Vendor record · pega.com
What Pega promises about your data.
Where Pega publishes its promises, how long it gives you when it adds a sub-processor, and what has changed.
- Where it publishes
Pega lists its sub-processors at pega.com/subprocessors. We last read it on October 15, 2026.
- What has changed
We've recorded no change to its sub-processor list or data processing agreement between August 31, 2026 and September 15, 2026. Subscribers hear about a change the morning we read it; the public record shows it 30 days later.
- Its window
We couldn't quote a notice window: we haven't found a data processing agreement from Pega anywhere we've looked.
- Window
- —
- Sub-processors
- 12
- Pages
- 4
- Copies
- 14
no window we can quote yet
sub-processors named
pages we watch
dated copies of all its pages, since August 31, 2026
Pega DPA
We have not found a data processing agreement published by Pega anywhere we looked. There is no sub-processor notice window we can quote.
How it says it sends notice
“Notifications Log in or sign up to set up personalized notifications.”
pega.com/subprocessors · read 2026-09-20
Pega sub-processors
Pega publishes a sub-processor list at pega.com/subprocessors; we last read it on October 15, 2026. It names 12 entries. The entries, as the list prints them: Amazon Web Services, Inc.; Google LLC; MessageBird USA, INC (“Bird”); Microsoft Corporation; NetApp, Inc. (acquired Instaclustr Pty Ltd. and change is due to acquisition); Pega Japan KK; Pegasystems PTY Limited; Pegasystems New Zealand Limited; Pegasystems Servicos de Software do Brasil Ltda.; Pegasystems Software Limited Sp. z.o.o. Oddzial w Polsce; Pegasystems Worldwide India Private Limited; Raintank Inc. (known as Grafana Labs). The same list is in the full table below. The public record holds no change to the list read before September 15, 2026. A change we read after September 15, 2026 is published 30 days after we read it.
12 named · full table
Every public change we have recorded · Where vendors publish their lists
How long Pega keeps your data
We hold no statement about data retention from Pega's watched pages. The pages we watch: privacy policy pega.com/privacy; sub-processor list pega.com/subprocessors; terms of service pega.com/terms; trust and security page pega.com/trust. On training with customer data, Pega's privacy policy (pega.com/privacy, in the copy read September 20, 2026) says: “This information allows us to recognize you and personalize your experience if you return to a Service, to improve the Services and the products and services we provide, and to provide you with advertisements targeted to your interests (commonly referred to as “Targeted Advertisements”).”
Retention windows vendors publish · What vendors say about training
What the pages say
Read automatically from the pages below and shown as printed. A missing row is a gap in our reading, not proof it isn’t there.
Sub-processors named · 12
Amazon Web Services, Inc.
Cloud services provider Generative AI services
United States (AWS HQ) and [other deployment regions](https://docs.aws.amazon.c…
Google LLC
Cloud services provider (for Pega Cloud clients on Google Cloud) Generative AI services
United States and [other deployment regions](https://cloud.google.com/about/loc…
MessageBird USA, INC (“Bird”)
Email and SMS services (for Customer Decision Hub clients with optional Pega Message Stream add-on only)
United States and [other deployment regions](https://docs.bird.com/applications…
Microsoft Corporation
Generative AI services (for Generative AI clients only)
United States and [other deployment regions](https://azure.microsoft.com/en-us/…
NetApp, Inc. (acquired Instaclustr Pty Ltd. and change is due to acquisition)
Staff augmentation
United States and [other deployment regions](https://docs.netapp.com/us-en/occm…
Pega Japan KK
Japan
Pegasystems PTY Limited
Australia
Pegasystems New Zealand Limited
New Zealand
Pegasystems Servicos de Software do Brasil Ltda.
Brazil
Pegasystems Software Limited Sp. z.o.o. Oddzial w Polsce
Poland
Pegasystems Worldwide India Private Limited
India
Raintank Inc. (known as Grafana Labs)
Observability platform to monitor Pega Cloud infrastructure
United States
Certifications the trust page names · CSA STAR · Cyber Essentials · FedRAMP · HITRUST · IRAP · ISO 27001 · ISO 27017 · ISO 27018 · ISO 42001 · PCI DSS · SOC 1 · SOC 2 · SOC 2 Type II
Laws the trust page names · GDPR · HIPAA
The pages' own stamps: Effective 2023-07-17 · Last updated 2026-07 · Last updated 2023-07-31
The pages we watch
Every page we read, so you can check it. Each is re-read on a schedule, and we keep a dated copy when it changes.
Where we get nothing
What Pega does not publish where we can read it
Of the 4 public pages we watch for Pega, these give us nothing right now.
Data processing agreement
we have not found one published anywhere we looked
Before you conclude anything
This only means we couldn’t read it on a public page. Pega may share it in its agreement, a trust portal, or with any customer who asks.
So treat it as a question to ask them: “Can you send your sub-processor list, and tell us when it changes?”
What this page doesn’t tell you
No score.
Nothing here rates Pega. A short notice window is a contract term, not a criticism.
Public pages only.
Private notices and negotiated terms are invisible to us. Your agreement may say something different.
Wrong? Tell us.
Corrections are free, always. We reply within 2–3 business days.
How we read a page · The change log
Work at Pega? With an email at pega.com you can claim this record, suggest pages we should watch, and take a free copy of it. Claiming changes nothing we publish.
Is Pega in your product? Hear the morning we read a change.
You get the lines that moved, in Pega’s own words, and the date any window closes. No card. Nothing to cancel.