# urlscan urlscan declares [8 subprocessors](https://thirdpartyindex.com/vendors/urlscan#subprocessors) in [its subprocessor list](https://urlscan.io/legal/subprocessors), which we last checked on 2026-11-11 ([evidence](https://thirdpartyindex.com/evidence/224319)). They include [Amazon Web Services](https://thirdpartyindex.com/vendors/amazon-web-services), [Google Cloud](https://thirdpartyindex.com/vendors/google-cloud) and [Stripe](https://thirdpartyindex.com/vendors/stripe). No published changes since we first read it on 2026-11-06. [1 tracked vendor](https://thirdpartyindex.com/vendors/urlscan#used-by), [Prophet Security](https://thirdpartyindex.com/vendors/prophet-security), names urlscan as a subprocessor. urlscan (urlscan.io): subprocessors, data processing agreement, security documents and changes, as monitored by Third Party Index. - Page: https://thirdpartyindex.com/vendors/urlscan - Documents last verified: 2026-11-11 - Transparency rating: 67/100 (how much it publishes, not how secure it is): Subprocessor list 30/30; Processing locations 0/8 (partial); Purposes 7/7; Data processing addendum 0/12 (not found); Trust center 0/8 (not found); Privacy policy 6/6; security.txt 6/6; Security page 5/5; Status page 5/5; Vulnerability disclosure 0/5 (not found); Pages still reachable 8/8 - Supply chain: relies on 6 tracked vendors directly, 76 within two hops, 348 within three; 1 tracked vendors rely on it directly, 1 within two hops, 1 within three - Cite as: urlscan, Third Party Index, https://thirdpartyindex.com/vendors/urlscan (data CC BY 4.0) ## Documents | Document | URL | Last verified | Last changed | |---|---|---|---| | Subprocessor list | https://urlscan.io/legal/subprocessors | 2026-11-11 | 2026-11-06 | | Privacy policy | https://urlscan.io/privacy/ | 2026-11-11 | 2026-11-06 | | Terms | https://urlscan.io/terms/ | 2026-11-11 | 2026-11-06 | | Security page | https://urlscan.io/security/ | 2026-11-11 | 2026-11-06 | | security.txt | https://urlscan.io/.well-known/security.txt | 2026-11-11 | 2026-11-06 | | Status page | https://status.urlscan.io/ | 2026-11-11 | 2026-11-11 | ## Subprocessors (8) As its own list states them. | Subprocessor | Purpose | Location | Listed since | |---|---|---|---| | [Amazon Web Services EMEA SARL](https://thirdpartyindex.com/vendors/amazon-web-services.md) | Encrypted database backups | — | 2026-11-06 | | [Backblaze Inc.](https://thirdpartyindex.com/vendors/backblaze.md) | URL scan results storage (DOM, Screenshot, API Trace) | — | 2026-11-06 | | [DigitalOcean, LLC](https://thirdpartyindex.com/vendors/digitalocean.md) | URL Scanning | — | 2026-11-06 | | [Google LLC](https://thirdpartyindex.com/vendors/google-cloud.md) | Google reCaptcha | — | 2026-11-06 | | [Hetzner Online GmbH](https://thirdpartyindex.com/vendors/hetzner-online.md) | Core Infrastructure, database | — | 2026-11-06 | | Postmark - ActiveCampaign, LLC | Transactional Emails | — | 2026-11-06 | | [Stripe, Inc.](https://thirdpartyindex.com/vendors/stripe.md) | Invoicing and payment | — | 2026-11-06 | | Vultr - The Constant Company, LLC. | URL Scanning | — | 2026-11-06 | Read from ([evidence](https://thirdpartyindex.com/evidence/224319)). CSV: https://thirdpartyindex.com/vendors/urlscan/subprocessors.csv ## Web Technologies urlscan's homepage made 57 requests to 4 domains, and 1 service controlled by another company. Loaded on 2026-11-07 by a browser that accepted nothing; other visits may load more or less. What a page loads is not a list of who receives customer data. 1 third party by category: Security 1 (Google Cloud). Each company that appears controlled by another organization is counted once, under the main category of the technologies detected from it on this homepage or, when none was, the category