# Zscaler Zscaler declares [9 subprocessors](https://thirdpartyindex.com/vendors/zscaler#subprocessors) in [its subprocessor list](https://trust.zscaler.com/notifications/sub-processor), which we last checked on 2026-11-11 ([evidence](https://thirdpartyindex.com/evidence/171702)). They include [Amazon Web Services](https://thirdpartyindex.com/vendors/amazon-web-services), [Google Cloud](https://thirdpartyindex.com/vendors/google-cloud) and [SendSafely](https://thirdpartyindex.com/vendors/sendsafely). No published changes since we first read it on 2026-09-21. [4 tracked vendors](https://thirdpartyindex.com/vendors/zscaler#used-by) name Zscaler as a subprocessor, including [Digital Realty](https://thirdpartyindex.com/vendors/digital-realty), [Lattice](https://thirdpartyindex.com/vendors/lattice) and [Accruent](https://thirdpartyindex.com/vendors/accruent). Zscaler (zscaler.com): subprocessors, data processing agreement, security documents and changes, as monitored by Third Party Index. - Page: https://thirdpartyindex.com/vendors/zscaler - Documents last verified: 2026-11-11 - Transparency rating: 82/100 (how much it publishes, not how secure it is): Subprocessor list 30/30; Processing locations 8/8; Purposes 0/7 (partial); Data processing addendum 12/12; Trust center 8/8; Privacy policy 6/6; security.txt 0/6 (not found); Security page 5/5; Status page 0/5 (not found); Vulnerability disclosure 5/5; Pages still reachable 8/8 - Supply chain: relies on 5 tracked vendors directly, 49 within two hops, 212 within three; 4 tracked vendors rely on it directly, 18 within two hops, 1107 within three - Cite as: Zscaler, Third Party Index, https://thirdpartyindex.com/vendors/zscaler (data CC BY 4.0) ## Documents | Document | URL | Last verified | Last changed | |---|---|---|---| | Trust center | https://trust.zscaler.com/zscaler.net | 2026-11-11 | 2026-11-11 | | Subprocessor list | https://trust.zscaler.com/notifications/sub-processor | 2026-11-11 | 2026-10-28 | | Data processing addendum | https://www.zscaler.com:443/privacy-compliance/dpa | 2026-11-11 | 2026-09-21 | | Privacy policy | https://www.zscaler.com:443/privacy-compliance/overview | 2026-11-11 | 2026-09-21 | | Terms | https://www.zscaler.com/privacy-compliance/cookie-policy | 2026-11-11 | 2026-09-21 | | Security page | https://www.zscaler.com:443/security/vulnerability-disclosure-program | 2026-11-11 | 2026-09-21 | | Security advisories | https://www.zscaler.com:443/security-advisories | 2026-11-11 | 2026-09-21 | ## Subprocessors (9) As its own list states them. | Subprocessor | Purpose | Location | Listed since | |---|---|---|---| | [Amazon Web Services](https://thirdpartyindex.com/vendors/amazon-web-services.md) | — | United States, European Union, Australia, Canada, Singapore, or India | 2026-10-28 | | Centracomm Communications | — | Ohio, USA | 2026-09-21 | | [Concentrix](https://thirdpartyindex.com/vendors/concentrix.md) | — | Sofia, Bulgaria and Chennai, India | 2026-09-21 | | [Google Cloud Platform](https://thirdpartyindex.com/vendors/google-cloud.md) | — | United States & European Union | 2026-10-06 | | iOpex Technologies | — | Wroclaw and Krakow, Poland, and Bangalore and Chennai, India | 2026-09-21 | | JTP CO | — | Japan | 2026-09-21 | | [Momentum Labs, Inc.](https://thirdpartyindex.com/vendors/momentum.md) | — | United States | 2026-09-21 | | [SendSafely Inc.](https://thirdpartyindex.com/vendors/sendsafely.md) | — | United States | 2026-09-21 | | theLoopsai Inc. | — | United States | 2026-09-21 | Read from ([evidence](https://thirdpartyindex.com/evidence/171702)). CSV: https://thirdpartyindex.com/vendors/zscaler/subprocessors.csv ## Compliance As its trust center lists them. - FedRAMP Marketplace: Moderate · 21 agency authorizations · since