Wire
Messaging · wire.com · last read 2026-10-12
Identity
| Legal entity | Wire Swiss GmbH |
|---|---|
| HQ | CH |
| Parent company | — |
| Ultimate ownership | — |
| EU contracting entity | — |
| LEI | 5299009GLMJXTGQK5061 |
| US CLOUD Act reach | Not determined from the sources read |
| Source | wire.com · 2026-10-08 |
Legal entity from the vendor's own terms. LEI, registered country and parent company from the Global LEI Index (GLEIF); ownership is left empty where GLEIF names no parent. The CLOUD Act row is arithmetic over those countries, not an assessment of risk.
Data location
| Region | EU data location | Minimum plan | Source | Observed |
|---|---|---|---|---|
| EU | EU by default | — | wire.com | 2026-10-08 |
EU: The document says Wire's servers are in Germany and Ireland, under "Servers in the EU / European data sovereignity". It doesn't name a plan, an option the customer has to choose, or a cost.
Subprocessor chain
11 third parties · 1 of the vendor's own group companies · 1 with a country outside the EEA · all read 2026-10-08
| Subprocessor | Country | Purpose |
|---|---|---|
| Amazon Web Services EMEA SARL | EU | Hosting |
| Box, Inc. | EU | Signature Management |
| Cloud Temple | EU | Infrastructure for processing/hosting Wire Drive content for customers subscribed to the EU sovereign instance |
| Cloud Temple SAS | EU | Wire Drive hosting (EU sovereign instance only) |
| ContractHero GmbH | EU | Contract Management |
| Countly Ltd. | DE | Product Analytics |
| Google Cloud EMEA Limited | EU | E-mail provider |
| Hubspot Inc. | EU | Website Hosting & Marketing Activities, CRM Services |
| Salesforce, Inc. | DE | CRM Services |
| Stripe Payments Europe, Limited (SPEL) | US | Payment Services |
| Zendesk, Inc. | EU | Customer Support |
Wire's own group companies listed as subprocessors (1)
| Company | Country | Purpose |
|---|---|---|
| Wire Germany GmbH | — | Development of the services |
The count outside the EEA is arithmetic over the country column, not a judgement about lawfulness. A transfer outside the EEA can be perfectly lawful; whether this one is depends on your use, not on the vendor.
Processing terms
From the vendor's data processing agreement · read 2026-10-09 · wire.com
| Term | What the agreement says |
|---|---|
| Transfer mechanism | SCC (module not stated) |
| Notice of new subprocessors | Advance notice in writing or text form, including the planned date of the change; no notice period stated |
| If you object to one | Principal may object within fourteen days of notice |
| Breach notification | within 48 hours |
| Audit | Inspections by Principal or designated auditor after consultation, during normal operating hours without disruption; evidence may be codes of conduct, certifications, third-party reports (e.g. ISO/IEC 27001/27701); on-site may require NDA; Wire may claim appropriate remuneration |
| Audit | Wire may provide current certificates, reports or excerpts from independent bodies (e.g. auditors, DPOs, IT security audits) as evidence of its measures; approved codes of conduct or certifications are also acceptable. The text refers to audits by the Principal but does not set their scope, frequency or cost. |
Terms as the agreement states them. Where it is silent on a term, there is no row; that is not a statement that the vendor does not offer it.
Assurance
| Scheme | Status | Scope | Source | Observed |
|---|---|---|---|---|
| Cyber Essentials · CyberEssentials | Claimed | — | wire.com | 2026-10-08 |
| ISO 27001 · ISO27001 | Claimed | — | wire.com | 2026-10-08 |
| ISO 27701 · ISO27701 | Claimed | — | wire.com | 2026-10-08 |
Claimed means the vendor asserts the scheme on its own page and offers nothing further. Available on request means the report or certificate exists but sits behind a request, a login or an NDA. Neither is a certificate we have seen. That is a distinction an auditor makes, so we make it too.
Official registers
| Register | Offering, as the register names it | Status | Level | Valid until | Observed |
|---|---|---|---|---|---|
| Global LEI Index (GLEIF) | Wire Swiss GmbH · Wire Swiss GmbH | ISSUED | CH | 2027-03-24 | 2026-10-09 |
- ACN qualified cloud (Italy): checked 2026-10-09, no entry under Wire; Wire Swiss GmbH
- DORA critical ICT third-party providers (ESAs): checked 2026-10-09, no entry under Wire; Wire Swiss GmbH
- EU Cloud Code of Conduct (GDPR Art. 40): checked 2026-10-09, no entry under Wire; Wire Swiss GmbH
- FedRAMP Marketplace (US): checked 2026-10-09, no entry under Wire; Wire Swiss GmbH
- SecNumCloud qualified services (ANSSI, France): checked 2026-10-09, no entry under Wire; Wire Swiss GmbH
What the authority publishes, not what the vendor claims. An entry covers the offering it names and nothing else: a FedRAMP authorisation for a government edition says nothing about the commercial service. No entry is not a finding about security - most vendors never apply - and an entry filed under a name not listed above would not have been found.
Support window
Not yet collected. This row will say not declared only once we have read a lifecycle or security page and found no period stated — see support windows.
Vulnerability reporting: [email protected], [email protected], account.wire.com, account.wire.com (security.txt, expires 2027-08-01; read 2026-10-11)
Documents
| Document | Disclosure | Transcription | HTTP | Observed |
|---|---|---|---|---|
| certifications | Public | full | 200 | 2026-10-08 |
| dpa | Public | full | 200 | 2026-10-09 |
| residency | Public | full | 200 | 2026-10-08 |
| subprocessors | Public | full | 200 | 2026-10-08 |
History
Nothing has moved since we started watching this vendor on 2026-10-08. Changes appear here only after a human has reviewed them.