Sitecore uses its Affiliates and a range of third-party Subprocessors to assist it in providing the Services (as described in the Agreement). The Subprocessors set out below are product-specific third-party Subprocessors, which provide cloud hosting services, application processing services, database services, email sending/tracking services, as well as incident tracking, response, diagnosis, and resolution services in the form of SaaS DXP and Platform DXP products.
Sitecore has introduced SitecoreAI, which unifies Sitecore SaaS components under a single platform experience. Unless expressly stated otherwise, the Subprocessors listed below apply to SitecoreAI and to its component services. EXM Cloud and Managed Cloud Services remain separate and continue to use their own product-specific Subprocessor lists.
For customers who continue to use legacy SaaS DXP subscriptions without enabling SitecoreAI, the Subprocessors applicable to their existing products remain unchanged and continue to apply under the same regional hosting and data-processing terms.
| Entity Name | Description of the performance | Corporate Location |
| Auth0 | Authentication Tool | Seattle, Washington |
| AWS | Cloud Service Provider | Seattle, Washington |
| Confluent | Real-time Data Management | Mountain View, California |
| Cloudflare | Web performance and security services | San Francisco, California |
| Elastic | Observability / security monitoring | San Francisco CA USA |
| HTMLtoImage | Thumbnail Rendition | Leeds, England |
| Imgix | Image Management | San Francisco, California |
| Liveblocks | User Engagement and Collaboration | Wilmington, Delaware |
| Microsoft (Azure Open AI / Azure AI Foundry) | Generative AI Services | Redmond, Washington |
| Microsoft | Microsoft Azure Cloud Service Provider | Redmond, Washington |
| MongoDB Atlas | Database services | New York NY US |
| Redis | Caching and session management | Mountain View, California |
| SearchStax | Search Services | Manhattan Beach, California |
| SendGrid | Email Delivery Services | Denver, Colorado |
| Snowflake | Data warehouse services | Bozeman MT USA |
| Uploadcare | File Upload Management | Wilmington, Delaware |
| Vercel | Frontend Cloud Platform | San Francisco, California |
| Workato | Integration and workflow automation | San Francisco, California |
Note: For customers selecting Singapore, Japan or Australia as their SitecoreAI region, certain functionality covered by the Gen AI Addendum may use Microsoft Azure OpenAI / Azure AI Foundry Global Standard deployment where the applicable Sitecore functionality, AI model or model version is not available to Sitecore under a Regional or Data Zone deployment for the customer’s selected region.
Where Global Standard is used, Microsoft may process AI inference data in Azure regions where the relevant model is deployed. The applicable Azure regions vary by model and may change over time, as described in Microsoft’s regional availability documentation: https://learn.microsoft.com/en-us/azure/foundry/foundry-models/concepts/models-sold-directly-by-azure-region-availability.
AI inference data may include prompts and contextual data included in the request, model outputs and completions, embeddings, image inputs and outputs, technical metadata, and prompts and outputs processed for abuse monitoring, where applicable. Customer-stored data remains in the designated Azure geography; this note addresses AI inference processing only.
Sitecore’s various SaaS DXP products are further categorized according to the functionalities they provide, namely:
| Entity Name | Description of the performance | Corporate Location |
| Auth0 | Authentication Tool | Seattle, Washington |
| Cloudflare | Web performance and security services | San Francisco, California |
| Elastic | Observability and Security Services | San Francisco, California |
| Gradial* | Generative AI Services | Seattle, Washington |
| Microsoft | Microsoft Azure Services | Redmond, Washington |
| Microsoft (Azure Open AI) | Generative AI Services | Redmond, Washington |
* Used where purchased under the relevant Order for Services.
Sitecore XM Cloud (if applicable)
| Entity Name | Description of the performance | Corporate Location |
| AWS | Cloud Service Provider | Seattle, Washington |
| Confluent | Real-time Data Management | Mountain View, California |
| HTMLtoImage** | Thumbnail Rendition | Leeds, England |
| Imgix** | Image Management | San Francisco, California |
| Redis | Caching and session management | Mountain View, California |
| SearchStax | Search Services | Manhattan Beach, California |
| Uploadcare** | File Upload Management | Wilmington, Delaware |
| Vercel* | Frontend Cloud Platform | San Francisco, California |
* Used for Sitecore XM Cloud where purchased under the relevant Order for Services.
