How many subprocessors does CircleCI use?

CircleCI lists 8 subprocessors on its published list, including Role Definition, Regulatory Compliance, Vendor and Subprocessor Management, Data Security, and Access Restrictions and 3 more.

Does CircleCI use customer data to train AI models?

According to its AI terms, CircleCI uses customer data to train AI models unless customers opt out: “You acknowledge and agree that we may process, store, and otherwise use Your Data/Customer Data to build, and improve existing and new versions of the Services and Al Features, unless you expressly opt out with written notice to us.”

When was CircleCI's subprocessor list last checked?

ClauseTrail last checked CircleCI's subprocessor list on September 26, 2026. Lists are re-checked daily.

How do I find out when CircleCI adds or removes a subprocessor?

ClauseTrail monitors CircleCI's subprocessor list, DPA, privacy policy and terms and emails you the exact change — who was added or removed and what the page said before and after. The first vendors are free.

CircleCI Subprocessors List (September 2026): Changes and History

CircleCI names 8 subprocessors on its published list. Read from the vendor's own page and re-checked daily.

Last checked September 26, 2026 Official source ↗

CircleCI subprocessors (September 2026)

#	Subprocessor	Purpose	Location
1	Role Definition	CircleCI acts as a data processor, processing personal data only on instructions from the customer (who acts as the data controller).	—
2	Regulatory Compliance	The DPA incorporates requirements from privacy laws, including GDPR and CCPA/CPRA, and details mechanisms for cross-border data transfers such as the use of standard contractual clauses for lawful transfers from the EEA.	—
3	Vendor and Subprocessor Management	CircleCI uses third-party vendors (sub-processors) to provide its services. All vendors with access to customer data must complete security questionnaires, sign Data Processing Addendums, and comply with applicable privacy laws. A current list of sub-processors, together with their data processing jurisdictions, is maintained and publicly accessible.	—
4	Data Security	The DPA ensures that customer data is protected through technical and organizational safeguards, including robust encryption (AES-256-GCM96 at rest, TLS/HTTPS in transit), strict access controls, audit logging, and data segregation. Customer data is primarily stored within the United States.	—
5	Access Restrictions	Only authorized engineers, support staff, and customer success managers have access to customer data, with all access logged and reviewed.	—
6	Data Retention and Disposal	Data is retained and disposed of in line with policies aligned with legal obligations and customer expectations.	—
7	Customer Rights	The DPA recognizes customer rights to instruct, access, and manage personal data processing, and elaborates on procedures for data subject requests enforced under GDPR and CCPA.	—
8	No Removable Media	Customer data is not persisted on removable media.	—

Get an email when CircleCI changes its subprocessors

ClauseTrail re-checks this list every day and tells you exactly who was added or removed — including when a vendor starts sending data to an AI provider. The first vendors are free.

Track CircleCI free

AI and customer data at CircleCI

What CircleCI's own documents say, with the sentence each answer comes from.

Trains AI models on customer data: Yes, unless you opt out

“You acknowledge and agree that we may process, store, and otherwise use Your Data/Customer Data to build, and improve existing and new versions of the Services and Al Features, unless you expressly opt out with written notice to us.”
AI terms, circleci.com ↗
Sends customer data to AI model providers: Yes

“CircleCI will transmit the Inputs submitted to the Services to CircleCI's AI Providers.”
Privacy policy, circleci.com ↗
How to opt out: Customers can opt out of CircleCI using their data to train or improve AI Features by sending written notice to CircleCI.

“unless you expressly opt out with written notice to us”
AI terms, circleci.com ↗
How long AI features keep data: CircleCI is not obligated to keep, store, or maintain any Input or Output processed by the AI Features.

“CircleCI is under no obligation to keep, store, or maintain any Input or Output that has been processed by the AI Features.”
AI terms, circleci.com ↗

Documents we track for CircleCI

AI terms: checked September 26, 2026 circleci.com ↗
Privacy policy: checked September 26, 2026 circleci.com ↗
Subprocessor list: checked September 26, 2026 trust.circleci.com ↗
Terms of service: checked September 26, 2026 circleci.com ↗

Change history

Tracking since September 26, 2026. No change has been published since; additions, removals and document changes will appear here as they're published.

CircleCI subprocessors FAQ

How many subprocessors does CircleCI use?: CircleCI lists 8 subprocessors on its published list, including Role Definition, Regulatory Compliance, Vendor and Subprocessor Management, Data Security, and Access Restrictions and 3 more.
Does CircleCI use customer data to train AI models?: According to its AI terms, CircleCI uses customer data to train AI models unless customers opt out: “You acknowledge and agree that we may process, store, and otherwise use Your Data/Customer Data to build, and improve existing and new versions of the Services and Al Features, unless you expressly opt out with written notice to us.”
When was CircleCI's subprocessor list last checked?: ClauseTrail last checked CircleCI's subprocessor list on September 26, 2026. Lists are re-checked daily.
How do I find out when CircleCI adds or removes a subprocessor?: ClauseTrail monitors CircleCI's subprocessor list, DPA, privacy policy and terms and emails you the exact change — who was added or removed and what the page said before and after. The first vendors are free.