WSO2
WSO2 declares 20 subprocessors in its subprocessor list, which we last checked on Nov 11, 2026 (evidence). They include Amazon Web Services, Google Cloud and Microsoft. No published changes since we first read it on Sep 28, 2026.
Not listed by any tracked vendor.
Not loaded by any published homepage.
Subprocessors CSV of WSO2's subprocessors · Atom feed of WSO2's subprocessors DORA draft CSV of WSO2's subprocessors as declared by WSO2 what's this? ·
20 third parties.
| Name | Purpose | Location | Listed since |
|---|---|---|---|
| Aiven | To provide a database as a service for Developer Platform subscribers. | USA and EU | |
| Aiven Google Inc | To provide a database as a service for Developer Platform subscribers. | USA and EU | |
| Amplitude | For the performance and analytics purposes of Developer Platform. | USA and EU | |
| AWS | To host WSO2 public cloud services. | Global | |
| DocuSign | For executing contracts between subscribers and WSO2. | USA | |
| Google Inc (Google reCAPTCHA) | To protect logins and forms from bots.; protect logins and forms from bots. | USA | |
| Google Cloud | To host WSO2 public cloud services. | Global | |
| Microsoft Azure | To host WSO2 public cloud services. | Global | |
| MongoDB, Inc. | To host cloud metadata. | USA | |
| Netsuite | For subscriber invoicing and internal finance systems. | USA | |
| Pardot | communication preferences. | USA | |
| Platform | |||
| Silicon Valley Bank Payment Gateway purchase | To facilitate card payments to WSO2 services. | USA | |
| SpotDraft | For executing contracts between subscribers and WSO2. | USA | |
| Stripe | To facilitate card payments to purchase WSO2 services. | USA | |
| TailScale | To Provide a Secure VPN tunnel to transfer data.; To provide a Secure VPN tunnel to transfer data. | Global | |
| Thinkific | For providing WSO2 training and product exams. | USA | |
| VirusTotal | To protect WSO2 systems and services against malware and bad actors. | USA | |
| VirusTotal Google Inc | To protect WSO2 systems and services against malware and bad actors. | USA | |
| Zoom | To facilitate webinar events, we may invite subscribers to present their experiences with WSO2. | USA |
Web TechnologiesCSV of WSO2's web technologies · Atom feed of WSO2's web technologies
WSO2's homepage made 163 requests to 7 domains, 3 services controlled by another company, and 1 domain not identified.
3 third parties by category: Tag managers 1Cookie compliance 1CDN 1
cachefly.net
2 tracked companies loaded by the homepage are not in WSO2's subprocessor list. A website can use a service without it processing customer data.
Security recordCSV of WSO2's security record · Atom feed of WSO2's security record
What public security catalogs list for WSO2, in their words.
Known exploited vulnerabilities
2 vulnerabilities in WSO2's software that CISA lists as exploited in the wild.
| CVE | Product | Vulnerability | Listed |
|---|---|---|---|
| CVE-2026-5430 | Multiple Products | WSO2 Multiple Products Path Traversal Vulnerability | |
| CVE-2022-29464 | Multiple Products | WSO2 Multiple Products Unrestrictive Upload of File Vulnerability used by ransomware |
Source: CISA Known Exploited Vulnerabilities catalog (evidence)
Incidents reported by WSO2's subprocessorsCSV of incidents reported by vendors WSO2 lists · Atom feed of incidents reported by vendors WSO2 lists
52 reported incidents in the last 30 days, by 8 of the vendors WSO2 lists as subprocessors.
A subprocessor list names a company, not the service an incident touched. This does not show that WSO2 was involved.
And 27 more. All of them: CSV · Who is around them.
ChangesCSV of WSO2's changes · Atom feed of WSO2's changes
See the list as we read it on any date: Time machine
None since tracking began.
Rating badge for WSO2's site
It updates with the rating.
<a href="https://thirdpartyindex.com/vendors/wso2"><img src="https://thirdpartyindex.com/badge/wso2.svg" alt="WSO2 transparency rating on Third Party Index" height="20"></a>[](https://thirdpartyindex.com/vendors/wso2)