Sitecore
Sitecore declares 45 subprocessors in its subprocessor list, which we last checked on Nov 11, 2026 (evidence). They include Amazon Web Services, Google Cloud and OpenAI. No published changes since we first read it on Sep 21, 2026. 1 tracked vendor, Center for Internet Security, names Sitecore as a subprocessor.
Subprocessors CSV of Sitecore's subprocessors · Atom feed of Sitecore's subprocessors DORA draft CSV of Sitecore's subprocessors as declared by Sitecore what's this? ·
45 third parties.
| Name | Purpose | Location | Listed since |
|---|---|---|---|
| Akamai | Edge storage and delivery of customer derived optimised content | United States | |
| Americaneagle.com | Managed Cloud and product technical support services; Operational support services; Professional Services delivery partner providing implementation, migration and advisory services, including white-label delivery and staff augmentation. Depending on the engagement, personnel may access Customer systems and Personal Data and may use the partner's own tools. | Chicago, Illinois, USA | |
| Atlassian | Jira and Confluence collaboration and delivery tooling. | Sydney, New South Wales, Australia | |
| Auth0 | Authentication Tool | Seattle, Washington | |
| AWS | Cloud Service Provider | Seattle, Washington | |
| Certinia | Professional Services management and customer success planning. | San Jose, California | |
| ClickHouse Cloud | Storage and analytics supporting response collection and reporting | United States | |
| Cloro | Collection of responses from consumer AI services using Customer prompts | United States | |
| Cloudflare | Edge storage and delivery of customer derived optimised content; Web Performance and Security Services; Web performance and security services | San Francisco, California; United States | |
| Confluent | Real-time Data Management | Mountain View, California | |
| Confluent Kafka | Cloud Service Provider | Mountain View, California | |
| Constant Contact | Digital and Email Marketing Platform | Waltham, Massachusetts | |
| Datadog | Monitoring, and log management services | New York City, New York, USA | |
| DataForSEO | Collection of responses and search results from consumer AI services using Customer prompts | United States | |
| Digital Herd | Staff augmentation provider supporting implementation services in EMEA. Personnel may access Customer systems and Personal Data and may use the provider's own tools while acting under Sitecore's instructions. | Zellik, Flemish Region, Belgium | |
| Elastic | Observability / security monitoring; Observability and Security Services | San Francisco CA USA; San Francisco, California | |
| Google Cloud Platform / | Cloud hosting, storage, database, compute and AI model services supporting the Scrunch SaaS Product | United States | |
| Gradial | Generative AI Services | Seattle, Washington | |
| HTMLtoImage | Thumbnail Rendition | Leeds, England | |
| IGT 1 Outsourcing Lanka (Private) Limited | Business Process Outsourcing Partner | Colombo, Sri Lanka | |
| Imgix | Image Management | San Francisco, California | |
| Individual contractors engaged by Sitecore | Contracted Professional Services resources supporting advisory and implementation activities. Where applicable, such personnel may access Customer systems and Personal Data while acting under Sitecore's instructions and using Sitecore tools. | Various / as applicable | |
| Intercom | Processing of Scrunchie conversation transcripts and user contact data when a conversation is escalated | United States | |
| Liveblocks | User Engagement and Collaboration | Wilmington, Delaware | |
| Message Systems (Sparkpost) | Email Delivery Services | Columbia, Maryland | |
| Microsoft (Azure Open AI / Azure AI Foundry) AI | Cloud Service Provider; Customer Relations Performance; Data Visualization; Generative AI Services; Microsoft Azure Cloud Service Provider; Microsoft Azure Services; Technology and collaboration services used in Professional Services delivery, including Microsoft Teams, GitHub and SharePoint. | Click here; Redmond, Washington | |
| Microsoft Azure | Cloud hosting and infrastructure supporting support services, including processing through Azure Web Apps and storage through Azure SQL Managed Instance | Redmond, Washington | |
| MongoDB Atlas | Cloud Service Provider; Database services | New York NY US; New York, New York | |
| OpenAI AI | AI inference, summarisation, embeddings, evaluation and content generation | United States | |
| Perplexity AI | Fallback AI model/search processing for Customer prompts | United States | |
| Redis | Caching and session management | Mountain View, California | |
| Salesforce | Customer Relations Performance | Click here | |
| Scrapeless | Collection of responses and search results from consumer AI services using Customer prompts | United States | |
| SearchStax | Search Services | Manhattan Beach, California | |
| SendGrid | Email Delivery Services | Denver, Colorado | |
| ServiceNow | Customer Relations Performance | Click here | |
| Snowflake | Data Warehouse; Data warehouse services | Bozeman MT USA; Bozeman, Montana | |
| Teamwork | Collaboration and delivery tooling. | Geneva, Switzerland | |
| TheLoops, Inc | AI-driven support operations, ticketing analytics, and customer experience insights. | San Mateo, California | |
| Together AI AI | Fallback AI model processing for Customer prompts | United States | |
| Twilio | Communications Platform | San Francisco, California | |
| Uploadcare | File Upload Management | Wilmington, Delaware | |
| Velir | Professional Services delivery partner used for customer engagements delivered on Sitecore paper. Scope of Personal Data access and applicable delivery locations to be confirmed for inclusion where the partner processes Personal Data on Sitecore's behalf. | Massachusetts, USA | |
| Vercel | Cloud platform; Frontend Cloud Platform | San Francisco, California | |
| Workato | Integration and workflow automation | San Francisco, California |
Web TechnologiesCSV of Sitecore's web technologies · Atom feed of Sitecore's web technologies
Sitecore's homepage made 256 requests to 25 domains, 15 services controlled by another company, and 1 domain not identified.
