Twenty
Twenty declares 10 subprocessors in its subprocessor list, which we last checked on Nov 11, 2026 (evidence). They include Amazon Web Services, Google Cloud and OpenAI. No published changes since we first read it on Nov 6, 2026.
Not listed by any tracked vendor.
Not loaded by any published homepage.
Subprocessors CSV of Twenty's subprocessors · Atom feed of Twenty's subprocessors DORA draft CSV of Twenty's subprocessors as declared by Twenty what's this? ·
10 third parties.
| Name | Purpose | Location | Listed since |
|---|---|---|---|
| Amazon Web Services | AWS hosts all Customer Personal Data stored in the Twenty CRM — including contacts, companies, notes, activities, attachments — together with related backups and logs. Data is hosted in Germany (Frankfurt, eu-central-1). AWS is always engaged. | ||
| Anthropic AI | Anthropic processes Customer Personal Data only when a workspace enables AI features and a user runs an AI action — in which case only the specific records or text needed for that action are sent. When AI features are disabled, Anthropic is not a sub-processor. Processed in the United States. Customer data is not used to train Anthropic's models. Transfers are covered by the EU Standard Contractual Clauses. | ||
| Azure | Microsoft Azure provides Azure Foundry inference for Twenty AI features when requests are routed to Azure. Data may include prompts, responses, and CRM content supplied as context. Processing locations depend on the model and deployment: Global deployments may process outside the EU even when the Azure resource is in Germany. Retention and abuse monitoring depend on the service and approved account configuration. | ||
| ClickHouse | ClickHouse stores Twenty's audit logs, which record activity within the CRM and can contain Customer Personal Data (for example, the content or identifiers associated with a logged action). Processed in Germany. Always engaged. Transfers outside the EEA are covered by the EU Standard Contractual Clauses where applicable. | ||
| Cloudflare | Cloudflare processes Customer Personal Data only in transit — request and response content — together with connection metadata such as IP addresses and request headers, in order to route, cache, and protect traffic. As a content delivery network, processing occurs worldwide across Cloudflare's global edge network. Always engaged. Transfers outside the EEA are covered by the EU Standard Contractual Clauses and the EU–US Data Privacy Framework. | ||
| Google Cloud Platform AI | Google provides Maps look-ups, Google sign-in, and Gemini models for Twenty AI features when the relevant Google service is used. Data may include address or location queries, authentication information, and, for Gemini inference, prompts, responses, and CRM content supplied as context. Processing locations and data-handling terms depend on the Google service and API used; this entry does not guarantee Germany-only processing for Gemini. | ||
| Mistral AI | Mistral processes Customer Personal Data only when a workspace enables AI features and a user runs an AI action; only the data needed for that action is sent. When AI features are disabled, Mistral is not a sub-processor. Processed in France. Customer data is not used to train Mistral's models. As an EU-based provider with EU hosting, no transfer outside the EEA is required for this processing. | ||
| OpenAI AI | OpenAI processes Customer Personal Data only when a workspace enables AI features and a user runs an AI action; only the data needed for that action is sent. When AI features are disabled, OpenAI is not a sub-processor. Processed in the United States and the EU. Customer data is not used to train OpenAI's models. Transfers are covered by the EU Standard Contractual Clauses. | ||
| Sentry | Sentry receives error and performance events, including stack traces and request context. Customer Personal Data is not expected to be included, but it may incidentally appear if present at the moment an error occurs; Twenty minimizes this through data scrubbing. Processed in the European Union (Frankfurt, Germany). Always engaged. Sentry is a US company, so any remote access from outside the EU, for example for support, is covered by the EU Standard Contractual Clauses and the EU–US Data Privacy Framework. | ||
| TypeSafe | Typesafe AI, Inc. provides AI evaluation and monitoring. Data may include prompts, responses, and contextual CRM data in AI interactions submitted for evaluation. Processing locations, retention, and applicable contractual safeguards are being verified. |
Web TechnologiesCSV of Twenty's web technologies · Atom feed of Twenty's web technologies
Twenty's homepage made 129 requests to 4 domains, and 2 services controlled by another company.
2 third parties by category: Analytics 1CDN 1
Third parties 2 · 2 requests
First party 1 · 127 requests
Twenty Cloudflare HSTS HTTP/3 Next.js 16.4.1 Next.js App Router Open Graph Priority Hints React Three.js 184 Turbopack Webpack 127
1 tracked company loaded by the homepage is not in Twenty's subprocessor list. A website can use a service without it processing customer data.
Incidents reported by Twenty's subprocessorsCSV of incidents reported by vendors Twenty lists · Atom feed of incidents reported by vendors Twenty lists
62 reported incidents in the last 30 days, by 5 of the vendors Twenty lists as subprocessors.
A subprocessor list names a company, not the service an incident touched. This does not show that Twenty was involved.
And 37 more. All of them: CSV · Who is around them.
ChangesCSV of Twenty's changes · Atom feed of Twenty's changes
See the list as we read it on any date: Time machine
None since tracking began.
Rating badge for Twenty's site
It updates with the rating.
<a href="https://thirdpartyindex.com/vendors/twenty"><img src="https://thirdpartyindex.com/badge/twenty.svg" alt="Twenty transparency rating on Third Party Index" height="20"></a>[](https://thirdpartyindex.com/vendors/twenty)