# WSO2 WSO2 declares [20 subprocessors](https://thirdpartyindex.com/vendors/wso2#subprocessors) in [its subprocessor list](https://storage.pardot.com/142131/1775637164PW187KMc/wso2_subprocessor_list.pdf), which we last checked on 2026-11-11 ([evidence](https://thirdpartyindex.com/evidence/14466)). They include [Amazon Web Services](https://thirdpartyindex.com/vendors/amazon-web-services), [Google Cloud](https://thirdpartyindex.com/vendors/google-cloud) and [Microsoft](https://thirdpartyindex.com/vendors/microsoft). No published changes since we first read it on 2026-09-28. WSO2 (wso2.com): subprocessors, data processing agreement, security documents and changes, as monitored by Third Party Index. - Page: https://thirdpartyindex.com/vendors/wso2 - Documents last verified: 2026-11-11 - Transparency rating: 69/100 (how much it publishes, not how secure it is): Subprocessor list 30/30; Processing locations 8/8; Purposes 7/7; Data processing addendum 0/12 (not found); Trust center 0/8 (not found); Privacy policy 6/6; security.txt 0/6 (not found); Security page 5/5; Status page 0/5 (not found); Vulnerability disclosure 5/5; Pages still reachable 8/8 - Supply chain: relies on 14 tracked vendors directly, 165 within two hops, 520 within three; 0 tracked vendors rely on it directly, 0 within two hops, 0 within three - Cite as: WSO2, Third Party Index, https://thirdpartyindex.com/vendors/wso2 (data CC BY 4.0) ## Documents | Document | URL | Last verified | Last changed | |---|---|---|---| | Subprocessor list | https://storage.pardot.com/142131/1775637164PW187KMc/wso2\_subprocessor\_list.pdf | 2026-11-11 | 2026-09-28 | | Privacy policy | https://wso2.com/privacy-policy | 2026-11-11 | 2026-09-23 | | Terms | https://wso2.com/terms-of-use/ | 2026-11-11 | 2026-09-23 | | Security page | https://wso2.com/security | 2026-11-11 | 2026-09-23 | | Security advisories | https://security.docs.wso2.com/en/latest/security-announcements/security-advisories/ | 2026-11-11 | 2026-11-04 | ## Subprocessors (20) As its own list states them. | Subprocessor | Purpose | Location | Listed since | |---|---|---|---| | [Aiven](https://thirdpartyindex.com/vendors/aiven.md) | To provide a database as a service for Developer Platform subscribers. | USA and EU | 2026-09-28 | | Aiven Google Inc | To provide a database as a service for Developer Platform subscribers. | USA and EU | 2026-10-11 | | [Amplitude](https://thirdpartyindex.com/vendors/amplitude.md) | For the performance and analytics purposes of Developer Platform. | USA and EU | 2026-10-11 | | [AWS](https://thirdpartyindex.com/vendors/amazon-web-services.md) | To host WSO2 public cloud services. | Global | 2026-09-28 | | [DocuSign](https://thirdpartyindex.com/vendors/docusign.md) | For executing contracts between subscribers and WSO2. | USA | 2026-09-28 | | [Google Inc (Google reCAPTCHA)](https://thirdpartyindex.com/vendors/google-cloud.md) | To protect logins and forms from bots.; protect logins and forms from bots. | USA | 2026-09-28 | | [Google Cloud](https://thirdpartyindex.com/vendors/google-cloud.md) | To host WSO2 public cloud services. | Global | 2026-09-28 | | [Microsoft Azure](https://thirdpartyindex.com/vendors/microsoft.md) | To host WSO2 public cloud services. | Global | 2026-09-28 | | [MongoDB, Inc.](https://thirdpartyindex.com/vendors/mongodb.md) | To host cloud metadata. | USA | 2026-09-28 | | [Netsuite](https://thirdpartyindex.com/vendors/netsuite.md) | For subscriber invoicing and internal finance systems. | USA | 2026-09-28 | | [Pardot](https://thirdpartyindex.com/vendors/salesforce.md) | communication preferences. | USA | 2026-09-28 | | Platform | — | — | 2026-09-28 | | Silicon Valley Bank Payment Gateway purchase | To facilitate card payments to WSO2 services. | USA | 2026-10-11 | | [SpotDraft](https://thirdpartyindex.com/vendors/spotdraft.md) | For executing contracts between subscribers and WSO2. | USA | 2026-09-28 | | [Stripe](https://thirdpartyindex.com/vendors/stripe.md) | To facilitate card payments to purchase WSO2 services. | USA | 2026-10-11 | | [TailScale](https://thirdpartyindex.com/vendors/tailscale.md) | To Provide a Secure VPN tunnel to transfer data.; To provide a Secure VPN tunnel to transfer data. | Global | 2026-10-11 | | [Thinkific](https://thirdpartyindex.com/vendors/thinkific.md) | For providing WSO2 training and product exams. | USA | 2026-10-11 | | VirusTotal | To protect WSO2 systems and services against malware and bad actors. | USA | 2026-10-11 | | VirusTotal Google Inc | To protect WSO2 systems and services against malware and bad actors. | USA | 2026-09-28 | | [Zoom](https://thirdpartyindex.com/vendors/zoom.md) | To facilitate webinar events, we may invite subscribers to present their experiences with WSO2. | USA | 2026-10-11 | Read from ([evidence](https://thirdpartyindex.com/evidence/14466)). CSV: https://thirdpartyindex.com/vendors/wso2/subprocessors.csv ## Web Technologies WSO2's homepage made 163 requests to 7 domains, 3 services controlled by another company, and 1 domain not identified. Loaded on 2026-10-14 by a browser that accepted nothing; other visits may load more or less. What a page loads is not a list of who receives customer data. 3 third parties by category: Tag managers 1 (Google Cloud); Cookie compliance 1 (OneTrust); CDN 1 (jsDelivr). Each company that appears controlled by another organization is counted once, under the main category of the technologies detected from it on this homepage or, when none was, the category recorded from the company's own page (marked reviewed) or else the one it is usually detected as on other published homepages (marked as such); unclassified: none of these. ### Third parties (3) - OneTrust: 10 requests to cookiepro.com, onetrust.com; OneTrust - jsDelivr: 3 requests to jsdelivr.net; Bootstrap 5.3.2, jsDelivr - Google Cloud: 2 requests to googletagmanager.com, gstatic.com; Google Tag Manager (its subprocessor list names it too) ### Unknown (1) Domains not identified yet: cachefly.net ### First party (1) - WSO2: 86 requests to wso2.com; Cloudflare, Drupal 10, HSTS, LazySizes, MathJax 3.2.2, Open Graph, PHP, Priority Hints, Salesforce Marketing Cloud Account Engagement, jQuery 3.7.1 2 tracked companies loaded by the homepage are not in WSO2's subprocessor list. A website can use a service without it processing customer data. ## Subprocessor of (0) No tracked vendor lists it. ## Security record CISA's Known Exploited Vulnerabilities catalog lists 2 vulnerabilities in its software: - CVE-2026-5430 (Multiple Products), listed 2026-09-24: WSO2 Multiple Products Path Traversal Vulnerability - CVE-2022-29464 (Multiple Products), listed 2022-04-25: WSO2 Multiple Products Unrestrictive Upload of File Vulnerability (known ransomware use) ## Incidents reported by WSO2's subprocessors Incidents reported in the last 30 days on their own status pages by 8 vendors WSO2 lists as subprocessors. A subprocessor list names a company, not the service an incident touched. - 2026-11-12: [Zoom](https://thirdpartyindex.com/vendors/zoom#status), which WSO2 lists as a subprocessor, reported Service Degradation Affecting Outbound SMS Messages for a subset of users in the US region (minor) - 2026-11-11: [Thinkific](https://thirdpartyindex.com/vendors/thinkific#status), which WSO2 lists as a subprocessor, reported Student Dashboard Not Loading Enrolled Course Cards (no impact stated) - 2026-11-10: [Zoom](https://thirdpartyindex.com/vendors/zoom#status), which WSO2 lists as a subprocessor, reported Service Degradation Affecting Zoom Conference Room Connector Services Endpoints in the AMS region. (minor) - 2026-11-10: [Zoom](https://thirdpartyindex.com/vendors/zoom#status), which WSO2 lists as a subprocessor, reported Service Degradation Affecting a subset of users with ZVA and ZoomMate (no impact stated) - 2026-11-09: [Zoom](https://thirdpartyindex.com/vendors/zoom#status), which WSO2 lists as a subprocessor, reported Service Degradation Affecting Zoom Inbound SMS Service in the AU region (minor) - 2026-11-06: [Tailscale](https://thirdpartyindex.com/vendors/tailscale#status), which WSO2 lists as a subprocessor, reported DERP connection issues (minor) - 2026-11-06: [NetSuite](https://thirdpartyindex.com/vendors/netsuite#status), which WSO2 lists as a subprocessor, reported NetSuite Service | UK Newport (critical) - 2026-11-06: [Zoom](https://thirdpartyindex.com/vendors/zoom#status), which WSO2 lists as a subprocessor, reported Service