Wix
Website builder · wix.com · last read 2026-10-12
Identity
| Legal entity | Wix.com Ltd. |
|---|---|
| HQ | IL |
| Parent company | — |
| Ultimate ownership | — |
| EU contracting entity | — |
| LEI | — |
| US CLOUD Act reach | Not determined from the sources read |
| Source | wix.com · 2026-10-08 |
Data location
No data-location observation recorded yet.
Subprocessor chain
15 third parties · 10 of the vendor's own group companies · 18 with a country outside the EEA · all read 2026-10-08
| Subprocessor | Country | Purpose |
|---|---|---|
| AI service providers | — | AI-powered features within our platform |
| Amazon Web Services | US | Cloud infrastructure, hosting, and content delivery |
| Confluent | US | Data streaming and event processing |
| Fastly | US | Content delivery network |
| Google Ireland Ltd | IE | Cloud infrastructure, hosting, and content delivery |
| Microsoft Dynamics 365 | US | Customer support ticketing system |
| New Relic | US | Performance monitoring and analytics |
| Perimeter-X | US | Security and bot protection |
| Postmastery | NL | Email delivery optimization |
| SendGrid | US | Email delivery services |
| Sentry.io | US | Application monitoring and error tracking |
| Snowflake | US | Data warehouse and analytics |
| Sparkpost | US | Email delivery services |
| TaskUs | US | Customer support services |
| Twilio | US | Communications platform (SMS, voice, messaging) |
Wix's own group companies listed as subprocessors (10)
| Company | Country | Purpose |
|---|---|---|
| Wix Com India Private Limited | IN | Platform operations and service delivery |
| Wix Online Platform Limited | IE | Platform operations and service delivery |
| Wix.com (UK) Limited | GB | Platform operations and service delivery |
| Wix.com Brasil Serviços De Internet Ltda. | BR | Platform operations and service delivery |
| Wix.Com Germany GmbH | DE | Platform operations and service delivery |
| Wix.com INC | US | Platform operations and service delivery |
| Wix.com Luxembourg S.a.r.l | LU | Platform operations and service delivery |
| Wix.com Services Mexico S de RL de C.V. | MX | Platform operations and service delivery |
| Wix.com UAB | LT | Platform operations and service delivery |
| Wix.com Ukraine, LLC | UA | Platform operations and service delivery |
The count outside the EEA is arithmetic over the country column, not a judgement about lawfulness. A transfer outside the EEA can be perfectly lawful; whether this one is depends on your use, not on the vendor.
Processing terms
From the vendor's data processing agreement · read 2026-10-09 · wix.com
| Term | What the agreement says |
|---|---|
| Transfer mechanism | SCC (module not stated) |
| Transfer mechanism | other |
| Notice of new subprocessors | At least 7 days before the change, by email to customers who subscribe to notifications via the sub-processor list |
| If you object to one | Customer may send a written, reasoned objection on data protection grounds to [email protected] within 7 days of the notice |
| If you object to one | If Wix cannot resolve the objection or offer an alternative within 30 days, the customer's only remedy is to stop using the affected Service(s) by written notice |
| Breach notification | without undue delay after becoming aware |
| Audit | Audits including inspections by customer or independent auditor mandated by customer, at customer's cost, during business hours only |
| Audit | On reasonable written request, no more than once every 12 months: third-party audit reports/certifications; audits and inspections by customer or independent auditor at customer's cost, during business hours, subject to confidentiality |
| Audit | US states: User may verify that Wix processes Users-of-Users Information consistently with the DPA; if Wix cannot or will not comply with reasonable requests, the remedy is termination of the DPA and/or the related part of the Agreement |
Terms as the agreement states them. Where it is silent on a term, there is no row; that is not a statement that the vendor does not offer it.
Assurance
| Scheme | Status | Scope | Source | Observed |
|---|---|---|---|---|
| CCPA | Claimed | — | wix.com | 2026-10-08 |
| GDPR | Claimed | — | wix.com | 2026-10-08 |
| LGPD | Claimed | — | wix.com | 2026-10-08 |
| PCI DSS Level 1 · PCIDSS | Claimed | — | wix.com | 2026-10-08 |
| Soc 2 Type 2 · SOC2T2 | Claimed | — | wix.com | 2026-10-08 |
Claimed means the vendor asserts the scheme on its own page and offers nothing further. Available on request means the report or certificate exists but sits behind a request, a login or an NDA. Neither is a certificate we have seen. That is a distinction an auditor makes, so we make it too.
Official registers
| Register | Offering, as the register names it | Status | Level | Valid until | Observed |
|---|---|---|---|---|---|
| Data Privacy Framework List (US) | EU-U.S. Data Privacy Framework · Wix.com Inc. | Active - Re-certification under Review | non-HR data | 2027-10-06 | 2026-10-09 |
| Data Privacy Framework List (US) | Swiss-U.S. Data Privacy Framework · Wix.com Inc. | Active - Re-certification under Review | non-HR data | 2027-10-06 | 2026-10-09 |
| Data Privacy Framework List (US) | UK Extension to the EU-U.S. DPF · Wix.com Inc. | Active - Re-certification under Review | non-HR data | 2027-10-06 | 2026-10-09 |
- ACN qualified cloud (Italy): checked 2026-10-12, no entry under Wix; Wix.com Ltd.
- DORA critical ICT third-party providers (ESAs): checked 2026-10-12, no entry under Wix; Wix.com Ltd.
- Data Privacy Framework List (US): checked 2026-10-12, 3 entries under Wix; Wix.com Ltd.
- EU Cloud Code of Conduct (GDPR Art. 40): checked 2026-10-12, no entry under Wix; Wix.com Ltd.
- FedRAMP Marketplace (US): checked 2026-10-12, no entry under Wix; Wix.com Ltd.
- SecNumCloud qualified services (ANSSI, France): checked 2026-10-12, no entry under Wix; Wix.com Ltd.
What the authority publishes, not what the vendor claims. An entry covers the offering it names and nothing else: a FedRAMP authorisation for a government edition says nothing about the commercial service. No entry is not a finding about security - most vendors never apply - and an entry filed under a name not listed above would not have been found.
Support window
Not yet collected. This row will say not declared only once we have read a lifecycle or security page and found no period stated — see support windows.
Vulnerability reporting: [email protected] (security.txt, no Expires field; read 2026-10-11)
Documents
| Document | Disclosure | Transcription | HTTP | Observed |
|---|---|---|---|---|
| certifications | Public | full | 200 | 2026-10-08 |
| dpa | Public | full | 200 | 2026-10-09 |
| subprocessors | Public | full | 200 | 2026-10-08 |
History
Nothing has moved since we started watching this vendor on 2026-10-08. Changes appear here only after a human has reviewed them.