# Tiny

Tiny (tiny.cloud): subprocessors, data processing agreement, security documents and changes, as monitored by Third Party Index.

- Page: https://thirdpartyindex.com/vendors/tiny
- Documents last verified: 2026-10-06
- Transparency rating: 76/100 (how much it publishes, not how secure it is): Subprocessor list 30/30; Processing locations 8/8; Purposes 0/7 (partial); Data processing addendum 0/12 (not found); Trust center 8/8; Privacy policy 6/6; security.txt 6/6; Security page 5/5; Status page 5/5; Vulnerability disclosure 0/5 (not found); Pages still reachable 8/8
- Supply chain: relies on 3 tracked vendors directly, 48 within two hops, 250 within three; 0 tracked vendors rely on it directly, 0 within two hops, 0 within three
- Cite as: Tiny, Third Party Index, https://thirdpartyindex.com/vendors/tiny (data CC BY 4.0)

## Documents

| Document | URL | Last verified | Last changed |
|---|---|---|---|
| Trust center | https://trust.tiny.cloud/ | 2026-10-06 | 2026-10-06 |
| Subprocessor list | https://trust.tiny.cloud/subprocessors | 2026-10-06 | 2026-10-06 |
| Privacy policy | https://www.tiny.cloud/legal/privacy/ | 2026-10-06 | 2026-10-06 |
| Terms | https://www.tiny.cloud/legal/cloud-use-subscription-agreement/ | 2026-10-06 | 2026-10-06 |
| Security page | https://www.tiny.cloud/tinymce/security/ | 2026-10-06 | 2026-10-06 |
| security.txt | https://www.tiny.cloud/.well-known/security.txt | 2026-10-06 | 2026-10-06 |
| Status page | https://status.tiny.cloud/ | 2026-10-06 | 2026-10-06 |

## Subprocessors (3)

As its own list states them.

| Subprocessor | Purpose | Location | Listed since |
|---|---|---|---|
| [Amazon Web Services](https://thirdpartyindex.com/vendors/amazon-web-services.md) | — | Cloud provider | 2026-10-06 |
| [Maxio](https://thirdpartyindex.com/vendors/maxio.md) | — | Finance and payments | 2026-10-06 |
| [Stripe](https://thirdpartyindex.com/vendors/stripe.md) | — | Finance and payments | 2026-10-06 |

Read from ([evidence](https://thirdpartyindex.com/evidence/52395)). CSV: https://thirdpartyindex.com/vendors/tiny/subprocessors.csv

## Compliance

As its trust center lists them.

- Audited: SOC 2 Type II ([evidence](https://thirdpartyindex.com/evidence/52396))
- Claimed: HIPAA, GDPR ([evidence](https://thirdpartyindex.com/evidence/52396))

## Web Technologies

Tiny's homepage made 360 requests to 31 domains, 18 services controlled by another company, and 1 domain not identified. Loaded on 2026-10-06 by a browser that accepted nothing; other visits may load more or less. What a page loads is not a list of who receives customer data.

### Third parties (18)

- Spara, Inc.: 98 requests to spara.co; Spara
- Google Cloud: 32 requests to google.com, gstatic.com, doubleclick.net, fonts.googleapis.com, googletagmanager.com; DoubleClick Floodlight, Google Analytics, Google Tag Manager, reCAPTCHA
- Microsoft: 9 requests to bing.com; Microsoft Advertising
- GetVector, Inc.: 6 requests to vector.co; Vector
- Uploadcare: 5 requests to ucarecdn.com
- CookieHub: 4 requests to cookiehub.net, cookiehub.eu
- LinkedIn: 4 requests to licdn.com, linkedin.com; Linkedin Insight Tag
- OpenAI: 4 requests to openai.com
- Hotjar: 3 requests to hotjar.com, hotjar.io; Hotjar
- Meta: 3 requests to facebook.net, facebook.com; Facebook Pixel 2.9.414
- G2.com: 2 requests to g2crowd.com, g2.com; G2 Track Your Prospects
- ZoomInfo: 2 requests to zoominfo.com; Zoominfo
- Ahrefs: 1 request to ahrefs.com
- Amazon Web Services: 1 request to s3-us-west-2.amazonaws.com (its subprocessor list names it too)
- Cloudflare: 1 request to cloudflareinsights.com; Cloudflare Browser Insights
- Salesforce: 1 request to pardot.com
- Wingify: 1 request to visualwebsiteoptimizer.com
- jsDelivr: 1 request to jsdelivr.net; jsDelivr

### Unknown (1)

Domains not identified yet: cr-relay.com

### First party (1)

- Tiny: 181 requests to tiny.cloud, tinymce.com, ephox.com; Amazon CloudFront, Amazon S3, Amazon Web Services, Emotion, Gatsby 3.6.0, Google Font API, HSTS, Open Graph, React, Salesforce Marketing Cloud Account Engagement, TinyMCE 8, VWO, Webpack, core-js 3.6.5

14 tracked companies loaded by the homepage are not in Tiny's subprocessor list. A website can use a service without it processing customer data.

## Subprocessor of (0)

No tracked vendor lists it.

## Service status

Incidents it reported on its own status page.

- Last 90 days: 1 reported incidents (1 major or critical, 0 minor, 0 with no impact stated)
- Typical time to resolve: 5 h 29 min
- Status page last read: 2026-10-06
- 2026-09-24: \[Editor\] Some customers experienced read-only editors (major)
- 2025-10-20: Tiny Cloud services unavailable or degraded due to AWS outage (critical)
- 2025-10-20: Tiny Cloud services unavailable due to AWS outage (critical)

## Security contact

From its security.txt (https://www.tiny.cloud/.well-known/security.txt) ([evidence](https://thirdpartyindex.com/evidence/52392)):

- Contact: mailto:infosec@tiny.cloud
- Disclosure policy: https://www.tiny.cloud/tinymce/security/
- Languages: EN
- Valid until 2030-01-01

---

Third Party Index (https://thirdpartyindex.com) monitors vendors' public security and privacy documents and keeps each version as evidence. Data CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/); vendors' own documents are theirs. API: https://thirdpartyindex.com/api