# Twenty Twenty declares [10 subprocessors](https://thirdpartyindex.com/vendors/twenty#subprocessors) in [its subprocessor list](https://trust.twenty.com/?tab=subprocessors), which we last checked on 2026-11-11 ([evidence](https://thirdpartyindex.com/evidence/253543)). They include [Amazon Web Services](https://thirdpartyindex.com/vendors/amazon-web-services), [Google Cloud](https://thirdpartyindex.com/vendors/google-cloud) and [OpenAI](https://thirdpartyindex.com/vendors/openai). No published changes since we first read it on 2026-11-06. Twenty (twenty.com): subprocessors, data processing agreement, security documents and changes, as monitored by Third Party Index. - Page: https://thirdpartyindex.com/vendors/twenty - Documents last verified: 2026-11-12 - Transparency rating: 65/100 (how much it publishes, not how secure it is): Subprocessor list 30/30; Processing locations 0/8 (partial); Purposes 7/7; Data processing addendum 0/12 (not found); Trust center 8/8; Privacy policy 6/6; security.txt 6/6; Security page 0/5 (not found); Status page 0/5 (not found); Vulnerability disclosure 0/5 (not found); Pages still reachable 8/8 - Supply chain: relies on 10 tracked vendors directly, 84 within two hops, 301 within three; 0 tracked vendors rely on it directly, 0 within two hops, 0 within three - Cite as: Twenty, Third Party Index, https://thirdpartyindex.com/vendors/twenty (data CC BY 4.0) ## Documents | Document | URL | Last verified | Last changed | |---|---|---|---| | Trust center | https://trust.twenty.com/ | 2026-11-11 | 2026-11-11 | | Subprocessor list | https://trust.twenty.com/?tab=subprocessors | 2026-11-11 | 2026-11-11 | | Privacy policy | https://twenty.com/privacy-policy | 2026-11-12 | 2026-11-06 | | Terms | https://twenty.com/terms | 2026-11-12 | 2026-11-06 | | security.txt | https://twenty.com/.well-known/security.txt | 2026-11-12 | 2026-11-06 | ## Subprocessors (10) As its own list states them. | Subprocessor | Purpose | Location | Listed since | |---|---|---|---| | [Amazon Web Services](https://thirdpartyindex.com/vendors/amazon-web-services.md) | AWS hosts all Customer Personal Data stored in the Twenty CRM — including contacts, companies, notes, activities, attachments — together with related backups and logs. Data is hosted in Germany (Frankfurt, eu-central-1). AWS is always engaged. | — | 2026-11-06 | | [Anthropic](https://thirdpartyindex.com/vendors/anthropic.md) (AI model provider: Anthropic) | Anthropic processes Customer Personal Data only when a workspace enables AI features and a user runs an AI action — in which case only the specific records or text needed for that action are sent. When AI features are disabled, Anthropic is not a sub-processor. Processed in the United States. Customer data is not used to train Anthropic's models. Transfers are covered by the EU Standard Contractual Clauses. | — | 2026-11-06 | | [Azure](https://thirdpartyindex.com/vendors/microsoft.md) | Microsoft Azure provides Azure Foundry inference for Twenty AI features when requests are routed to Azure. Data may include prompts, responses, and CRM content supplied as context. Processing locations depend on the model and deployment: Global deployments may process outside the EU even when the Azure resource is in Germany. Retention and abuse monitoring depend on the service and approved account configuration. | — | 2026-11-06 | | [ClickHouse](https://thirdpartyindex.com/vendors/clickhouse.md) | ClickHouse stores Twenty's audit logs, which record activity within the CRM and can contain Customer Personal Data (for example, the content or identifiers associated with a logged action). Processed in Germany. Always engaged. Transfers outside the EEA are covered by the EU Standard Contractual Clauses where applicable. | — | 2026-11-06 | | [Cloudflare](https://thirdpartyindex.com/vendors/cloudflare.md) | Cloudflare processes Customer Personal Data only in transit — request and response content — together with connection metadata such as IP addresses and request headers, in order to route, cache, and