WarmTransfer
security identity · published

Cisco offer disclosures as an evidence class

Verified 2026-09-30 · 40 sources · tier 2–4

Also known as CAIQ, CSA STAR, Common Control Framework, Offer Disclosure, Statement of Volatility, Transfer Impact Assessment, Trust Package, Trust Portal, subcontractor, subprocessor.

WarmTransfer's reading of the sources is that an Offer Disclosure is a Cisco document type that states for 1 named offer what personal data it handles, for what purpose, how long it is kept, where it is stored and processed, who it is shared with, and what security controls apply 37. An Offer Disclosure states that it complements the General Disclosures and the Cisco Online Privacy Statement, and each disclosure carries its own precedence and annual review wording in its preamble 10.

Document scope and structure

WarmTransfer's reading of the sources is that an Offer Disclosure is scoped to a commercial offer rather than to a product family, so a customer buying 2 Cisco contact centre offers is covered by 2 different disclosures 9. Cisco publishes 3 separate contact centre offer disclosures: 1 for the Webex Contact Center Service 1 for Webex Contact Center Enterprise and 1 for the Cisco Contact Center Enterprise Solution 32. The Cisco Webex Contact Center Service Offer Disclosure is the document covering the cloud contact centre product, and it carries the full section set: an overview, data handling with tables 1 to 3, security with the access and controls table at table 6, and an artificial intelligence section with table 7 38.

In the field, 3 of the 4 disclosures read follow the same section order: an overview, then data handling with collection purpose and retention, then storage and processing, then access and sharing, then security with access control and encryption and reports and resources, and finally artificial intelligence 22. However, field reports suggest section numbers are not portable across Offer Disclosures because the on-premises Contact Center Enterprise Solution disclosure folds data handling into section 1 and numbers security as section 2, while the 3 cloud disclosures number data handling 2 and security 3 24.

Field reports suggest Table 1 in an Offer Disclosure lists customer content data categories, and the count varies by offer from 2 categories in the Webex Contact Center Enterprise disclosure to 11 in the on-premises Contact Center Enterprise Solution disclosure 28. In the field, Table 2 lists customer systems information categories and is where retention periods for telemetry events and configuration data are published 29. In the field, the access and controls table is numbered Table 6 in all 3 cloud disclosures and Table 3 in the on-premises Contact Center Enterprise Solution disclosure 31. Table numbering within a disclosure can also skip; for example, the Webex Contact Center Enterprise disclosure labels a table Table 5 although it contains no Table 4 because it merges subcontractors and subprocessors into a single table 27.

Storage, processing, and third parties

An Offer Disclosure distinguishes subcontractors, which assist with broader data processing services, from subprocessors, which specifically process personal data on Cisco's behalf to support the functionality of the offer 26.

Table 3 in a cloud Offer Disclosure lists data centre locations, and the Webex Contact Center disclosure lists 12 Cisco locations plus 11 AWS regions, while the Webex Contact Center Enterprise disclosure lists 7 Cisco locations and names no AWS regions, and the Webex Engage disclosure lists 7 AWS regions and names no Cisco owned data centre 30. The Webex Engage disclosure names 5 subprocessors: Amazon Web Services, Mailgun, Sendgrid, Maxmind, and Meta 11.

In contrast, the Contact Center Enterprise Solution disclosure states that the offer does not rely on its own data centres or third-party operated co-location facilities, that it is an on-premise solution, and that the location of data centres is determined by the customer 17. That disclosure states that because the solution is not hosted or operated by Cisco, it is provided without sending personal data to any third-party service providers 18. It also states of the outbound campaign contact list and of termination call detail records that the personal data is unencrypted, and that the customer may elect to apply IPsec or TLS for data in transit and self-managed encryption 19. WarmTransfer's reading of the sources is that where the on-premises disclosure omits the data centre, subprocessor, and artificial intelligence sections, it says why rather than leaving them blank 16.