** Used for Sitecore XM Cloud Forms
Sitecore Search (if applicable)
| Entity Name | Description of the performance | Corporate Location |
| AWS | Cloud Service Provider | Seattle, Washington |
| Confluent Kafka | Cloud Service Provider | Mountain View, California |
| MongoDB Atlas | Cloud Service Provider | New York, New York |
| Snowflake | Data Warehouse | Bozeman, Montana |
Sitecore Discover (if applicable)
| Entity Name | Description of the performance | Corporate Location |
| AWS | Cloud Service Provider | Seattle, Washington |
| Confluent Kafka | Cloud Service Provider | Mountain View, California |
| MongoDB Atlas | Cloud Service Provider | New York, New York |
| Snowflake | Data Warehouse | Bozeman, Montana |
Sitecore Personalize (if applicable)
| Entity Name | Description of the performance | Corporate Location |
| AWS | Cloud Service Provider | Seattle, Washington |
Used for Sitecore Personalize where purchased under the relevant Order for Services.
Sitecore CDP (if applicable)
| Entity Name | Description of the performance | Corporate Location |
| AWS | Cloud Service Provider | Seattle, Washington |
Used for Sitecore CDP where purchased under the relevant Order for Services.
Sitecore Send (if applicable)
| Entity Name | Description of the performance | Corporate Location |
| AWS | Cloud Service Provider | Seattle, Washington |
| Constant Contact | Digital and Email Marketing Platform | Waltham, Massachusetts |
Sitecore Content Hub (if applicable)
| Entity Name | Description of the performance | Corporate Location |
| Confluent |
Real-time Data Management |
Mountain View, California |
| Redis |
Caching and session management |
Mountain View, California |
| SendGrid | Email Delivery Services | Denver, Colorado |
| Vercel* | Frontend Cloud Platform | San Francisco, California |
* Used for Sitecore Content Hub where purchased under the relevant Order for Services.
Sitecore Experience Edge (if applicable)
| Entity Name | Description of the performance | Corporate Location |
| Cloudflare* | Web Performance and Security Services | San Francisco, California |
|
Redis |
Caching and session management |
Mountain View, California |
|
Vercel* |
Frontend Cloud Platform |
San Francisco, California |
* Used for Sitecore Experience Edge where purchased under the relevant Order for Services.
Sitecore OrderCloud (if applicable)
| Entity Name | Description of the performance | Corporate Location |
| Elastic | Observability and Security Services | San Francisco, California |
| Microsoft | Cloud Service Provider | Redmond, Washington |
| Vercel* | Frontend Cloud Platform | San Francisco, California |
* Used for Sitecore OrderCloud where purchased under the relevant Order for Services.
Sitecore Stream (if applicable)
| Entity Name | Description of the performance | Corporate Location |
| Liveblocks | User Engagement and Collaboration |
Wilmington, Delaware |
Note: For customers who select Singapore as their Azure region for Sitecore Stream, certain AI model inference requests may be processed in Microsoft Azure’s Japan East region due to model availability. All data at rest remains stored within the customer’s Singapore Azure region. Processing is governed by Microsoft’s Data Protection Addendum (DPA) and Japan’s Act on the Protection of Personal Information (APPI), which provides a protection standard comparable to Singapore’s Personal Data Protection Act (PDPA).