protect traffic. As a content delivery network, processing occurs worldwide across Cloudflare's global edge network. Always engaged. Transfers outside the EEA are covered by the EU Standard Contractual Clauses and the EU–US Data Privacy Framework. | — | 2026-11-06 | | [Google Cloud Platform](https://thirdpartyindex.com/vendors/google-cloud.md) (AI model provider: Google Vertex AI / Gemini) | Google provides Maps look-ups, Google sign-in, and Gemini models for Twenty AI features when the relevant Google service is used. Data may include address or location queries, authentication information, and, for Gemini inference, prompts, responses, and CRM content supplied as context. Processing locations and data-handling terms depend on the Google service and API used; this entry does not guarantee Germany-only processing for Gemini. | — | 2026-11-06 | | [Mistral](https://thirdpartyindex.com/vendors/mistral.md) (AI model provider: Mistral) | Mistral processes Customer Personal Data only when a workspace enables AI features and a user runs an AI action; only the data needed for that action is sent. When AI features are disabled, Mistral is not a sub-processor. Processed in France. Customer data is not used to train Mistral's models. As an EU-based provider with EU hosting, no transfer outside the EEA is required for this processing. | — | 2026-11-06 | | [OpenAI](https://thirdpartyindex.com/vendors/openai.md) (AI model provider: OpenAI) | OpenAI processes Customer Personal Data only when a workspace enables AI features and a user runs an AI action; only the data needed for that action is sent. When AI features are disabled, OpenAI is not a sub-processor. Processed in the United States and the EU. Customer data is not used to train OpenAI's models. Transfers are covered by the EU Standard Contractual Clauses. | — | 2026-11-06 | | [Sentry](https://thirdpartyindex.com/vendors/sentry.md) | Sentry receives error and performance events, including stack traces and request context. Customer Personal Data is not expected to be included, but it may incidentally appear if present at the moment an error occurs; Twenty minimizes this through data scrubbing. Processed in the European Union (Frankfurt, Germany). Always engaged. Sentry is a US company, so any remote access from outside the EU, for example for support, is covered by the EU Standard Contractual Clauses and the EU–US Data Privacy Framework. | — | 2026-11-11 | | [TypeSafe](https://thirdpartyindex.com/vendors/typesafe-ai.md) | Typesafe AI, Inc. provides AI evaluation and monitoring. Data may include prompts, responses, and contextual CRM data in AI interactions submitted for evaluation. Processing locations, retention, and applicable contractual safeguards are being verified. | — | 2026-11-06 | Read from ([evidence](https://thirdpartyindex.com/evidence/223712)). CSV: https://thirdpartyindex.com/vendors/twenty/subprocessors.csv AI model providers (or a cloud provider's AI model service) among these entries: 4. All vendors that list one: https://thirdpartyindex.com/ai ## Web Technologies Twenty's homepage made 129 requests to 4 domains, and 2 services controlled by another company. Loaded on 2026-11-06 by a browser that accepted nothing; other visits may load more or less. What a page loads is not a list of who receives customer data. 2 third parties by category: Analytics 1 (Cloudflare); CDN 1 (jsDelivr). Each company that appears controlled by another organization is counted once, under the main category of the technologies detected from it on this homepage or, when none was, the category recorded from the company's own page (marked reviewed) or else the one it is usually detected as on other published homepages (marked as such); unclassified: none of these. ### Third parties (2) - Cloudflare: 1 request to cloudflareinsights.com; Cloudflare Browser Insights (its subprocessor list names it too) - jsDelivr: 1 request to jsdelivr.net; jsDelivr ### First party (1) - Twenty: 127 requests to twenty.com, twenty-icons.com; Cloudflare, HSTS, HTTP/3, Next.js 