked as such); unclassified: none of these.

### Third parties (19)

- Adobe: 31 requests to adobedtm.com, marketo.net, demdex.net, everesttech.net, mktoresp.com; Marketo
- Qualified.com, Inc.: 30 requests to qualified.com; Qualified
- Google Cloud: 16 requests to doubleclick.net, google.com, googletagmanager.com, youtube.com; DoubleClick Floodlight, Google Analytics, Google Tag Manager, YouTube
- TrustArc: 9 requests to trustarc.com; TrustArc
- ZoomInfo: 5 requests to zoominfo.com, zi-scripts.com; Zoominfo
- MNTN, Inc.: 4 requests to mountain.com; Mountain
- Contentsquare: 3 requests to contentsquare.net; Contentsquare
- LinkedIn: 3 requests to linkedin.com, licdn.com; Linkedin Insight Tag
- Meta: 3 requests to facebook.net, facebook.com; Facebook Pixel 2.9.435
- Qualtrics: 3 requests to qualtrics.com; Qualtrics
- Basis Technologies (Basis; formerly Centro): 2 requests to basis.net, sitescout.com; Basis Technologies
- UserTesting: 2 requests to userzoom.com; UserZoom
- Bombora: 1 request to ml314.com
- Claritas, LLC: 1 request to trkn.us
- Cloudflare: 1 request to cloudflareinsights.com; Cloudflare Browser Insights
- FreeWheel: 1 request to bidr.io
- Sentry: 1 request to sentry.io
- The Trade Desk, Inc.: 1 request to adsrvr.org
- X Corp.: 1 request to twitter.com

### Unknown (1)

Domains not identified yet: 100.20.58.101

### First party (1)

- Red Hat: 107 requests to redhat.com; Adobe Audience Manager, Adobe Experience Platform Launch, Akamai, Akamai Bot Manager, Apache HTTP Server, Drupal 10, HSTS, Open Graph, PHP, Priority Hints, Sentry, core-js 3.32.2, lit-element 4.2.1, lit-html 3.3.1

12 tracked companies loaded by the homepage are not in Red Hat's subprocessor list. A website can use a service without it processing customer data.

## Subprocessor of (8)

Tracked vendors whose own subprocessor lists name it, and what they say they use it for.

- [Adobe](https://thirdpartyindex.com/vendors/adobe.md): Adobe leverages OpenShift on top of its cloud infrastructure to orchestrate, scale, and manage its services. OpenShift is an implementation of Kubernetes, which…
- [Deepgram](https://thirdpartyindex.com/vendors/deepgram.md): A security-focused and scalable private registry platform for managing content across globally distributed datacenter and cloud environments.
- [Mailgun](https://thirdpartyindex.com/vendors/mailgun.md): OS, Support
- [Microsoft](https://thirdpartyindex.com/vendors/microsoft.md): Deploying, operating, and troubleshooting Azure Red Hat OpenShift
- [Rackspace](https://thirdpartyindex.com/vendors/rackspace.md): Products & Services – Storage
- [Sinch](https://thirdpartyindex.com/vendors/sinch.md): OS, Support
- [Syndigo](https://thirdpartyindex.com/vendors/syndigo.md): The duration of the Processing is generally determined by the services agreement with the Sub-Processor.; The nature of the Processing involves: collection, , o…
- [TierPoint](https://thirdpartyindex.com/vendors/tierpoint.md): Products & Services

## Security record

CISA's Known Exploited Vulnerabilities catalog lists 9 vulnerabilities in its software:

- CVE-2015-3246 (Libuser), listed 2026-08-26: Red Hat Libuser Race Condition Vulnerability
- CVE-2015-5287 (Automatic Bug Reporting Tool), listed 2026-08-26: Red Hat Automatic Bug Reporting Tool Privilege Escalation Vulnerability
- CVE-2018-14667 (JBoss RichFaces Framework), listed 2023-09-28: Red Hat JBoss RichFaces Framework Expression Language Injection Vulnerability
- CVE-2021-3560 (Polkit), listed 2023-05-12: Red Hat Polkit Incorrect Authorization Vulnerability
- CVE-2021-4034 (Polkit), listed 2022-06-27: Red Hat Polkit Out-of-Bounds Read and Write Vulnerability (known ransomware use)
- CVE-2010-0738 (JBoss), listed 2022-05-25: Red Hat JBoss Authentication Bypass Vulnerability (known ransomware use)
- CVE-2010-1428 (JBoss), listed 2022-05-25: Red Hat JBoss Information Disclosure Vulnerability (known ransomware use)
- CVE-2010-1871 (JBoss Seam 2), listed 2021-12-10: Red Hat Linux JBoss Seam 2 Remote Code Execution Vulnerability
- CVE-2017-12149 (JBoss Application Server), listed 2021-12-10: Red Hat JBoss Application Server Remote Code Execution Vulnerability (known ransomware use)

## Service status

Incidents it reported on its own status page.

- Last 90 days: 45 reported incidents (21 major or critical, 22 minor, 2 with no impact stated)
- Typical time to resolve: 8 h 55 min
- Status page last read: 2026-11-12
- Under way: access.redhat.com Community and Discussions (no impact stated), since 2026-11-11 01:49 UTC
- 2026-11-11: access.redhat.com Community and Discussions (no impact stated)
- 2026-11-05: Docs.redhat.com - Intermittent performance degradation (major)
- 2026-10-30: access.redhat.com - Community and Discussions (minor)
- 2026-10-29: API errors (critical)
- 2026-10-29: Red Hat Lightspeed Compliance Degraded Performance (minor)
- 2026-10-26: Red Hat Connect Major Outage - Investigating (major)
- 2026-10-24: Quayio Is Facing Intermittent 500s Due to a Service Maintenance (major)
- 2026-10-23: access.redhat.com - Security Pages - CVE Outage (major)

## Security contact

From its security.txt (https://www.redhat.com/.well-known/security.txt) ([evidence](https://thirdpartyindex.com/evidence/3684)):

- Contact: https://access.redhat.com/security/team/contact/
- Contact: mailto:secalert@redhat.com
- Encryption key: https://security.access.redhat.com/data/97f5eac4.txt
- Acknowledgments: https://access.redhat.com/articles/66234
- Languages: en
- Valid until 2027-07-29
- Signed

---

Third Party Index (https://thirdpartyindex.com) monitors vendors' public security and privacy documents and keeps each version as evidence. Data CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/); vendors' own documents are theirs. API: https://thirdpartyindex.com/api