Degradation Affecting Zoom Mail, Calendar and Scheduler. (minor) - 2026-11-05: [Tailscale](https://thirdpartyindex.com/vendors/tailscale#status), which WSO2 lists as a subprocessor, reported Funnel performance degradation (minor) - 2026-11-05: [Amplitude](https://thirdpartyindex.com/vendors/amplitude#status), which WSO2 lists as a subprocessor, reported Session Replay capturing more sessions than configured (minor) - 2026-11-05: [Amplitude](https://thirdpartyindex.com/vendors/amplitude#status), which WSO2 lists as a subprocessor, reported Delayed S3 export (minor) - 2026-11-05: [Aiven](https://thirdpartyindex.com/vendors/aiven#status), which WSO2 lists as a subprocessor, reported API requests failing/timing out (no impact stated) - 2026-11-03: [Zoom](https://thirdpartyindex.com/vendors/zoom#status), which WSO2 lists as a subprocessor, reported Service Degradation Affecting Outbound MMS Services in the US region (minor) - 2026-11-01: [Stripe](https://thirdpartyindex.com/vendors/stripe#status), which WSO2 lists as a subprocessor, reported Elevated Instant Payouts failures (no impact stated) - 2026-10-30: [Tailscale](https://thirdpartyindex.com/vendors/tailscale#status), which WSO2 lists as a subprocessor, reported Coordination service issues (minor) - 2026-10-29: [Thinkific](https://thirdpartyindex.com/vendors/thinkific#status), which WSO2 lists as a subprocessor, reported Learner Hub Is Down - We've Identified the Problem (major) - 2026-10-28: [Stripe](https://thirdpartyindex.com/vendors/stripe#status), which WSO2 lists as a subprocessor, reported Elevated Issuing errors from 17:13 - 20:41 UTC (minor) - 2026-10-28: [Zoom](https://thirdpartyindex.com/vendors/zoom#status), which WSO2 lists as a subprocessor, reported Service Degradation Affecting the Evaluations Acknowledge Button in Zoom Quality Management in the US Region (minor) - 2026-10-27: [Tailscale](https://thirdpartyindex.com/vendors/tailscale#status), which WSO2 lists as a subprocessor, reported Funnel hostnames not resolving in public DNS (minor) - 2026-10-26: [Amplitude](https://thirdpartyindex.com/vendors/amplitude#status), which WSO2 lists as a subprocessor, reported Data Ingestion Delays (minor) - 2026-10-24: [Stripe](https://thirdpartyindex.com/vendors/stripe#status), which WSO2 lists as a subprocessor, reported Elevated Blik errors (no impact stated) - 2026-10-24: [Tailscale](https://thirdpartyindex.com/vendors/tailscale#status), which WSO2 lists as a subprocessor, reported Funnel hostnames not resolving in public DNS (minor) - 2026-10-24: [Amplitude](https://thirdpartyindex.com/vendors/amplitude#status), which WSO2 lists as a subprocessor, reported Delayed/Blocked Event Delivery to Amazon Kinesis Destination (no impact stated) - 2026-10-23: [Zoom](https://thirdpartyindex.com/vendors/zoom#status), which WSO2 lists as a subprocessor, reported Service Degradation Affecting Multiple Zoom Services (minor) - 2026-10-22: [Stripe](https://thirdpartyindex.com/vendors/stripe#status), which WSO2 lists as a subprocessor, reported Elevated Bancontact errors (no impact stated) - 2026-10-22: [Amplitude](https://thirdpartyindex.com/vendors/amplitude#status), which WSO2 lists as a subprocessor, reported Streaming to External Destinations Unavailable (no impact stated) - 2026-10-22: [Amplitude](https://thirdpartyindex.com/vendors/amplitude#status), which WSO2 lists as a subprocessor, reported Amplitude Website Outage (no impact stated) - 2026-10-22: [Amplitude](https://thirdpartyindex.com/vendors/amplitude#status), which WSO2 lists as a subprocessor, reported Notice: Amplitude not impacted by recent PHP vulnerabilities (no impact stated) - 2026-10-22: [Zoom](https://thirdpartyindex.com/vendors/zoom#status), which WSO2 lists as a subprocessor, reported Service Degradation Affecting Zoom Meetings Services in the US. (minor) - 2026-10-22: [Stripe](https://thirdpartyindex.com/vendors/stripe#status), which WSO2 lists as a subprocessor, reported Elevated Bancontact errors (no impact stated) - 2026-10-21: [Zoom](https://thirdpartyindex.com/vendors/zoom#status), which WSO2 lists as a subprocessor, reported Service Degradation Affecting Zoom Learning Webpage (minor) - 2026-10-21: [NetSuite](https://thirdpartyindex.com/vendors/netsuite#status), which