How many subprocessors does Bugcrowd use?

Bugcrowd lists 18 subprocessors on its published list, including Datadog, Mailgun Technologies, Inc., Outreach, DocuSign, and Salesforce and 13 more.

Where does Bugcrowd process customer data?

The subprocessors named by Bugcrowd are located in California, USA, Washington, USA, Massachusetts, USA, New York, USA, Tel Aviv, Israel, and Texas, USA and 1 other locations, as stated on its list.

Does Bugcrowd have a SOC 2 Type II report?

Yes. Bugcrowd's trust page lists a SOC 2 Type II report: “SOC 2 Type 2”

Which security certifications does Bugcrowd list?

Bugcrowd's trust page lists SOC 2 Type II, ISO 27001, EU–US Data Privacy Framework, FedRAMP, and CSA STAR.

When was Bugcrowd's subprocessor list last checked?

ClauseTrail last checked Bugcrowd's subprocessor list on September 28, 2026. Lists are re-checked daily.

How do I find out when Bugcrowd adds or removes a subprocessor?

ClauseTrail monitors Bugcrowd's subprocessor list, DPA, privacy policy and terms and emails you the exact change — who was added or removed and what the page said before and after. The first vendors are free.

Bugcrowd Subprocessors List (September 2026): Changes and History

Bugcrowd names 18 subprocessors on its published list. Read from the vendor's own page and re-checked daily.

Last checked September 28, 2026 Official source ↗

Bugcrowd subprocessors (September 2026)

#	Subprocessor	Purpose	Location	Data
1	Datadog	Browser client IP, login activity, and accidental PII	New York, USA	Browser client IP, login activity, accidental PII
2	Mailgun Technologies, Inc.	Email Address	Texas, USA	Email Address
3	Outreach	Email Address	Washington, USA	Email Address
4	DocuSign	Tax Documents, NDA's, etc...	California, USA	Tax Documents, NDA's, etc...
5	Salesforce	Various Contact Details	California, USA	Various Contact Details
6	Clari	Email Address	California, USA	Email Address
7	Adobe Marketo Engage	Email Address	California, USA	Email Address
8	Personyze	Email Address	Tel Aviv, Israel	Email Address
9	GoTo	Email Addresses for Webinars	Massachusetts, USA	Email Addresses
10	Heap	IP and browsing history on-site	California, USA	IP, browsing history on-site
11	Seismic	Email Address	California, USA	Email Address
12	Google Analytics	IP and browsing history on-site	California, USA	IP, browsing history on-site
13	Gainsight	Email, activities on platform	California, USA	Email, activities on platform
14	Amazon Web Services (AWS)	Broad Processing Activities	Washington, USA, or (if agreed by the parties) Frankfurt, Germany	—
15	Google	email, document sharing, form response collection	California, USA	email, document sharing, form response collection
16	Segment	Email, IP, and browsing history on-site	California, USA	Email, IP, browsing history on-site
17	HelloFax	Employee information over fax	California, USA	Employee information
18	Tableau	Researchers#prime	Washington, USA	Researchers#prime

Get an email when Bugcrowd changes its subprocessors

ClauseTrail re-checks this list every day and tells you exactly who was added or removed — including when a vendor starts sending data to an AI provider. The first vendors are free.

Track Bugcrowd free

Certifications at Bugcrowd

What Bugcrowd's trust page lists, with the text each one comes from. SOC 2 Type I or Type II: what's the difference?

SOC 2 Type II: Active

“SOC 2 Type 2”
Trust page, trust.bugcrowd.com ↗
ISO 27001: Active

“ISO/IEC 27001:2022”
Trust page, trust.bugcrowd.com ↗
EU–US Data Privacy Framework: Active

“Certified EU-U.S. Data Privacy Framework”
Trust page, trust.bugcrowd.com ↗
FedRAMP: Active

“FedRAMP Moderate”
Trust page, trust.bugcrowd.com ↗
CSA STAR: Active

“CSA STAR Level 1”
Trust page, trust.bugcrowd.com ↗

Documents we track for Bugcrowd

DPA: checked September 28, 2026 www.bugcrowd.com ↗
Privacy policy: checked September 28, 2026 www.bugcrowd.com ↗
Subprocessor list: checked September 28, 2026 trust.bugcrowd.com ↗
Terms of service: checked September 28, 2026 www.bugcrowd.com ↗
Trust page: checked September 28, 2026 trust.bugcrowd.com ↗

Change history

Tracking since September 28, 2026. No change has been published since; additions, removals and document changes will appear here as they're published.

Bugcrowd subprocessors FAQ

How many subprocessors does Bugcrowd use?: Bugcrowd lists 18 subprocessors on its published list, including Datadog, Mailgun Technologies, Inc., Outreach, DocuSign, and Salesforce and 13 more.
Where does Bugcrowd process customer data?: The subprocessors named by Bugcrowd are located in California, USA, Washington, USA, Massachusetts, USA, New York, USA, Tel Aviv, Israel, and Texas, USA and 1 other locations, as stated on its list.
Does Bugcrowd have a SOC 2 Type II report?: Yes. Bugcrowd's trust page lists a SOC 2 Type II report: “SOC 2 Type 2”
Which security certifications does Bugcrowd list?: Bugcrowd's trust page lists SOC 2 Type II, ISO 27001, EU–US Data Privacy Framework, FedRAMP, and CSA STAR.
When was Bugcrowd's subprocessor list last checked?: ClauseTrail last checked Bugcrowd's subprocessor list on September 28, 2026. Lists are re-checked daily.
How do I find out when Bugcrowd adds or removes a subprocessor?: ClauseTrail monitors Bugcrowd's subprocessor list, DPA, privacy policy and terms and emails you the exact change — who was added or removed and what the page said before and after. The first vendors are free.