LastPass Subprocessors List (November 2026): Changes and History
LastPass names 26 subprocessors on its published list. Read from the vendor's own page and re-checked daily.
Last checked November 2, 2026
Official source ↗
LastPass subprocessors (November 2026)
| # | Subprocessor | Purpose | Location | Data |
|---|---|---|---|---|
| 1 | (Virginia) | — | Cloud hosting Provider (US only) | Vault/Customer Content Amazon Web Services via US-East-1 |
| 2 | Amazon Web Services via US-East-1 (Virginia) | — | Cloud hosting Provider (US only) | Unified Admin Console |
| 3 | Microsoft Azure US-East (Virginia) and US-West (California) | — | — | Identity Users |
| 4 | AP-South-1 (India), AP-Southeast-1 (Singapore) and AP-Southeast-2 (Australia) | — | — | Vault/Customer Content Amazon Web Services via |
| 5 | Akamai Technologies, Inc. | Global Traffic Management (GTM) and DDoS protection services Note: No Customer Content/Vault Data is stored the nearest edge server by Akamai Technologies | Global | — |
| 6 | Amplitude Inc. | Product Performance Analytics | United States | — |
| 7 | CyberSource Corporation | Export compliance and Fraud Prevention System | United States | — |
| 8 | DataBricks, Inc. | Cloud Data Platform | United States | — |
| 9 | DataDog, Inc. | Observability platform used for cloud application monitoring, logging, and analytics | United States | — |
| 10 | PasswordPing, Ltd. | User credential security webmonitoring (known as dark-webmonitoring) see the LastPass support page here:nitoring, https://www.lastpass.com/features/dark-webmonitoring | United States | — |
| 11 | Pendo.io, Inc. | In-product messaging, user experience guide and onboarding platform | United States, United Kingdom, Israel | — |
| 12 | Segment.io, Inc. | Data Governance Control Platform | United States | — |
| 13 | Splunk, Inc. | Security monitoring, logging, and analytics | United States | — |
| 14 | Twilio, Inc. (SendGrid) | Product-related email and text (SMS) notification service (when enrolled in SMS account recovery) | United States | — |
| 15 | Drift.com, Inc. | Customer Chat and Support Service | United States | — |
| 16 | Gainsight, Inc. | Customer Experience Management | United States | — |
| 17 | Gong.io Ltd. | Sales Call Recording and Training | United States | — |
| 18 | Google, Inc. | Business and Crash Analytics | United States | — |
| 19 | Marketo, Inc. | Customer Engagement Management and Automation | United States | — |
| 20 | Oracle Corporation (NetSuite) | Billing and Accounting | United States | — |
| 21 | Salesforce, Inc. | CRM | United States | — |
| 22 | Skilljar Inc. | Customer Training Platform | United States | — |
| 23 | Slack, Inc. | Customer Support and | United States | — |
| 24 | Stripe, Inc. | Communication Payment Processing | United States | — |
| 25 | SurveyMonkey, Inc. | User feedback | United States | — |
| 26 | YayPay Inc. | Accounts Receivable Customer Relationship Management System | United States | — |
Get an email when LastPass changes its subprocessors
ClauseTrail re-checks this list every day and tells you exactly who was added or removed — including when a vendor starts sending data to an AI provider. The first vendors are free.
Key DPA terms at LastPass
What LastPass's data processing agreement commits to, with the sentence each answer comes from. SCCs or the Data Privacy Framework: what's the difference?
- Breach notification
-
Within 72 hours
“LastPass maintains security incident management policies and procedures, as further specified in the Technical and Organizational Measures, and shall notify Customer, without undue delay, but not to exceed 72 hours, after becoming aware of a Security Incident.”
DPA, www.lastpass.com ↗ - Notice of a new subprocessor
-
15 days ahead
“LastPass shall inform Customer of any new Sub-processors by providing an updated disclosure on its Trust and Privacy Center at https://www.lastpass.com/trustcenter/resources as well as via e-mail no less than fifteen (15) business days before authorizing such Sub-processors to Process Customer Personal Data in connection with the provision of the applicable Services.”
DPA, www.lastpass.com ↗ - Transfers outside the EU
-
Standard contractual clauses and the EU–US Data Privacy Framework
“The Standard Contractual Clauses shall apply in addition to this DPA.”
“The Standard Contractual Clauses will not apply to the data transfer if LastPass adopts an alternative, recognized compliance standard for lawful data transfers, such as the EU-US Data Privacy Framework.”
DPA, www.lastpass.com ↗ - Customer data after the contract ends
-
Deleted or returned when the contract ends
“Following the termination or expiration of Customer's Agreement or earlier upon Customer's written request, LastPass shall delete and make irretrievable Customer Personal Data, unless European Union law, European Union Member State law, or applicable Data Protection Laws and Regulations requires or permits further storage of such Customer Personal Data.”
DPA, www.lastpass.com ↗ - Audit rights
-
Once a year
“LastPass maintains an audit program to verify compliance with the obligations set forth in this DPA and shall make available to Customer all information necessary to demonstrate compliance with its obligations under this DPA and required by applicable Data Protection Laws and Regulations by making available, upon Customer's reasonable request and no more than once annually”
DPA, www.lastpass.com ↗
Documents we track for LastPass
- DPA
- checked November 2, 2026 www.lastpass.com ↗
- Privacy policy
- checked November 3, 2026 www.lastpass.com ↗
- Subprocessor list
- checked November 2, 2026 www.lastpass.eu ↗
Change history
Tracking since October 15, 2026. No change has been published since; additions, removals and document changes will appear here as they're published.
LastPass subprocessors FAQ
- How many subprocessors does LastPass use?
- LastPass lists 26 subprocessors on its published list, including (Virginia), Amazon Web Services via US-East-1 (Virginia), Microsoft Azure US-East (Virginia) and US-West (California), AP-South-1 (India), AP-Southeast-1 (Singapore) and AP-Southeast-2 (Australia), and Akamai Technologies, Inc. and 21 more.
- Where does LastPass process customer data?
- The subprocessors named by LastPass are located in United States, Cloud hosting Provider (US only), Global, Israel, and United Kingdom, as stated on its list.
- How quickly does LastPass report a personal data breach to customers?
- According to its DPA, LastPass reports a personal data breach to customers within 72 hours: “LastPass maintains security incident management policies and procedures, as further specified in the Technical and Organizational Measures, and shall notify Customer, without undue delay, but not to exceed 72 hours, after becoming aware of a Security Incident.”
- How much notice does LastPass give before adding a subprocessor?
- LastPass's DPA gives 15 days' notice of a new subprocessor, the time customers have to object: “LastPass shall inform Customer of any new Sub-processors by providing an updated disclosure on its Trust and Privacy Center at https://www.lastpass.com/trustcenter/resources as well as via e-mail no less than fifteen (15) business days before authorizing such Sub-processors to Process Customer Personal Data in connection with the provision of the applicable Services.”
- How does LastPass transfer personal data outside the EU?
- LastPass's DPA relies on standard contractual clauses and the EU–US Data Privacy Framework: “The Standard Contractual Clauses shall apply in addition to this DPA.”
- When was LastPass's subprocessor list last checked?
- ClauseTrail last checked LastPass's subprocessor list on November 2, 2026. Lists are re-checked daily.
- How do I find out when LastPass adds or removes a subprocessor?
- ClauseTrail monitors LastPass's subprocessor list, DPA, privacy policy and terms and emails you the exact change — who was added or removed and what the page said before and after. The first vendors are free.