16.4.1, Next.js App Router, Open Graph, Priority Hints, React, Three.js 184, Turbopack, Webpack 1 tracked company loaded by the homepage is not in Twenty's subprocessor list. A website can use a service without it processing customer data. ## Subprocessor of (0) No tracked vendor lists it. ## Incidents reported by Twenty's subprocessors Incidents reported in the last 30 days on their own status pages by 5 vendors Twenty lists as subprocessors. A subprocessor list names a company, not the service an incident touched. - 2026-11-11: [OpenAI](https://thirdpartyindex.com/vendors/openai#status), which Twenty lists as a subprocessor, reported Unable to start new Workspace Agent runs (critical) - 2026-11-11: [OpenAI](https://thirdpartyindex.com/vendors/openai#status), which Twenty lists as a subprocessor, reported Elevated errors affecting logins, sign-ups, and ChatGPT features (minor) - 2026-11-11: [Sentry](https://thirdpartyindex.com/vendors/sentry#status), which Twenty lists as a subprocessor, reported US issues feed throwing intermittent errors (minor) - 2026-11-11: [ClickHouse](https://thirdpartyindex.com/vendors/clickhouse#status), which Twenty lists as a subprocessor, reported Provisioning and scaling operations may take longer in AWS ap-northeast-1 Tokyo (minor) - 2026-11-11: [Sentry](https://thirdpartyindex.com/vendors/sentry#status), which Twenty lists as a subprocessor, reported Account emails not being delivered (major) - 2026-11-10: [Anthropic](https://thirdpartyindex.com/vendors/anthropic#status), which Twenty lists as a subprocessor, reported Elevated errors on Fable 52 and Mythos 52 (no impact stated) - 2026-11-10: [Sentry](https://thirdpartyindex.com/vendors/sentry#status), which Twenty lists as a subprocessor, reported EU region replay ingestion latency (minor) - 2026-11-10: [OpenAI](https://thirdpartyindex.com/vendors/openai#status), which Twenty lists as a subprocessor, reported Incorrect cost data in Costs API exports (no impact stated) - 2026-11-09: [OpenAI](https://thirdpartyindex.com/vendors/openai#status), which Twenty lists as a subprocessor, reported Elevated Errors On API (minor) - 2026-11-09: [OpenAI](https://thirdpartyindex.com/vendors/openai#status), which Twenty lists as a subprocessor, reported Elevated ChatGPT Conversation Errors (minor) - 2026-11-08: [OpenAI](https://thirdpartyindex.com/vendors/openai#status), which Twenty lists as a subprocessor, reported Elevated errors with image generation (minor) - 2026-11-08: [Anthropic](https://thirdpartyindex.com/vendors/anthropic#status), which Twenty lists as a subprocessor, reported Degraded performance for Claude Fable 5.1 (minor) - 2026-11-06: [OpenAI](https://thirdpartyindex.com/vendors/openai#status), which Twenty lists as a subprocessor, reported Elevated error rates with some U.S. business Mastercards (no impact stated) - 2026-11-05: [OpenAI](https://thirdpartyindex.com/vendors/openai#status), which Twenty lists as a subprocessor, reported ChatGPT Work and Dots Errors (minor) - 2026-11-04: [OpenAI](https://thirdpartyindex.com/vendors/openai#status), which Twenty lists as a subprocessor, reported Elevated error rates across paid ChatGPT plans (minor) - 2026-11-04: [Sentry](https://thirdpartyindex.com/vendors/sentry#status), which Twenty lists as a subprocessor, reported Ingestion delays across all data (minor) - 2026-11-03: [Sentry](https://thirdpartyindex.com/vendors/sentry#status), which Twenty lists as a subprocessor, reported Delays in spans and transactions processing (major) - 2026-11-03: [Sentry](https://thirdpartyindex.com/vendors/sentry#status), which Twenty lists as a subprocessor, reported Sentry.io dashboard and API is down (critical) - 2026-11-03: [OpenAI](https://thirdpartyindex.com/vendors/openai#status), which Twenty lists as a subprocessor, reported File upload errors in ChatGPT (minor) - 2026-11-02: [ClickHouse](https://thirdpartyindex.com/vendors/clickhouse#status), which Twenty lists as a subprocessor, reported SQL Console database connection outage (minor) - 2026-11-02: [Sentry](https://thirdpartyindex.com/vendors/sentry#status), which Twenty lists as a subprocessor, reported Sentry dashboard is down (critical) - 2026-10-30: [TypeSafe AI](https://thirdpartyindex.com/vendors/typesafe-ai#status), which Twenty lists as a subprocessor, reported System overload (minor) - 2026-10-30: [OpenAI](https://thirdpartyindex.com/vendors/openai#status), which Twenty lists as a subprocessor, reported Elevated errors with search in Dots, ChatGPT Work, and certain ChatGPT thinking experiences (minor) - 2026-10-30: [OpenAI](https://thirdpartyindex.com/vendors/openai#status), which Twenty lists as a subprocessor, reported Elevated errors for GPT Image 2 API image edits (minor) - 2026-10-28: [Anthropic](https://thirdpartyindex.com/vendors/anthropic#status), which Twenty lists as a subprocessor, reported Elevated errors affecting the Google Calendar connector (minor) - 2026-10-28: [Anthropic](https://thirdpartyindex.com/vendors/anthropic#status), which Twenty lists as a subprocessor, reported Elevated errors affecting the Gmail connector (minor) - 2026-10-27: [Anthropic](https://thirdpartyindex.com/vendors/anthropic#status), which Twenty lists as a subprocessor, reported Elevated errors for Claude Sonnet 5.5 (major) - 2026-10-27: [OpenAI](https://thirdpartyindex.com/vendors/openai#status), which Twenty lists as a subprocessor, reported 6.1 Sol Degraded Model Performance (minor) - 2026-10-27: [Anthropic](https://thirdpartyindex.com/vendors/anthropic#status), which Twenty lists as a subprocessor, reported Elevated errors for Claude Sonnet 5.5 (major) - 2026-10-27: [OpenAI](https://thirdpartyindex.com/vendors/openai#status), which Twenty lists as a subprocessor, reported Elevated error rates for most hosted Code Reviews and Security Reviews on private GitHub repositories (no impact stated) - 2026-10-26: [OpenAI](https://thirdpartyindex.com/vendors/openai#status), which Twenty lists as a subprocessor, reported Elevated error rates for Ads POST requests (minor) - 2026-10-25: [Anthropic](https://thirdpartyindex.com/vendors/anthropic#status), which Twenty lists as a subprocessor, reported Elevated errors for Claude Fable 5.1 (major) - 2026-10-25: [Anthropic](https://thirdpartyindex.com/vendors/anthropic#status), which Twenty lists as a subprocessor, reported Elevated errors for Claude Sonnet 5.5 and other models (major) - 2026-10-24: [Anthropic](https://thirdpartyindex.com/vendors/anthropic#status), which Twenty lists as a subprocessor, reported Elevated errors for Claude Fable 5 and Claude Fable 5.1 (major) - 2026-10-24: [Anthropic](https://thirdpartyindex.com/vendors/anthropic#status), which Twenty lists as a subprocessor, reported Elevated errors for Claude Opus 5.5 (major) - 2026-10-23: [Anthropic](https://thirdpartyindex.com/vendors/anthropic#status), which Twenty lists as a subprocessor, reported Elevated errors for Claude Fable 5.1, Sonnet 5.5, and Haiku 5.5 (critical) - 2026-10-23: [OpenAI](https://thirdpartyindex.com/vendors/openai#status), which Twenty lists as a subprocessor, reported Degraded experience with ChatGPT app connections using CIMD (minor) - 2026-10-23: [OpenAI](https://thirdpartyindex.com/vendors/openai#status), which Twenty lists as a subprocessor, reported Help Center Chat Support Degraded (no impact stated) - 2026-10-23: [ClickHouse](https://thirdpartyindex.com/vendors/clickhouse#status), which Twenty lists as a subprocessor, reported Degraded support ticket submission and response (minor) - 2026-10-23: [OpenAI](https://thirdpartyindex.com/vendors/openai#status), which Twenty lists as a subprocessor, reported Delays in customer support responses (no impact stated) - 2026-10-22: [OpenAI](https://thirdpartyindex.com/vendors/openai#status), which Twenty lists as a subprocessor, reported New Ad Accounts failing to provision admins (minor) - 2026-10-22: [OpenAI](https://thirdpartyindex.com/vendors/openai#status), which Twenty lists as a subprocessor, reported Degraded Performance of Dots on Enterprise (minor) - 2026-10-22: [Anthropic](https://thirdpartyindex.com/vendors/anthropic#status), which