How many subprocessors does Upwind use?

Upwind lists 4 subprocessors on its published list, including Cloud Security, Blog, Our Partners, and About.

Where does Upwind process customer data?

The subprocessors named by Upwind are located in AI Security, Agentic Security, Amazon Web Services, Careers, Channel Partners, and Customers and 9 other locations, as stated on its list.

How quickly does Upwind report a personal data breach to customers?

According to its DPA, Upwind reports a personal data breach to customers without undue delay, with no set deadline: “shall notify the Customer without undue delay after becoming aware of a Data Incident”

How does Upwind transfer personal data outside the EU?

Upwind's DPA relies on standard contractual clauses and adequacy decisions: “The Parties agree that the terms of the EU SCCs are hereby incorporated by reference and shall apply to an EEA Transfer.”

Does Upwind have a SOC 2 Type II report?

Yes. Upwind's trust page lists a SOC 2 Type II report: “SOC 2 Type 2”

Which security certifications does Upwind list?

Upwind's trust page lists SOC 2 Type II and ISO 27001.

When was Upwind's subprocessor list last checked?

ClauseTrail last checked Upwind's subprocessor list on November 2, 2026 and last saw it change on October 23, 2026. Lists are re-checked daily.

How do I find out when Upwind adds or removes a subprocessor?

ClauseTrail monitors Upwind's subprocessor list, DPA, privacy policy and terms and emails you the exact change — who was added or removed and what the page said before and after. The first vendors are free.

Upwind Subprocessors List (November 2026): Changes and History

Upwind names 4 subprocessors on its published list. Read from the vendor's own page and re-checked daily.

Last checked November 2, 2026 Last change October 23, 2026 Official source ↗

Upwind subprocessors (November 2026)

#	Subprocessor	Purpose	Location
1	Cloud Security	—	AI Security, Agentic Security
2	Blog	—	Events, UpwindTV, Integrations, Customers, Glossary
3	Our Partners	—	Technology Alliances, Channel Partners, Amazon Web Services, Google Cloud, Microsoft Azure, Oracle Cloud
4	About	—	Values, Careers

Get an email when Upwind changes its subprocessors

ClauseTrail re-checks this list every day and tells you exactly who was added or removed — including when a vendor starts sending data to an AI provider. The first vendors are free.

Track Upwind free

Key DPA terms at Upwind

What Upwind's data processing agreement commits to, with the sentence each answer comes from. SCCs or the Data Privacy Framework: what's the difference?

Breach notification: Without undue delay, with no set deadline

“shall notify the Customer without undue delay after becoming aware of a Data Incident”
DPA, www.upwind.io ↗
Transfers outside the EU: Standard contractual clauses and adequacy decisions

“The Parties agree that the terms of the EU SCCs are hereby incorporated by reference and shall apply to an EEA Transfer.”

“Personal Data may be transferred from EU Member States, the three other EEA member countries (Norway, Liechtenstein and Iceland) (collectively, "EEA"), Switzerland and the United Kingdom ("UK") to countries that offer an adequate level of data protection under or pursuant to the adequacy decisions published by the relevant data protection authorities”
DPA, www.upwind.io ↗
Customer data after the contract ends: Deleted or returned when the contract ends

“Following termination of the Agreement and subject thereto, the Processor shall delete or return to the Customer all the Personal Data it Processes solely on behalf of the Customer”
DPA, www.upwind.io ↗
Audit rights: Once a year

“Upon the Customer's thirty (30) days' prior written request at reasonable intervals (no more than once every twelve (12) months)”
DPA, www.upwind.io ↗

Certifications at Upwind

What Upwind's trust page lists, with the text each one comes from. SOC 2 Type I or Type II: what's the difference?

SOC 2 Type II: Active

“SOC 2 Type 2”
Trust page, trust.upwind.io ↗
ISO 27001: Active

“ISO/IEC 27001:2022”
Trust page, trust.upwind.io ↗

Documents we track for Upwind

DPA: checked November 3, 2026 www.upwind.io ↗
Privacy policy: checked November 3, 2026 www.upwind.io ↗
Subprocessor list: checked November 2, 2026 changed October 23, 2026 www.upwind.io ↗
Terms of service: checked November 3, 2026 www.upwind.io ↗
Trust page: checked November 3, 2026 trust.upwind.io ↗

Change history

Tracking since October 11, 2026. No change has been published since; additions, removals and document changes will appear here as they're published.

Upwind subprocessors FAQ

How many subprocessors does Upwind use?: Upwind lists 4 subprocessors on its published list, including Cloud Security, Blog, Our Partners, and About.
Where does Upwind process customer data?: The subprocessors named by Upwind are located in AI Security, Agentic Security, Amazon Web Services, Careers, Channel Partners, and Customers and 9 other locations, as stated on its list.
How quickly does Upwind report a personal data breach to customers?: According to its DPA, Upwind reports a personal data breach to customers without undue delay, with no set deadline: “shall notify the Customer without undue delay after becoming aware of a Data Incident”
How does Upwind transfer personal data outside the EU?: Upwind's DPA relies on standard contractual clauses and adequacy decisions: “The Parties agree that the terms of the EU SCCs are hereby incorporated by reference and shall apply to an EEA Transfer.”
Does Upwind have a SOC 2 Type II report?: Yes. Upwind's trust page lists a SOC 2 Type II report: “SOC 2 Type 2”
Which security certifications does Upwind list?: Upwind's trust page lists SOC 2 Type II and ISO 27001.
When was Upwind's subprocessor list last checked?: ClauseTrail last checked Upwind's subprocessor list on November 2, 2026 and last saw it change on October 23, 2026. Lists are re-checked daily.
How do I find out when Upwind adds or removes a subprocessor?: ClauseTrail monitors Upwind's subprocessor list, DPA, privacy policy and terms and emails you the exact change — who was added or removed and what the page said before and after. The first vendors are free.