# SonicWall

SonicWall declares [12 subprocessors](https://thirdpartyindex.com/vendors/sonicwall#subprocessors) in [its subprocessor list](https://www.sonicwall.com/legal/sub-processors), which we last checked on 2026-11-11 ([evidence](https://thirdpartyindex.com/evidence/10809)). They include [Amazon Web Services](https://thirdpartyindex.com/vendors/amazon-web-services) and [360insights Platform](https://thirdpartyindex.com/vendors/360insights-platform). No published changes since we first read it on 2026-09-27.

SonicWall (sonicwall.com): subprocessors, data processing agreement, security documents and changes, as monitored by Third Party Index.

- Page: https://thirdpartyindex.com/vendors/sonicwall
- Documents last verified: 2026-11-11
- Transparency rating: 76/100 (how much it publishes, not how secure it is): Subprocessor list 30/30; Processing locations 0/8 (partial); Purposes 7/7; Data processing addendum 12/12; Trust center 8/8; Privacy policy 6/6; security.txt 0/6 (not found); Security page 0/5 (not found); Status page 5/5; Vulnerability disclosure 0/5 (not found); Pages still reachable 8/8
- Supply chain: relies on 2 tracked vendors directly, 6 within two hops, 21 within three; 0 tracked vendors rely on it directly, 0 within two hops, 0 within three
- Cite as: SonicWall, Third Party Index, https://thirdpartyindex.com/vendors/sonicwall (data CC BY 4.0)

## Documents

| Document | URL | Last verified | Last changed |
|---|---|---|---|
| Trust center | https://trust.sonicwall.com/ | 2026-11-11 | 2026-09-27 |
| Subprocessor list | https://www.sonicwall.com/legal/sub-processors | 2026-11-11 | 2026-09-27 |
| Data processing addendum | https://www.sonicwall.com/legal/privacy-statement/sonicwall-data-processing-agreement | 2026-11-11 | 2026-10-25 |
| Privacy policy | https://www.sonicwall.com/legal/privacy-statement | 2026-11-11 | 2026-10-21 |
| Terms | https://www.sonicwall.com/legal/terms-of-use | 2026-11-11 | 2026-09-27 |
| Status page | https://status.sonicwall.com/ | 2026-11-11 | 2026-11-11 |

## Subprocessors (12)

As its own list states them.

| Subprocessor | Purpose | Location | Listed since |
|---|---|---|---|
| [360Insights](https://thirdpartyindex.com/vendors/360insights-platform.md) | MDF Payment Processing | — | 2026-09-27 |
| Avanan | Hosting | — | 2026-09-27 |
| Avertech | Marketing tool | — | 2026-09-27 |
| [AWS](https://thirdpartyindex.com/vendors/amazon-web-services.md) | Hosting | — | 2026-09-27 |
| CallidusCloud | Surveys | — | 2026-09-27 |
| Cybersource | Transaction processing | — | 2026-09-27 |
| Datamotion | Hosting | — | 2026-09-27 |
| Oracle Eloqua | Marketing Tool | — | 2026-09-27 |
| Perimeter81 | Cloud Edge | — | 2026-09-27 |
| Rockwell Information Services | Training & Education | — | 2026-09-27 |
| Safesforce | CRM | — | 2026-09-27 |
| Trolley | Rebate Payment Processing | — | 2026-09-27 |

Read from ([evidence](https://thirdpartyindex.com/evidence/10809)). CSV: https://thirdpartyindex.com/vendors/sonicwall/subprocessors.csv

## Compliance

As its trust center lists them.

- Audited: SOC 2 Type II ([evidence](https://thirdpartyindex.com/evidence/10816))

## Web Technologies

SonicWall's homepage made 209 requests to 31 domains, and 20 services controlled by another company. Loaded on 2026-11-10 by a browser that accepted nothing; other visits may load more or less. What a page loads is not a list of who receives customer data.

20 third parties by category: Analytics 8 (Google Cloud, Hotjar, Dun & Bradstreet, Meta, Demandbase, LinkedIn, ZoomInfo, Cloudflare); Advertising 4 (Microsoft; reviewed: Index Exchange Inc.; usually detected as Advertising: Magnite, Inc., PubMatic); Marketing automation 1 (HubSpot); Live chat 1 (Qualified.com, Inc.); Cookie compliance 1 (TrustArc); CDN 1 (jQuery); CMS 1 (reviewed: Contentstack); Customer data platform 1 (reviewed: LiveRamp); Issue trackers 1 (usually detected as Issue trackers: Sentry); RUM 1 (SolarWinds). Each company that appears controlled by another organization is counted once, under the main category of the technologies detected from it on this homepage or, when none was, the category recorded from the company's own page (marked reviewed) or else the one it is usually detected as on other published homepages (marked as such); unclassified: none of these.

