# WalkMe

WalkMe declares [7 subprocessors](https://thirdpartyindex.com/vendors/walkme#subprocessors) in [its subprocessor list](https://trust.walkme.com/?itemUid=e3fae2ca-94a9-416b-b577-5c90e382df57), which we last checked on 2026-11-11 ([evidence](https://thirdpartyindex.com/evidence/238555)). They include [Amazon Web Services](https://thirdpartyindex.com/vendors/amazon-web-services), [Google Cloud](https://thirdpartyindex.com/vendors/google-cloud) and [Microsoft](https://thirdpartyindex.com/vendors/microsoft). No published changes since we first read it on 2026-09-22. [12 tracked vendors](https://thirdpartyindex.com/vendors/walkme#used-by) name WalkMe as a subprocessor, including [LinkedIn](https://thirdpartyindex.com/vendors/linkedin), [ConnectWise](https://thirdpartyindex.com/vendors/connectwise) and [Sprinklr](https://thirdpartyindex.com/vendors/sprinklr).

WalkMe (walkme.com): subprocessors, data processing agreement, security documents and changes, as monitored by Third Party Index.

- Page: https://thirdpartyindex.com/vendors/walkme
- Documents last verified: 2026-11-11
- Transparency rating: 72/100 (how much it publishes, not how secure it is): Subprocessor list 30/30; Processing locations 8/8; Purposes 7/7; Data processing addendum 0/12 (not found); Trust center 8/8; Privacy policy 6/6; security.txt 0/6 (not found); Security page 0/5 (not found); Status page 5/5; Vulnerability disclosure 0/5 (not found); Pages still reachable 8/8
- Supply chain: relies on 7 tracked vendors directly, 77 within two hops, 292 within three; 12 tracked vendors rely on it directly, 108 within two hops, 2149 within three
- Cite as: WalkMe, Third Party Index, https://thirdpartyindex.com/vendors/walkme (data CC BY 4.0)

## Documents

| Document | URL | Last verified | Last changed |
|---|---|---|---|
| Trust center | https://trust.walkme.com/ | 2026-11-11 | 2026-11-08 |
| Subprocessor list | https://trust.walkme.com/?itemUid=e3fae2ca-94a9-416b-b577-5c90e382df57 | 2026-11-11 | 2026-11-08 |
| Privacy policy | https://www.walkme.com/privacy-policy/ | 2026-11-11 | 2026-09-23 |
| Terms | https://www.walkme.com/terms-and-conditions/ | 2026-11-11 | 2026-09-22 |
| Status page | https://status.walkme.com/ | 2026-11-11 | 2026-11-11 |

## Subprocessors (7)

As its own list states them.

| Subprocessor | Purpose | Location | Listed since |
|---|---|---|---|
| [Akamai](https://thirdpartyindex.com/vendors/akamai.md) | Content Delivery, WAF services | Massachusetts, United States | 2026-09-22 |
| [Amazon Web Services (AWS)](https://thirdpartyindex.com/vendors/amazon-web-services.md) | Hosting infrastructure services | Washington, United States | 2026-10-01 |
| [Datadog](https://thirdpartyindex.com/vendors/datadog.md) | Application logging & monitoring | New York, United States | 2026-09-22 |
| [Google Cloud](https://thirdpartyindex.com/vendors/google-cloud.md) | Hosting infrastructure services | Dublin, Ireland | 2026-10-01 |
| [Microsoft Azure](https://thirdpartyindex.com/vendors/microsoft.md) | Hosting infrastructure services; AI services (only in use in connection with WalkMe backend or optional Genertaive AI features) | Dublin, Ireland | 2026-10-01 |
| [Okta](https://thirdpartyindex.com/vendors/okta.md) | User authentication to WalkMe Editor | California, United States | 2026-09-22 |
| [Salesforce](https://thirdpartyindex.com/vendors/salesforce.md) | Support | UK | 2026-09-22 |

Read from ([evidence](https://thirdpartyindex.com/evidence/3691)). CSV: https://thirdpartyindex.com/vendors/walkme/subprocessors.csv

## Compliance

As its trust center lists them.