Sitecore Connect (if applicable)
| Entity Name | Description of the performance | Corporate Location |
| Workato | Integration and workflow automation |
San Francisco, California |
EXM (if applicable)
| Entity Name | Description of the performance | Corporate Location |
| Message Systems (Sparkpost) | Email Delivery Services | Columbia, Maryland |
Managed Cloud (if applicable)
| Entity Name | Description of the performance | Corporate Location |
| Americaneagle.com | Operational support services | Chicago, Illinois, USA |
| Cloudflare*** | Web performance and security services | San Francisco, California |
| Datadog*** |
Monitoring, and log management services |
New York City, New York, USA |
| Elastic | Observability and Security Services | San Francisco, California |
| Microsoft | Cloud Service Provider | Redmond, Washington |
| SearchStax** | Search Services | Manhattan Beach, California |
| Vercel | Cloud platform | San Francisco, California |
| * | Used for Sitecore XP and XC version 9 and above where Premium Support is purchased under the relevant Order for Services. |
| ** | Used for Sitecore XP and XC versions 9 and above where purchased under the relevant Order for Services. |
| *** | Used for Sitecore Managed Cloud where purchased under the relevant Order for Services. |
| Entity Name | Description of the performance | Corporate Location |
| Americaneagle.com | Managed Cloud and product technical support services | Chicago, Illinois, USA |
| IGT 1 Outsourcing Lanka (Private) Limited | Business Process Outsourcing Partner | Colombo, Sri Lanka |
| Microsoft Azure | Cloud hosting and infrastructure supporting support services, including processing through Azure Web Apps and storage through Azure SQL Managed Instance | Redmond, Washington |
| Microsoft (Azure OpenAI Services) | Customer Relations Performance | Click here |
| Microsoft (Power BI) | Data Visualization | Click here |
| Salesforce | Customer Relations Performance | Click here |
| ServiceNow | Customer Relations Performance | Click here |
| SendGrid | Email Delivery Services | Denver, Colorado |
| TheLoops, Inc | AI-driven support operations, ticketing analytics, and customer experience insights. | San Mateo, California |
| Twilio | Communications Platform | San Francisco, California |
| Entity Name | Description of the performance | Corporate Location |
| Google Cloud Platform / Google LLC | Cloud hosting, storage, database, compute and AI model services supporting the Scrunch SaaS Product | United States |
| OpenAI | AI inference, summarisation, embeddings, evaluation and content generation | United States |
| ClickHouse Cloud | Storage and analytics supporting response collection and reporting | United States |
| Cloro | Collection of responses from consumer AI services using Customer prompts | United States |
| DataForSEO | Collection of responses and search results from consumer AI services using Customer prompts | United States |
| Scrapeless | Collection of responses and search results from consumer AI services using Customer prompts | United States |
| Perplexity | Fallback AI model/search processing for Customer prompts | United States |
| Together AI | Fallback AI model processing for Customer prompts | United States |
| Intercom | Processing of Scrunchie conversation transcripts and user contact data when a conversation is escalated | United States |
| Cloudflare | Edge storage and delivery of customer derived optimised content | United States |
| Akamai | Edge storage and delivery of customer derived optimised content | United States |
| Entity Name | Description of the performance | Corporate Location |
| Americaneagle.com | Professional Services delivery partner providing implementation, migration and advisory services, including white-label delivery and staff augmentation. Depending on the engagement, personnel may access Customer systems and Personal Data and may use the partner's own tools. | Chicago, Illinois, USA |
| Digital Herd | Staff augmentation provider supporting implementation services in EMEA. Personnel may access Customer systems and Personal Data and may use the provider's own tools while acting under Sitecore's instructions. | Zellik, Flemish Region, Belgium |
| Velir | Professional Services delivery partner used for customer engagements delivered on Sitecore paper. Scope of Personal Data access and applicable delivery locations to be confirmed for inclusion where the partner processes Personal Data on Sitecore's behalf. | Massachusetts, USA |
| Individual contractors engaged by Sitecore | Contracted Professional Services resources supporting advisory and implementation activities. Where applicable, such personnel may access Customer systems and Personal Data while acting under Sitecore's instructions and using Sitecore tools. | Various / as applicable |
| Entity Name | Description of the performance | Corporate Location |
| Microsoft | Technology and collaboration services used in Professional Services delivery, including Microsoft Teams, GitHub and SharePoint. | Redmond, Washington |
| Atlassian | Jira and Confluence collaboration and delivery tooling. | Sydney, New South Wales, Australia |
| Teamwork | Collaboration and delivery tooling. | Geneva, Switzerland |
| Certinia | Professional Services management and customer success planning. | San Jose, California |