# Weflow

Weflow (weflow.ai): subprocessors, data processing agreement, security documents and changes, as monitored by Third Party Index.

- Page: https://thirdpartyindex.com/vendors/weflow
- Documents last verified: 2026-10-05
- Transparency rating: 70/100 (how much it publishes, not how secure it is): Subprocessor list 30/30; Processing locations 8/8; Purposes 0/7 (partial); Data processing addendum 0/12 (not found); Trust center 8/8; Privacy policy 6/6; security.txt 0/6 (not found); Security page 5/5; Status page 5/5; Vulnerability disclosure 0/5 (not found); Pages still reachable 8/8
- Supply chain: relies on 6 tracked vendors directly, 69 within two hops, 268 within three; 1 tracked vendors rely on it directly, 1 within two hops, 1 within three
- Cite as: Weflow, Third Party Index, https://thirdpartyindex.com/vendors/weflow (data CC BY 4.0)

## Documents

| Document | URL | Last verified | Last changed |
|---|---|---|---|
| Trust center | https://trust.weflow.ai/ | 2026-10-05 | 2026-10-05 |
| Subprocessor list | https://trust.weflow.ai/subprocessors | 2026-10-05 | 2026-10-03 |
| Privacy policy | https://www.weflow.ai/platform-privacy-policy | 2026-10-05 | 2026-10-03 |
| Security page | https://www.weflow.ai/security | 2026-10-05 | 2026-10-03 |
| Status page | https://status.getweflow.com/ | 2026-10-05 | 2026-10-03 |

## Subprocessors (6)

As its own list states them.

| Subprocessor | Purpose | Location | Listed since |
|---|---|---|---|
| [Amazon Web Services](https://thirdpartyindex.com/vendors/amazon-web-services.md) | — | Cloud service used for various backend services relating to our product offering including storing PII. | 2026-10-03 |
| [Bitbucket](https://thirdpartyindex.com/vendors/bitbucket.md) | — | Cloud service that stores code and provides version management relevant to providing product and services to customers. | 2026-10-03 |
| [Google Workspace](https://thirdpartyindex.com/vendors/google-cloud.md) | — | Cloud service provider for communication and collaboration | 2026-10-03 |
| [Jira](https://thirdpartyindex.com/vendors/atlassian.md) | — | Cloud service provider that stores customer support tickets and serves as project management tool for organizing the work of the engineering team. | 2026-10-03 |
| [Slack](https://thirdpartyindex.com/vendors/slack.md) | — | Chat tool used for internal and external communication. | 2026-10-03 |
| [Vanta](https://thirdpartyindex.com/vendors/vanta.md) | — | Continuous security and compliance monitoring | 2026-10-03 |

Read from ([evidence](https://thirdpartyindex.com/evidence/40136)). CSV: https://thirdpartyindex.com/vendors/weflow/subprocessors.csv

## Compliance

As its trust center lists them.

- Audited: SOC 2 Type II ([evidence](https://thirdpartyindex.com/evidence/40128))
- Claimed: HIPAA, GDPR, CCPA/CPRA ([evidence](https://thirdpartyindex.com/evidence/40128))

## Web Technologies

Weflow's homepage made 219 requests to 42 domains, 19 services controlled by another company, and 5 domains not identified. Loaded on 2026-10-03 by a browser that accepted nothing; other visits may load more or less. What a page loads is not a list of who receives customer data.

### Third parties (19)

- Webflow: 93 requests to website-files.com
- Google Cloud: 24 requests to google.com, doubleclick.net, googletagmanager.com, googleadservices.com; DoubleClick Floodlight, Google Analytics, Google Tag Manager (its subprocessor list names it too)
- Reddit, Inc.: 16 requests to reddit.com, redditstatic.com; Reddit Ads
- HubSpot: 14 requests to hubspot.com, hs-scripts.com, hscollectedforms.net, hsforms.com, hs-banner.com, hs-analytics.net, hsadspixel.net, hubapi.com; HubSpot
- Microsoft: 10 requests to clarity.ms, bing.com; Microsoft Advertising
- LinkedIn: 6 requests to linkedin.com, licdn.com; Linkedin Insight Tag
- Intercom: 5 requests to intercom.io, intercomcdn.com
- Clay: 4 requests to claydar.com
- Cookiebot: 4 requests to cookiebot.com; Cookiebot 1
- LiveIntent: 4 requests to liadm.com; LiveIntent
- OpenAI: 4 requests to openai.com
- FullContact: 3 requests to fullcontact.com; FullContact
- Meta: 3 requests to facebook.net, facebook.com; Facebook Pixel 2.9.414
- Snitcher: 3 requests to snitcher.com
- Cloudflare: 2 requests to cloudflareinsights.com, cloudflare.com; Cloudflare Browser Insights, cdnjs
- G2.com: 2 requests to g2crowd.com, g2.com
- Leadfeeder: 2 requests to lfeeder.com
- jsDelivr: 2 requests to jsdelivr.net; FingerprintJS 3.4.2, jsDelivr
- Primer Labs, Inc.: 1 request to sayprimer.com

### Unknown (5)

Domains not identified yet: hubspotonwebflow.com, webflow.services, d3e54v103j8qbb.cloudfront.net, g1584674684.co, leadsy.ai

### First party (1)

- Weflow: 3 requests to weflow.ai; Cloudflare, GSAP 3.15.0, Goober, HSTS, HTTP/3, Intercom, Leadfeeder, Microsoft Clarity, Open Graph, Swiper, Webflow 1.6.0, Webpack, core-js 3.32.2

15 tracked companies loaded by the homepage are not in Weflow's subprocessor list. A website can use a service without it processing customer data.

## Subprocessor of (1)

Tracked vendors whose own subprocessor lists name it, and what they say they use it for.

- [Lumerate](https://thirdpartyindex.com/vendors/lumerate.md): Sales productivity, pipeline management, and Salesforce synchronization tools.

## Service status

Incidents it reported on its own status page.

- Last 2 days: 0 reported incidents (0 major or critical, 0 minor, 0 with no impact stated)
- Status page last read: 2026-10-06
- No incidents reported since Oct 4, 2026

---

Third Party Index (https://thirdpartyindex.com) monitors vendors' public security and privacy documents and keeps each version as evidence. Data CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/); vendors' own documents are theirs. API: https://thirdpartyindex.com/api