15 third parties by category: Advertising 3Marketing automation 3Analytics 2Live chat 2Cookie compliance 1Other 4
Third parties 15 · 127 requests
Qualified.com, Inc. Qualified 37
6Sense Insights, Inc. 6sense 18
LiveIntent LiveIntent 3
Dreamdata Dreamdata 2
ipify ipify 1
Unknown 1 · 1 request
usbrowserspeed.com
First party 1 · 128 requests
Sitecore Azure Cloudflare HSTS Microsoft ASP.NET Microsoft Clarity Next.js 16.2.1 Next.js App Router Open Graph Priority Hints React Salesforce Salesforce Marketing Cloud Account Engagement Sentry Sitecore Turbopack Vercel Vercel Analytics Webpack core-js 3.50.0 lit-html 2.8.0 128
6 tracked companies loaded by the homepage are not in Sitecore's subprocessor list. A website can use a service without it processing customer data.
Subprocessor of (1)CSV of the companies listing Sitecore · Atom feed of the companies listing Sitecore
Center for Internet Security cisecurity.org Digital Experience Platform; Sitecore is a digital experience platform.; Your general personal information will be processed by Sitecore, Inc. for storage purposes for the period necessary to fulfill the purposes outlined in the CIS Privacy Notice and in accordance with applicable law.
ComplianceCSV of Sitecore's compliance · Atom feed of Sitecore's compliance
- Certified
- Says it complies with
Certifications as Sitecore's trust center lists them; reports are usually shared on request (evidence)
Security recordCSV of Sitecore's security record · Atom feed of Sitecore's security record
What public security catalogs list for Sitecore, in their words.
Known exploited vulnerabilities
4 vulnerabilities in Sitecore's software that CISA lists as exploited in the wild.
| CVE | Product | Vulnerability | Listed |
|---|---|---|---|
| CVE-2025-53690 | Multiple Products | Sitecore Multiple Products Deserialization of Untrusted Data Vulnerability | |
| CVE-2019-9874 | CMS and Experience Platform (XP) | Sitecore CMS and Experience Platform (XP) Deserialization Vulnerability | |
| CVE-2019-9875 | CMS and Experience Platform (XP) | Sitecore CMS and Experience Platform (XP) Deserialization Vulnerability | |
| CVE-2021-42237 | XP | Sitecore XP Remote Command Execution Vulnerability used by ransomware |
Source: CISA Known Exploited Vulnerabilities catalog (evidence)
Incidents reported by Sitecore's subprocessorsCSV of incidents reported by vendors Sitecore lists · Atom feed of incidents reported by vendors Sitecore lists
280 reported incidents in the last 30 days, by 15 of the vendors Sitecore lists as subprocessors.
A subprocessor list names a company, not the service an incident touched. This does not show that Sitecore was involved.
And 255 more. All of them: CSV · Who is around them.
ChangesCSV of Sitecore's changes · Atom feed of Sitecore's changes
See the list as we read it on any date: Time machine
None since tracking began.
Rating badge for Sitecore's site
It updates with the rating.
<a href="https://thirdpartyindex.com/vendors/sitecore"><img src="https://thirdpartyindex.com/badge/sitecore.svg" alt="Sitecore transparency rating on Third Party Index" height="20"></a>[](https://thirdpartyindex.com/vendors/sitecore)