Third Party Index

Todoist

todoist.com

Transparency

Strong

Breakdown
Subprocessor list30 / 30
Processing locations8 / 8
Purposes7 / 7
Data processing addendumnot found0 / 12
Trust center8 / 8
Privacy policy6 / 6
security.txt6 / 6
Security page5 / 5
Status page5 / 5
Vulnerability disclosurenot found0 / 5
Pages still reachable8 / 8
Total83 / 100

Only documents we can retrieve count: a page behind a login or a broken link scores nothing.

Badge

Todoist transparency rating

For Todoist's own site; it updates with the rating.

<a href="https://thirdpartyindex.com/vendors/todoist"><img src="https://thirdpartyindex.com/badge/todoist.svg" alt="Todoist transparency rating on Third Party Index" height="20"></a>
[![Todoist transparency rating on Third Party Index](https://thirdpartyindex.com/badge/todoist.svg)](https://thirdpartyindex.com/vendors/todoist)

Documents

DocumentVerifiedChangedEvidence
Trust center vanta snapshot
Subprocessor list vanta snapshot
Privacy policy snapshot
Terms snapshot
Security page snapshot
security.txt snapshot
Status page snapshot

Subprocessors

29 third parties. CSV · Atom

NamePurposeLocationListed since
Amazon Bedrock **Models**: Claude family models (Anthrophic) & Nova family models (Amazon) | **AI Data Retention**: Not stored | **Privacy info**: [Policy](https://docs.aws.amazon.com/bedrock/latest/userguide/), [FAQ](https://docs.aws.amazon.com/nova/latest/userguide/responsible-use.html); AI providerUnited States
Amazon Web Services **Data elements**: Personal data, account content, uploaded files; Hosting, Data ProcessingUnited States
Apple, Inc. **Data elements**: Reminder notifications; iOS Push NotificationsUnited States
BunnyWay d.o.o **Data elements**: IP addresses, device metadata; Content Delivery NetworkSlovenia
ChartMogul **Data elements**: User subscription data; Subscription AnalyticsUnited States
Convert **Data elements**: IP addresses, device metadata; A/B Testing ToolUnited States
Datadog, Inc. **Data elements**: User profile identifiers, sanitized user activity; Service MonitoringUnited States
Firebase (Google LLC) **Data elements**: Android app installation IDs; Android Push NotificationsUnited States
Gemini Enterprise Agent Platform, formerly Vertex AI Studio (Google LLC) **Models:** Gemini family models (Google) with Grounding Search and Grounding Maps & Claude family models (Anthropic) with Web Search | **AI Data Retention:** Ramble session data, including audio, is cached by Google for up to 24 hours to support pausing and resuming sessions, under its [session-resumption policy](https://docs.cloud.google.com/vertex-ai/generative-ai/docs/vertex-ai-zero-data-retention#session-resumption). Separately, Google may log and retain prompts for up to 90 days when suspicious activity requires investigation, under its [abuse-monitoring policy](https://docs.cloud.google.com/vertex-ai/generative-ai/docs/learn/abuse-monitoring). This does not mean every voice recording is routinely stored for 90 days | Automations Search Steps for 30 days | **Privacy info:** [Policy](https://docs.cloud.google.com/vertex-ai/generative-ai/docs/data-governance) Todoist Automations uses Google's Gemini Enterprise Agent Platform to run automations. Your use of Automations must comply with Google's applicable terms and policies: * [Google Cloud Platform Terms of Service](http://cloud.google.com/terms/) * [Google Cloud Service Specific Terms (including the Generative AI Services terms)](http://cloud.google.com/terms/service-terms) * [Google Cloud Acceptable Use Policy](http://cloud.google.com/terms/aup) * [Generative AI Prohibited Use Policy](http://policies.google.com/terms/generative-ai/use-policy); AI ProviderUnited States
Google Analytics (Google LLC) **Data elements**: User profile identifiers; Product Usage MetricsUnited States
Google Cloud Platform (Google LLC) **Data elements**: Session audio data; Ramble session resumptionUnited States
Grounding Maps (Google LLC) **Data elements**: Query text, geolocation context; Location and map data groundingUnited States
Grounding Search (Google LLC) **Data elements**: Query text, contextual metadata; Real-time web search groundingUnited States
HubSpot, Inc. **Data elements**: User contact information, profile identifiers; CRM PlatformUnited States
Iterable **Data elements**: Email address, first name, user ID, subscription plan, product usage and engagement events; MarketingIreland
Mailchimp Inc. **Data elements**: User contact information; Marketing Email, NewslettersUnited States
Mailgun Technologies, Inc. **Data elements**: Inbound email content, potential PII; Inbound Email ProcessingUnited States
OpenRouter **Purpose:** Routes Automations AI requests to the approved model providers listed below | **AI Data Retention:** Zero-data-retention routing enforced account-wide. OpenRouter does not store prompt content. | **Privacy info:** [Policy](https://openrouter.ai/privacy) | **Reference:** [Per-provider retention and logging table](https://openrouter.ai/docs/guides/privacy/provider-logging) Todoist uses OpenRouter as a subprocessor to route Automations AI requests to the providers listed below, which run DeepSeek V4 Flash 0731. **Approved model providers** (Model: DeepSeek V4 Flash 0731): [Atlas Cloud AI Inc.](https://www.atlascloud.ai/privacy) (US), [BaseTen Labs, Inc.](https://www.baseten.co/privacy-policy/) (US), [CoreWeave, Inc.](https://docs.coreweave.com/policies/terms-of-service/privacy-policy) (US), [DeepInfra, Inc.](https://deepinfra.com/privacy) (US), [Fireworks.ai, Inc.](https://fireworks.ai/privacy-policy) (US), [Inceptron AB](https://www.inceptron.io/privacy) (Sweden, EU/EEA-only processing), [Novita AI](https://novita.ai/legal/privacy-policy) (US), [Parasail, Inc.](https://www.parasail.io/legal/privacy-policy) (US), [Siliconflow Labs Pte. Ltd.](https://docs.siliconflow.com/en/legals/privacy-policy) (Singapore), [Together Computer, Inc.](https://www.together.ai/privacy) (US), [Venice.ai, Inc.](https://venice.ai/legal/privacy-policy) (US); AI Routing ServiceUnited States
Paddle (formerly Profitwell) **Data elements**: Subscription and billing data; Revenue AnalyticsUnited States
PartnerStack **Data elements**: Partner program data; Partnership ManagementUnited States
Porter Metrics **Data elements**: User profile identifiers, aggregated ads performance data (spend, impressions, clicks, conversion counts); Marketing analyticsEU
Printfection, LLC **Data elements**: User contact information; MerchandisingUnited States
Request Metrics (TrackJS LLC) **Data elements**: IP address; Website PerformanceUnited States
Sendgrid (Twilio, Inc.) **Data elements**: Names, email, IP addresses, account content; Transactional EmailUnited States
Sentry (Functional Software, Inc.) **Data elements**: User profile identifiers; Error MonitoringUnited States
Stripe, Inc. **Data elements**: User contact and billing data; Payment ProcessingUnited States
Temporal Technologies, Inc. (Temporal Cloud) **Data elements**: User instructions, workflow data (may include personal data); Workflow Orchestration, Data ProcessingUnited States
Typeform (Typeform SL) **Data elements**: User contact information (optional); Survey PlatformSpain
Zendesk, Inc. **Data elements**: User profile identifiers, support communications; Customer SupportUnited States

Changes

None since tracking began.