Twenty lists as a subprocessor, reported Elevated errors affecting Connectors (minor) - 2026-10-22: [OpenAI](https://thirdpartyindex.com/vendors/openai#status), which Twenty lists as a subprocessor, reported Elevated ChatGPT conversation and Responses API errors (minor) - 2026-10-21: [OpenAI](https://thirdpartyindex.com/vendors/openai#status), which Twenty lists as a subprocessor, reported Authentication errors for some users (major) - 2026-10-21: [Anthropic](https://thirdpartyindex.com/vendors/anthropic#status), which Twenty lists as a subprocessor, reported Degraded performance for Claude Fable 5 (minor) - 2026-10-21: [Sentry](https://thirdpartyindex.com/vendors/sentry#status), which Twenty lists as a subprocessor, reported Increased latency processing integration webhooks (minor) - 2026-10-21: [OpenAI](https://thirdpartyindex.com/vendors/openai#status), which Twenty lists as a subprocessor, reported Elevated error rates for gpt-5.6-luna API requests (minor) - 2026-10-21: [OpenAI](https://thirdpartyindex.com/vendors/openai#status), which Twenty lists as a subprocessor, reported Elevated FedRAMP API error rates for Astra and Sol (minor) - 2026-10-21: [Sentry](https://thirdpartyindex.com/vendors/sentry#status), which Twenty lists as a subprocessor, reported Sentry.io not loading in US region (critical) - 2026-10-21: [OpenAI](https://thirdpartyindex.com/vendors/openai#status), which Twenty lists as a subprocessor, reported Degraded performance in ChatGPT, Codex, and APIs (minor) - 2026-10-20: [Sentry](https://thirdpartyindex.com/vendors/sentry#status), which Twenty lists as a subprocessor, reported Sentry.io not loading (major) - 2026-10-20: [ClickHouse](https://thirdpartyindex.com/vendors/clickhouse#status), which Twenty lists as a subprocessor, reported Google Cloud Outage (minor) - 2026-10-19: [Sentry](https://thirdpartyindex.com/vendors/sentry#status), which Twenty lists as a subprocessor, reported Sentry is down (critical) - 2026-10-19: [OpenAI](https://thirdpartyindex.com/vendors/openai#status), which Twenty lists as a subprocessor, reported File Download errors (minor) - 2026-10-15: [OpenAI](https://thirdpartyindex.com/vendors/openai#status), which Twenty lists as a subprocessor, reported Widespread feature degradation (major) - 2026-10-14: [TypeSafe AI](https://thirdpartyindex.com/vendors/typesafe-ai#status), which Twenty lists as a subprocessor, reported Elevated Latency (minor) - 2026-10-14: [OpenAI](https://thirdpartyindex.com/vendors/openai#status), which Twenty lists as a subprocessor, reported Delayed Costs data in the Compliance API (minor) - 2026-10-14: [OpenAI](https://thirdpartyindex.com/vendors/openai#status), which Twenty lists as a subprocessor, reported Limited availability on gpt-image-2.5-flare and gpt-image-2.5-sunburst (minor) - 2026-10-14: [OpenAI](https://thirdpartyindex.com/vendors/openai#status), which Twenty lists as a subprocessor, reported Degraded performance in Codex and ChatGPT Work (minor) - 2026-10-14: [Sentry](https://thirdpartyindex.com/vendors/sentry#status), which Twenty lists as a subprocessor, reported Ingestion Halted for EAP data in EU (major) - 2026-10-13: [OpenAI](https://thirdpartyindex.com/vendors/openai#status), which Twenty lists as a subprocessor, reported Degraded performance in GPT-6.1 Sol Codex and Work mode (minor) The subprocessor list as we read it on any date: https://thirdpartyindex.com/labs/time-machine/twenty ## Security contact From its security.txt (https://twenty.com/.well-known/security.txt) ([evidence](https://thirdpartyindex.com/evidence/223081)): - Contact: https://github.com/twentyhq/twenty/issues/new - Contact: mailto:security@twenty.com - Disclosure policy: https://github.com/twentyhq/twenty/security/policy - Languages: en - No expiry date --- Third Party Index (https://thirdpartyindex.com) monitors vendors' public security and privacy documents and keeps each version as evidence. Data CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/); vendors' own documents are theirs. API: https://thirdpartyindex.com/api