How many subprocessors does Infisical use?

Infisical lists 17 subprocessors on its published list, including AWS, ClickHouse, Cloudflare, Datadog, and Gong.io and 12 more.

Where does Infisical process customer data?

The subprocessors named by Infisical are located in United States, as stated on its list.

How quickly does Infisical report a personal data breach to customers?

According to its DPA, Infisical reports a personal data breach to customers within 72 hours: “Company will notify Customer in writing without undue delay, and in any event within seventy-two (72) hours, after Company becomes aware of a Security Incident.”

How much notice does Infisical give before adding a subprocessor?

Infisical's DPA gives 30 days' notice of a new subprocessor, the time customers have to object: “Company will provide Customer with at least thirty (30) days' advance notice of any material addition, replacement, or removal of a Sub-processor that will Process Customer Personal Data”

How does Infisical transfer personal data outside the EU?

Infisical's DPA relies on standard contractual clauses: “the parties agree to be bound by the SCCs, incorporated by reference into this DPA”

When was Infisical's subprocessor list last checked?

ClauseTrail last checked Infisical's subprocessor list on September 28, 2026. Lists are re-checked daily.

How do I find out when Infisical adds or removes a subprocessor?

ClauseTrail monitors Infisical's subprocessor list, DPA, privacy policy and terms and emails you the exact change — who was added or removed and what the page said before and after. The first vendors are free.

Infisical Subprocessors List (September 2026): Changes and History

Infisical names 17 subprocessors on its published list. Read from the vendor's own page and re-checked daily.

Last checked September 28, 2026 Official source ↗

Infisical subprocessors (September 2026)

#	Subprocessor	Purpose	Location
1	AWS	Infisical is supported using resources and services provided by AWS.	United States
2	ClickHouse	Infisical uses ClickHouse to store audit logs generated by the Products.	United States
3	Cloudflare	Infisical uses Cloudflare for network security and content delivery services.	United States
4	Datadog	Infisical uses Datadog for infrastructure monitoring.	United States
5	Gong.io	Infisical uses Gong.io to support sales-related activities.	United States
6	Google	Customers may choose to contact Infisical via email. Infisical uses Google as its primary email service provider. Infisical does not require nor encourage disclosure of Personal Data via email, however the potential for Personal Data being transmitted to Infisical remains.	United States
7	Google Cloud	Infisical uses Google Cloud to store disaster recovery backups.	United States
8	Hex	Infisical uses Hex for data analytics.	United States
9	Linear	Infisical utilizes Linear to help track projects and manage tasks.	United States
10	Loops.so	Infisical uses Loops.so to assist with user engagement and communication workflows.	United States
11	Posthog	Infisical utilizes Posthog for event analytics purposes in order to improve user experience.	United States
12	Pylon	Infisical uses Pylon for customer support services.	United States
13	Salesforce	Infisical uses Salesforce to help manage customer and business relationships.	United States
14	SendGrid	Infisical uses SendGrid to deliver transactional and notification email to users of the Products.	United States
15	Slack	Infisical uses Slack for internal and external communication.	United States
16	Stripe	Infisical utilizes Stripe to process credit cards and payments.	United States
17	Zoom	Infisical uses Zoom to conduct virtual meetings.	United States

Get an email when Infisical changes its subprocessors

ClauseTrail re-checks this list every day and tells you exactly who was added or removed — including when a vendor starts sending data to an AI provider. The first vendors are free.

Track Infisical free

Key DPA terms at Infisical

What Infisical's data processing agreement commits to, with the sentence each answer comes from. SCCs or the Data Privacy Framework: what's the difference?

Breach notification: Within 72 hours

“Company will notify Customer in writing without undue delay, and in any event within seventy-two (72) hours, after Company becomes aware of a Security Incident.”
DPA, infisical.com ↗
Notice of a new subprocessor: 30 days ahead

“Company will provide Customer with at least thirty (30) days' advance notice of any material addition, replacement, or removal of a Sub-processor that will Process Customer Personal Data”
DPA, infisical.com ↗
Transfers outside the EU: Standard contractual clauses

“the parties agree to be bound by the SCCs, incorporated by reference into this DPA”
DPA, infisical.com ↗
Customer data after the contract ends: Deleted within 60 days of the contract ending

“In either case, Company will use commercially reasonable efforts to complete the action within sixty (60) days.”
DPA, infisical.com ↗
Audit rights: Through certifications and audit reports only

“Company's most recent independent security audit report or assessment (such as a SOC 2 audit report or ISO 27001 certification), where Company maintains one, together with Company's security documentation at the Trust Center, serves as the primary means of demonstrating compliance with this DPA.”
DPA, infisical.com ↗

Documents we track for Infisical

DPA: checked September 28, 2026 infisical.com ↗
Privacy policy: checked September 28, 2026 infisical.com ↗
Subprocessor list: checked September 28, 2026 infisical.com ↗
Terms of service: checked September 28, 2026 infisical.com ↗
Trust page: checked September 28, 2026 infisical.com ↗

Change history

Tracking since September 28, 2026. No change has been published since; additions, removals and document changes will appear here as they're published.

Infisical subprocessors FAQ

How many subprocessors does Infisical use?: Infisical lists 17 subprocessors on its published list, including AWS, ClickHouse, Cloudflare, Datadog, and Gong.io and 12 more.
Where does Infisical process customer data?: The subprocessors named by Infisical are located in United States, as stated on its list.
How quickly does Infisical report a personal data breach to customers?: According to its DPA, Infisical reports a personal data breach to customers within 72 hours: “Company will notify Customer in writing without undue delay, and in any event within seventy-two (72) hours, after Company becomes aware of a Security Incident.”
How much notice does Infisical give before adding a subprocessor?: Infisical's DPA gives 30 days' notice of a new subprocessor, the time customers have to object: “Company will provide Customer with at least thirty (30) days' advance notice of any material addition, replacement, or removal of a Sub-processor that will Process Customer Personal Data”
How does Infisical transfer personal data outside the EU?: Infisical's DPA relies on standard contractual clauses: “the parties agree to be bound by the SCCs, incorporated by reference into this DPA”
When was Infisical's subprocessor list last checked?: ClauseTrail last checked Infisical's subprocessor list on September 28, 2026. Lists are re-checked daily.
How do I find out when Infisical adds or removes a subprocessor?: ClauseTrail monitors Infisical's subprocessor list, DPA, privacy policy and terms and emails you the exact change — who was added or removed and what the page said before and after. The first vendors are free.