Dec 14, 2018 - FedRAMP Marketplace: High · 14 agency authorizations · since Jul 2, 2022 - FedRAMP Marketplace: Moderate · 18 agency authorizations · since Nov 7, 2022 - FedRAMP Marketplace: High · 24 agency authorizations · since Apr 29, 2020 ## Security program What Zscaler, Inc.'s Form 10-K for fiscal 2026, filed Sep 3, 2026 (Item 1C) says, in its words (https://www.sec.gov/Archives/edgar/data/1713683/000171368326000157/0001713683-26-000157-index.htm). - Led by: Chief Security Officer - Board oversight: Audit Committee, Security Committee - Practices named: Incident response plan, Penetration testing, Threat intelligence - Engages outside assessors or consultants - Reviews its suppliers' security - Says no cybersecurity incident has materially affected it ## Web Technologies Zscaler's homepage made 210 requests to 5 domains, and 4 services controlled by another company. Loaded on 2026-11-04 by a browser that accepted nothing; other visits may load more or less. What a page loads is not a list of who receives customer data. 4 third parties by category: Tag managers 1 (Google Cloud); Marketing automation 1 (Storylane); Cookie compliance 1 (Relyance Inc.); Accessibility 1 (reviewed: accessiBe). Each company that appears controlled by another organization is counted once, under the main category of the technologies detected from it on this homepage or, when none was, the category recorded from the company's own page (marked reviewed) or else the one it is usually detected as on other published homepages (marked as such); unclassified: none of these. ### Third parties (4) - Relyance Inc.: 8 requests to relyance.ai; Relyance AI - accessiBe: 2 requests to acsbapp.com - Google Cloud: 1 request to googletagmanager.com; Google Tag Manager (its subprocessor list names it too) - Storylane: 1 request to storylane.io; Storylane 1 ### First party (1) - Zscaler: 198 requests to zscaler.com; AccessiBe, Cloudflare, HSTS, Next.js 16.4.0, Open Graph, Priority Hints, React, Swiper, Webpack 2 tracked companies loaded by the homepage are not in Zscaler's subprocessor list. A website can use a service without it processing customer data. ## Subprocessor of (4) Tracked vendors whose own subprocessor lists name it, and what they say they use it for. - [Accruent](https://thirdpartyindex.com/vendors/accruent.md): InfoSec Partner - [Arvato Systems](https://thirdpartyindex.com/vendors/arvato-systems.md): PaaS Webaccess (Proxy) - [Digital Realty](https://thirdpartyindex.com/vendors/digital-realty.md): Data Loss Prevention - [Lattice](https://thirdpartyindex.com/vendors/lattice.md): Data loss prevention and monitoring ## Recent changes Changes to its documents and subprocessor list since monitoring began. - 2026-10-22: Changed registry listing: fedramp:FR1719759604 ([evidence](https://thirdpartyindex.com/evidence/141337)) - 2026-10-22: Changed registry listing: fedramp:FR2227062482 ([evidence](https://thirdpartyindex.com/evidence/141337)) - 2026-10-08: Changed registry listing: fedramp:FR1719759604 ([evidence](https://thirdpartyindex.com/evidence/67847)) - 2026-10-08: Changed registry listing: fedramp:FR1720454205 ([evidence](https://thirdpartyindex.com/evidence/67847)) - 2026-10-08: Changed registry listing: fedramp:FR2219763604 ([evidence](https://thirdpartyindex.com/evidence/67847)) Feed: https://thirdpartyindex.com/vendors/zscaler/changes.atom The subprocessor list as we read it on any date: https://thirdpartyindex.com/labs/time-machine/zscaler --- Third Party Index (https://thirdpartyindex.com) monitors vendors' public security and privacy documents and keeps each version as evidence. Data CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/); vendors' own documents are theirs. API: https://thirdpartyindex.com/api