- Audited: SOC 2 Type II, SOC 3, ISO/IEC 27001, ISO/IEC 27017, ISO/IEC 27018, ISO/IEC 27701, ISO/IEC 42001, PCI DSS, FedRAMP, StateRAMP, TX-RAMP, CSA STAR, BSI C5, TISAX, Cyber Essentials, IRAP ([evidence](https://thirdpartyindex.com/evidence/200554))
- Claimed: HIPAA, GDPR, CCPA/CPRA, Data Privacy Framework, DORA, NIST CSF ([evidence](https://thirdpartyindex.com/evidence/200554))
- FedRAMP Marketplace: Moderate

## Web Technologies

WalkMe's homepage made 213 requests to 34 domains, 19 services controlled by another company, and 1 domain not identified. Loaded on 2026-11-05 by a browser that accepted nothing; other visits may load more or less. What a page loads is not a list of who receives customer data.

19 third parties by category: Advertising 6 (Google Cloud, Microsoft, X Corp., Influ2, Inc., Reddit, Inc.; usually detected as Advertising: Xandr); Analytics 5 (Meta, G2.com, LinkedIn, Cloudflare; reviewed: Parse.ly); Marketing automation 1 (6Sense Insights, Inc.); Live chat 1 (Qualified.com, Inc.); Cookie compliance 1 (OneTrust); Accessibility 1 (Userway); Geolocation 1 (MaxMind); Issue trackers 1 (usually detected as Issue trackers: Sentry); JavaScript libraries 1 (usually detected as JavaScript libraries: WordPress.com); Personalisation 1 (Trendemon). Each company that appears controlled by another organization is counted once, under the main category of the technologies detected from it on this homepage or, when none was, the category recorded from the company's own page (marked reviewed) or else the one it is usually detected as on other published homepages (marked as such); unclassified: none of these.

### Third parties (19)

- Qualified.com, Inc.: 37 requests to qualified.com; Qualified
- Google Cloud: 23 requests to google.com, doubleclick.net, googletagmanager.com, googleadservices.com; DoubleClick Floodlight, Google Analytics, Google Tag Manager (its subprocessor list names it too)
- 6Sense Insights, Inc.: 19 requests to 6sc.co, 6sense.com; 6sense
- OneTrust: 11 requests to cookielaw.org, onetrust.com; OneTrust
- Userway: 9 requests to userway.org; UserWay
- Microsoft: 8 requests to bing.com, bing.net; Microsoft Advertising (its subprocessor list names it too)
- Trendemon: 7 requests to trendemon.com; Trendemon
- X Corp.: 5 requests to t.co, twitter.com, ads-twitter.com; Twitter Ads
- Meta: 4 requests to facebook.com, facebook.net; Facebook Pixel 2.9.435
- G2.com: 3 requests to g2.com, g2crowd.com; G2 Track Your Prospects
- Influ2, Inc.: 3 requests to influ2.com; Influ2
- LinkedIn: 3 requests to linkedin.com, licdn.com; Linkedin Insight Tag
- Parse.ly: 3 requests to parsely.com
- Reddit, Inc.: 3 requests to reddit.com, redditstatic.com; Reddit Ads
- MaxMind: 2 requests to geoip-js.com, maxmind.com; MaxMind
- WordPress.com: 2 requests to wp.com
- Cloudflare: 1 request to cloudflareinsights.com; Cloudflare Browser Insights
- Sentry: 1 request to sentry.io
- Xandr: 1 request to adnxs.com

### Unknown (1)

Domains not identified yet: usbrowserspeed.com

### First party (1)

- WalkMe: 67 requests to walkme.com; GSAP 3.12.5, LazySizes, MySQL, Nginx, Open Graph, PHP, PWA, Parse.ly, Priority Hints, RSS, Rive, Salesforce Marketing Cloud Account Engagement, Sentry, Swiper, WPML 4.9.4, WalkMe, WordPress 7.1.4, WordPress Block Editor, Yoast SEO 28.4, core-js 3.32.2, jQuery 3.7.1, jQuery Migrate 3.4.1

9 tracked companies loaded by the homepage are not in WalkMe's subprocessor list. A website can use a service without it processing customer data.

## Subprocessor of (12)

Tracked vendors whose own subprocessor lists name it, and what they say they use it for.

- [ConnectWise](https://thirdpartyindex.com/vendors/connectwise.md): Digital adoption and guidance platform; On-screen guidance and tutorials within SaaS applications
- [Edmentum](https://thirdpartyindex.com/vendors/edmentum.md): In product notifications, support, and help
- [Forcepoint](https://thirdpartyindex.com/vendors/forcepoint.md): Product Support Services
- [Humanforce](https://thirdpartyindex.com/vendors/humanforce.md): - Processing Purpose: Digital adoption analytics and workflow engagement within applications. - Type of Data: User interaction logs, session and environment met…
- [insightsoftware](https://thirdpartyindex.com/vendors/insightsoftware.md): Digital adoption platform and usage analytics)
- [JobAdder](https://thirdpartyindex.com/vendors/jobadder.md): Self-service training for JobAdder customers
- [LinkedIn](https://thirdpartyindex.com/vendors/linkedin.md): Software integration for customer training materials
- [Lytx](https://thirdpartyindex.com/vendors/lytx.md): User Experience
- [Moogsoft](https://thirdpartyindex.com/vendors/moogsoft.md)
- [Personify Health](https://thirdpartyindex.com/vendors/personify-health.md)
- [Riverbed](https://thirdpartyindex.com/vendors/riverbed.md): In-product contextual guidance and workflow support functionality
- [Sprinklr](https://thirdpartyindex.com/vendors/sprinklr.md)