WSO2 lists as a subprocessor, reported NetSuite Email | Multiple Regions (major) - 2026-10-20: [Amplitude](https://thirdpartyindex.com/vendors/amplitude#status), which WSO2 lists as a subprocessor, reported Export API returns 500 errors across multiple organizations (minor) - 2026-10-20: [Stripe](https://thirdpartyindex.com/vendors/stripe#status), which WSO2 lists as a subprocessor, reported Spike in cancellations and expired errors with PayByBank payments (no impact stated) - 2026-10-20: [MongoDB](https://thirdpartyindex.com/vendors/mongodb#status), which WSO2 lists as a subprocessor, reported GCP Availability Zone europe-west2-b connectivity issues (minor) - 2026-10-20: [Stripe](https://thirdpartyindex.com/vendors/stripe#status), which WSO2 lists as a subprocessor, reported Elevated Revolut Pay errors (no impact stated) - 2026-10-20: [Aiven](https://thirdpartyindex.com/vendors/aiven#status), which WSO2 lists as a subprocessor, reported Google Cloud VPN incident affecting services (minor) - 2026-10-19: [Zoom](https://thirdpartyindex.com/vendors/zoom#status), which WSO2 lists as a subprocessor, reported Service Degradation Affecting Meeting Summaries Via Email. (minor) - 2026-10-19: [Zoom](https://thirdpartyindex.com/vendors/zoom#status), which WSO2 lists as a subprocessor, reported Service Degradation Affecting Zoom Website in UK region (minor) - 2026-10-19: [Zoom](https://thirdpartyindex.com/vendors/zoom#status), which WSO2 lists as a subprocessor, reported Service Degradation Affecting ZP SMS Australia Mobile Numbers (no impact stated) - 2026-10-18: [Aiven](https://thirdpartyindex.com/vendors/aiven#status), which WSO2 lists as a subprocessor, reported Unable to spin up nodes in vultr-ewr (no impact stated) - 2026-10-17: [Amplitude](https://thirdpartyindex.com/vendors/amplitude#status), which WSO2 lists as a subprocessor, reported We are actively investigating an issue with our ingestion systems lagging (minor) - 2026-10-17: [Zoom](https://thirdpartyindex.com/vendors/zoom#status), which WSO2 lists as a subprocessor, reported Service Degradation Affecting Zoom Chat Compose and SMS Summarisation with AI Companion (minor) - 2026-10-16: [Aiven](https://thirdpartyindex.com/vendors/aiven#status), which WSO2 lists as a subprocessor, reported Issues starting new service nodes (no impact stated) - 2026-10-15: [Stripe](https://thirdpartyindex.com/vendors/stripe#status), which WSO2 lists as a subprocessor, reported Elevated declines on Mastercard (no impact stated) - 2026-10-15: [Stripe](https://thirdpartyindex.com/vendors/stripe#status), which WSO2 lists as a subprocessor, reported Elevated declines on Visa (no impact stated) - 2026-10-15: [Stripe](https://thirdpartyindex.com/vendors/stripe#status), which WSO2 lists as a subprocessor, reported Elevated Amazon Pay errors (no impact stated) - 2026-10-14: [Zoom](https://thirdpartyindex.com/vendors/zoom#status), which WSO2 lists as a subprocessor, reported Service degradation affected Zoom AI Companion in US region (no impact stated) - 2026-10-14: [Zoom](https://thirdpartyindex.com/vendors/zoom#status), which WSO2 lists as a subprocessor, reported Service Degradation Affected Sandbox Creation in ZoomMate (no impact stated) - 2026-10-14: [Zoom](https://thirdpartyindex.com/vendors/zoom#status), which WSO2 lists as a subprocessor, reported Service Degradation Affecting Zoom Clips (minor) - 2026-10-13: [Amplitude](https://thirdpartyindex.com/vendors/amplitude#status), which WSO2 lists as a subprocessor, reported Degraded Performance- Funnel charts renders as white text on a white/near-white background in light theme (no impact stated) - 2026-10-13: [Zoom](https://thirdpartyindex.com/vendors/zoom#status), which WSO2 lists as a subprocessor, reported Service degradation affecting Zoom Meeting API in US region (no impact stated) The subprocessor list as we read it on any date: https://thirdpartyindex.com/labs/time-machine/wso2 --- Third Party Index (https://thirdpartyindex.com) monitors vendors' public security and privacy documents and keeps each version as evidence. Data CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/); vendors' own documents are theirs. API: https://thirdpartyindex.com/api