WSO2 Sub-Processor List
Last updated date: April 7, 2026
This sub-processor list includes only those sub-processors that are engaged by WSO2 and are involved in the provision of the intended services to the customer.
As part of the service being provided under each solution, data may be shared with other WSO2 products/offerings. Such instances will not be listed here.
Sub-processors that are common across multiple products are listed under the “Infrastructure Service Provider” category.
Third party services facilitated by WSO2 at customer request are not WSO2 sub-processors. Contractual relationship remains directly between customer and third party.
Transfer of personal data between WSO2 subsidiaries and affiliate companies is in accordance with the transfer mechanisms specified under Art. 46 of the GDPR.
When you create a public cloud subscription, your organization administrator user details will be collected and processed by WSO2 for subscription and support services.
The following sub-processors would be involved. Please note that your end user or business user data will not be stored within any of the platforms listed below.
Furthermore, when you visit wso2.com to access documentation or use the contact us forms, the following sub-processors get involved.
Filter by
Product |
Infrastructure Service Sub-Processors
Sub-processor |
Purpose of processing |
Categories of data subjects |
Location |
| Microsoft Azure | To host WSO2 public cloud services. | Public cloud subscriber data, including administrator profiles and end-user profiles. | Global |
| AWS* | To host WSO2 public cloud services. | Public cloud subscriber data, including end-user profiles. | Global |
| Google Cloud Platform* | To host WSO2 public cloud services. | Public cloud subscriber data, including end-user profiles. | Global |
*Processed when opting for data planes or services offered by these optional CSP.
Identity Platform Sub-Processors
Sub-processor |
Purpose of processing |
Categories of data subjects |
Location |
| VirusTotal | To protect WSO2 systems and services against malware and bad actors. | Any request to WSO2 websites and public cloud services that are flagged by the security monitoring solutions in place for anomalies or suspicious or malicious. | USA |
| Google Inc (Google reCAPTCHA) | To protect logins and forms from bots. | Those who log in to Asgardeo. | USA |
Developer Platform Sub-Processors
Sub-processor |
Purpose of processing |
Categories of data subjects |
Location |
| VirusTotal | To protect WSO2 systems and services against malware and bad actors. | Any request to WSO2 websites and services that are flagged by the security monitoring solutions in place for anomalies or suspicious or malicious. | USA |
| Google Inc (Google reCAPTCHA) | To protect logins and forms from bots. | Those who log in to Asgardeo. | USA |
| MongoDB, Inc. | To host cloud metadata. | Those who publish APIs on Developer Platform. | USA |
| Aiven | To provide a database as a service for Developer Platform subscribers. | Those who consume Developer Platform database as a service. | USA and EU |
| Amplitude | For the performance and analytics purposes of Developer Platform. | Those who have interacted with Developer Platform Console. | USA and EU |
API Platform Sub-Processors
Sub-processor |
Purpose of processing |
Categories of data subjects |
Location |
| MongoDB, Inc. | To host cloud metadata. | Those who publish APIs on API Platform. | USA |
| VirusTotal | To protect WSO2 systems and services against malware and bad actors. | Any request to WSO2 websites and services that are flagged by the security monitoring solutions in place for anomalies or suspicious or malicious. | USA |
| Google Inc (Google reCAPTCHA) | To protect logins and forms from bots. | Those who log in to Asgardeo. | USA |
| TailScale | To provide a secure VPN tunnel to transfer data. | Public cloud subscriber data, including end-user profiles. | Global |
Integration Platform Sub-Processors
Sub-processor |
Purpose of processing |
Categories of data subjects |
Location |
| MongoDB, Inc. | To host cloud metadata. | Those who publish APIs on Integration Platform. | USA |
| VirusTotal | To protect WSO2 systems and services against malware and bad actors. | Any request to WSO2 websites and services that are flagged by the security monitoring solutions in place for anomalies or suspicious or malicious. | USA |
| Aiven | To provide a database as a service for Developer Platform subscribers. | Those who consume Integration Platform database as a service. | USA and EU |
| Google Inc (Google reCAPTCHA) | To protect logins and forms from bots. | Those who log in to Asgardeo. | USA |
| Amplitude | For the performance and analytics purposes of Developer Platform. | Those who have interacted with Integration Platform Console. | USA and EU |
| TailScale | To provide a secure VPN tunnel to transfer data. | Public cloud subscriber data, including end-user profiles. | Global |
WSO2 Sub-Processors
Sub-processor |
Purpose of processing |
Categories of data subjects |
Location |
| Pardot | For sending notifications to subscribers and managing communication preferences. | Those who have filled out any form on the WSO2 website. | USA |
| ServiceNow | For providing support services to subscribers and managing support cases. | Employees of the subscribers involved in raising support tickets through the support portal. | USA |
| Google Inc (Google Workspaces) | For communicating and collaborating with subscribers and potential subscribers. | Employees of the subscribers involved in communications with WSO2. | Global |
| Open AI | To provide AI model services (LLM processing) to power an AI-powered programming assistant. | Customers, end-users submitting prompts, and possibly employees if prompts contain identifiers. | Global |
| Anthropic | To provide code generation for API SDK generation in the Developer Portal. | Customers, end-users submitting prompts, and possibly employees if prompts contain identifiers. | USA |
Optional Sub-Processors
Sub-processor |
Purpose of processing |
Categories of data subjects |
Location |
| TalentLMS | For providing WSO2 training and product exams. | Those who undergo WSO2 training and exams. | USA |
| Silicon Valley Bank Payment Gateway | To facilitate card payments to purchase WSO2 services. | Those who make payments using online payment options. | USA |
| Stripe | To facilitate card payments to purchase WSO2 services. | Subscribers who are making online payments. | USA |
| Netsuite | For subscriber invoicing and internal finance systems. | Employees of the subscribers involved in the procurement or renewal of subscriptions. | USA |