## Service status

Incidents it reported on its own status page.

- Last 90 days: 0 reported incidents (0 major or critical, 0 minor, 0 with no impact stated)
- Status page last read: 2026-11-12
- No incidents reported in the last 12 months
- 2026-07-10: Extension not loading on cloud.microsoft domains after an update to the Microsoft Edge Browser (version 150) (minor)
- 2026-04-17: Known Chromium Bug Impacting Browser Load Time on Initial Boot Up With the WalkMe Extension Installed on Windows OS (minor)

## Incidents reported by WalkMe's subprocessors

Incidents reported in the last 30 days on their own status pages by 2 vendors WalkMe lists as subprocessors. A subprocessor list names a company, not the service an incident touched.

- 2026-11-03: [Akamai](https://thirdpartyindex.com/vendors/akamai#status), which WalkMe lists as a subprocessor, reported Property Manager Property Activation Errors (no impact stated)
- 2026-10-30: [Akamai](https://thirdpartyindex.com/vendors/akamai#status), which WalkMe lists as a subprocessor, reported Customer Security Advisory: CVE-2026-98432 (no impact stated)
- 2026-10-28: [Datadog](https://thirdpartyindex.com/vendors/datadog#status), which WalkMe lists as a subprocessor, reported Metrics query are disrupted (major)
- 2026-10-27: [Akamai](https://thirdpartyindex.com/vendors/akamai#status), which WalkMe lists as a subprocessor, reported Performance Degradation for Customers in Mumbai and Chennai (no impact stated)
- 2026-10-27: [Akamai](https://thirdpartyindex.com/vendors/akamai#status), which WalkMe lists as a subprocessor, reported Enterprise Application Access (EAA) Connector Issues (minor)
- 2026-10-26: [Datadog](https://thirdpartyindex.com/vendors/datadog#status), which WalkMe lists as a subprocessor, reported Elevated Error Rates for Workflow Automation, App Builder, Bits Code, Bits Agent Builder (major)
- 2026-10-25: [Akamai](https://thirdpartyindex.com/vendors/akamai#status), which WalkMe lists as a subprocessor, reported Edge Delivery issues between Indonesia and Singapore (minor)
- 2026-10-23: [Akamai](https://thirdpartyindex.com/vendors/akamai#status), which WalkMe lists as a subprocessor, reported Customer Security Advisory: Brotli Remote Code Execution Vulnerabilities \[CVE-2026-111497\] (no impact stated)
- 2026-10-22: [Akamai](https://thirdpartyindex.com/vendors/akamai#status), which WalkMe lists as a subprocessor, reported Customer Security Advisory: Critical F5/NGINX Out-of-Band Vulnerabilities (no impact stated)
- 2026-10-21: [Akamai](https://thirdpartyindex.com/vendors/akamai#status), which WalkMe lists as a subprocessor, reported Edge Delivery Secure CDN platform at Risk of Capacity Issues (no impact stated)
- 2026-10-21: [Akamai](https://thirdpartyindex.com/vendors/akamai#status), which WalkMe lists as a subprocessor, reported Web Security Analytics, Reporting and Configuration Deployment Issues (minor)
- 2026-10-21: [Akamai](https://thirdpartyindex.com/vendors/akamai#status), which WalkMe lists as a subprocessor, reported Customer Security Advisory: PHP Remote Code Execution Vulnerabilities (no impact stated)
- 2026-10-21: [Akamai](https://thirdpartyindex.com/vendors/akamai#status), which WalkMe lists as a subprocessor, reported NetStorage issues in Los Angeles (minor)

The subprocessor list as we read it on any date: https://thirdpartyindex.com/labs/time-machine/walkme

---

Third Party Index (https://thirdpartyindex.com) monitors vendors' public security and privacy documents and keeps each version as evidence. Data CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/); vendors' own documents are theirs. API: https://thirdpartyindex.com/api