recorded from the company's own page (marked reviewed) or else the one it is usually detected as on other published homepages (marked as such); unclassified: none of these. ### Third parties (1) - Google Cloud: 21 requests to gstatic.com, google.com, fonts.googleapis.com; reCAPTCHA (its subprocessor list names it too) ### First party (1) - urlscan: 36 requests to urlscan.io; Bootstrap, Glyphicons, Google Font API, HSTS, Nginx, RSS ## Subprocessor of (1) Tracked vendors whose own subprocessor lists name it, and what they say they use it for. - [Prophet Security](https://thirdpartyindex.com/vendors/prophet-security.md): Current – authorized as of September 10, 2026. Used for scanning URLs for malicious content. This enhances our ability to analyze and neutralize web-based thr… ## Incidents reported by urlscan's subprocessors Incidents reported in the last 30 days on their own status pages by 2 vendors urlscan lists as subprocessors. A subprocessor list names a company, not the service an incident touched. - 2026-11-01: [Stripe](https://thirdpartyindex.com/vendors/stripe#status), which urlscan lists as a subprocessor, reported Elevated Instant Payouts failures (no impact stated) - 2026-10-28: [Stripe](https://thirdpartyindex.com/vendors/stripe#status), which urlscan lists as a subprocessor, reported Elevated Issuing errors from 17:13 - 20:41 UTC (minor) - 2026-10-27: [DigitalOcean](https://thirdpartyindex.com/vendors/digitalocean#status), which urlscan lists as a subprocessor, reported Kubernetes Cluster Management Operations (major) - 2026-10-24: [Stripe](https://thirdpartyindex.com/vendors/stripe#status), which urlscan lists as a subprocessor, reported Elevated Blik errors (no impact stated) - 2026-10-22: [Stripe](https://thirdpartyindex.com/vendors/stripe#status), which urlscan lists as a subprocessor, reported Elevated Bancontact errors (no impact stated) - 2026-10-22: [Stripe](https://thirdpartyindex.com/vendors/stripe#status), which urlscan lists as a subprocessor, reported Elevated Bancontact errors (no impact stated) - 2026-10-20: [Stripe](https://thirdpartyindex.com/vendors/stripe#status), which urlscan lists as a subprocessor, reported Spike in cancellations and expired errors with PayByBank payments (no impact stated) - 2026-10-20: [Stripe](https://thirdpartyindex.com/vendors/stripe#status), which urlscan lists as a subprocessor, reported Elevated Revolut Pay errors (no impact stated) - 2026-10-15: [Stripe](https://thirdpartyindex.com/vendors/stripe#status), which urlscan lists as a subprocessor, reported Elevated declines on Mastercard (no impact stated) - 2026-10-15: [Stripe](https://thirdpartyindex.com/vendors/stripe#status), which urlscan lists as a subprocessor, reported Elevated declines on Visa (no impact stated) - 2026-10-15: [Stripe](https://thirdpartyindex.com/vendors/stripe#status), which urlscan lists as a subprocessor, reported Elevated Amazon Pay errors (no impact stated) - 2026-10-13: [DigitalOcean](https://thirdpartyindex.com/vendors/digitalocean#status), which urlscan lists as a subprocessor, reported App Platform Deployments (no impact stated) The subprocessor list as we read it on any date: https://thirdpartyindex.com/labs/time-machine/urlscan ## Security contact From its security.txt (https://urlscan.io/.well-known/security.txt) ([evidence](https://thirdpartyindex.com/evidence/224307)): - Contact: mailto:security@urlscan.io - Disclosure policy: https://urlscan.io/security/ - Languages: en, de - No expiry date --- Third Party Index (https://thirdpartyindex.com) monitors vendors' public security and privacy documents and keeps each version as evidence. Data CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/); vendors' own documents are theirs. API: https://thirdpartyindex.com/api