### Third parties (20)

- Qualified.com, Inc.: 32 requests to qualified.com; Qualified
- Google Cloud: 12 requests to gstatic.com, google.com, googletagmanager.com; Google Analytics, Google Tag Manager, reCAPTCHA
- TrustArc: 7 requests to trustarc.com; TrustArc
- Hotjar: 5 requests to hotjar.com, hotjar.io; Hotjar
- Contentstack: 4 requests to contentstack.io
- Dun & Bradstreet: 4 requests to d41.co; D&B Visitor Intelligence
- HubSpot: 4 requests to hs-analytics.net, hs-banner.com, hs-scripts.com, hubspot.com; HubSpot
- Meta: 4 requests to facebook.com, facebook.net; Facebook Pixel 2.9.439
- Demandbase: 3 requests to company-target.com, demandbase.com; Demandbase 11.1.11
- LinkedIn: 3 requests to linkedin.com, licdn.com; Linkedin Insight Tag
- LiveRamp: 3 requests to rlcdn.com
- Microsoft: 3 requests to bing.com; Microsoft Advertising
- Magnite, Inc.: 2 requests to rubiconproject.com, tremorhub.com
- SolarWinds: 2 requests to pingdom.net; Pingdom RUM
- ZoomInfo: 2 requests to zi-scripts.com; Zoominfo
- Cloudflare: 1 request to cloudflareinsights.com; Cloudflare Browser Insights
- Index Exchange Inc.: 1 request to casalemedia.com
- PubMatic: 1 request to pubmatic.com
- Sentry: 1 request to sentry.io
- jQuery: 1 request to jquery.com; jQuery 3.6.0, jQuery CDN

### First party (1)

- SonicWall: 114 requests to sonicwall.com; Contentsquare, HSTS, Imperva, Next.js 16.4.3, Next.js App Router, Open Graph, Priority Hints, Radix UI, React, Sentry, Turbopack, Vercel, Webpack, core-js 3.32.2

16 tracked companies loaded by the homepage are not in SonicWall's subprocessor list. A website can use a service without it processing customer data.

## Subprocessor of (0)

No tracked vendor lists it.

## Security record

CISA's Known Exploited Vulnerabilities catalog lists 20 vulnerabilities in its software:

- CVE-2026-19868 (SonicOS SSLVPN), listed 2026-11-06: SonicWall SonicOS SSLVPN Use of Single-factor Authentication Vulnerability
- CVE-2026-83548 (SMA1000 Appliances), listed 2026-09-02: SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability
- CVE-2026-83549 (SMA1000 Appliances), listed 2026-09-02: SonicWall SMA1000 Appliances OS Command Injection Vulnerability
- CVE-2026-15409 (SMA1000 Appliances), listed 2026-07-14: SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability (known ransomware use)
- CVE-2026-15410 (SMA1000 Appliances), listed 2026-07-14: SonicWall SMA1000 Appliances Code Injection Vulnerability (known ransomware use)
- CVE-2025-40602 (SMA1000 appliance), listed 2025-12-17: SonicWall SMA1000 Missing Authorization Vulnerability
- CVE-2023-44221 (SMA100 Appliances), listed 2025-05-01: SonicWall SMA100 Appliances OS Command Injection Vulnerability
- CVE-2021-20035 (SMA100 Appliances), listed 2025-04-16: SonicWall SMA100 Appliances OS Command Injection Vulnerability
- CVE-2024-53704 (SonicOS), listed 2025-02-18: SonicWall SonicOS SSLVPN Improper Authentication Vulnerability (known ransomware use)
- CVE-2025-23006 (SMA1000 Appliances), listed 2025-01-24: SonicWall SMA1000 Appliances Deserialization Vulnerability (known ransomware use)
- CVE-2024-40766 (SonicOS), listed 2024-09-09: SonicWall SonicOS Improper Access Control Vulnerability (known ransomware use)
- CVE-2019-7483 (SMA100), listed 2022-03-28: SonicWall SMA100 Directory Traversal Vulnerability
- CVE-2021-20028 (Secure Remote Access (SRA)), listed 2022-03-28: SonicWall Secure Remote Access (SRA) SQL Injection Vulnerability (known ransomware use)
- CVE-2020-5135 (SonicOS), listed 2022-03-15: SonicWall SonicOS Buffer Overflow Vulnerability (known ransomware use)
- CVE-2021-20038 (SMA 100 Appliances), listed 2022-01-28: SonicWall SMA 100 Appliances Stack-Based Buffer Overflow Vulnerability (known ransomware use)
- CVE-2019-7481 (SMA100), listed 2021-11-03: SonicWall SMA100 SQL Injection Vulnerability (known ransomware use)
- CVE-2021-20016 (SSLVPN SMA100), listed 2021-11-03: SonicWall SSLVPN SMA100 SQL Injection Vulnerability (known ransomware use)
- CVE-2021-20021 (SonicWall Email Security), listed 2021-11-03: SonicWall Email Security Improper Privilege Management Vulnerability (known ransomware use)
- CVE-2021-20022 (SonicWall Email Security), listed 2021-11-03: SonicWall Email Security Unrestricted Upload of File Vulnerability (known ransomware use)
- CVE-2021-20023 (SonicWall Email Security), listed 2021-11-03: SonicWall Email Security Path Traversal Vulnerability (known ransomware use)

The subprocessor list as we read it on any date: https://thirdpartyindex.com/labs/time-machine/sonicwall

---

Third Party Index (https://thirdpartyindex.com) monitors vendors' public security and privacy documents and keeps each version as evidence. Data CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/); vendors' own documents are theirs. API: https://thirdpartyindex.com/api