Artificial intelligence disclosures

The generative and agentic AI table lists 7 features in the Webex Contact Center disclosure and 5 in the Webex Contact Center Enterprise disclosure 6. The Webex Engage disclosure contains no artificial intelligence section and no generative and agentic AI table 5.

Distinction from other document types

WarmTransfer's reading of the sources is that a Transfer Impact Assessment is a different document type from an Offer Disclosure, noting that the Webex Contact Center 1 runs to about 4,000 characters against 46,000 for the disclosure and points to resources rather than publishing data handling tables 33. The Webex Customer Experience service level agreement and service level objective is also a separate document type that states availability commitments and is not where data handling or retention is published 25.

In the field, 55 distinct document type values were observed across 865 deduplicated Cisco Trust Portal documents in a 20 query sample taken on 5 September 2026 36. Field reports suggest Offer Disclosure was the most frequent document type in the sample at 270 of the 865 documents observed 15. In the field, other document types observed in the sample include Statement of Volatility ISO Transfer Impact Assessment AI Transparency Penetration Test CSA STAR White Paper ENS SLO SLA CAIQ SOC 2 C5 Security Brief Corporate Policy SOC 3 Transparency Report DORA Disclosure TX-RAMP SIG HIPAA PCI DSS FedRAMP ISMAP FIPS 140-2 EU COC HDS and Common Criteria 20. Field reports suggest 41 documents carrying the AI Transparency type were observed in the sample, which is more than the 9 contact centre notes this corpus has catalogued 7.

Portal distribution and extraction patterns

Field reports suggest Offer Disclosures are served from 2 URL path prefixes: a legacy privacydatasheet path and a current offer-disclosure path, with 136 and 116 of the 270 observed disclosures on each respectively 35. WarmTransfer's reading of the sources is that the persistence of a privacydatasheet path for documents titled Offer Disclosure, together with older documents that still use the words Privacy Data Sheet in their body, is consistent with the document type having been renamed from Privacy Data Sheet to Offer Disclosure 21.

In the field, localised Trust Portal documents carry a locale segment in the path, and 51 French and 23 Japanese offer disclosures were observed in the sample against 196 with no locale segment 14. In the field, Trust Portal document paths carry a product family segment, and the families observed include collaboration, security, services, software, datacenter, DNA, and iot 13. Field reports suggest some Trust Portal records carry several document types and no document URL of their own, acting as per-product compliance bundles rather than as documents 8.

Field reports suggest the Cisco Trust Portal exposes an undocumented and unversioned search endpoint that accepts an Elasticsearch style query body and returns document names, types, identifiers, and URLs 23. Furthermore, field reports suggest Trust Portal document PDFs under a c slash dam slash r slash ctp slash docs path are retrievable directly with an ordinary HTTP client, and the 404 behaviour previously recorded for this host applies to its application routes rather than to these document paths 34.

WarmTransfer's reading of the sources is that a document type existing for 1 product is no evidence that it exists for another, and an expected but absent disclosure must be treated as unknown rather than assumed 12. When extracting text, the Webex Contact Center Enterprise Offer Disclosure encodes its ff, fi, fl, and ffi ligatures as Private Use Area codepoints, so extracted text contains an unmapped character in place of each ligature 39. Specifically, the Webex Contact Center Enterprise Offer Disclosure contains 50 Private Use Area ligature characters: U+E023 for "fi", U+E026 for "ff", U+E025 for "fl", and U+E027 for "ffi"; a plain-text search of the document for "Offer" returns 1 hit instead of the actual 15 occurrences 40.

See also

See also The Cisco Trust Portal as a monitorable document source. See also Webex Contact Center Enterprise as a distinct product. See also Webex Engage as the digital channel product. See also Cisco AI transparency technical notes. See also The Cisco AI transparency note set beyond the contact centre. See also Cisco Statement of Volatility as a document type. See also Cisco DORA Disclosure as a document type. See also Webex Contact Center data locality by country. See also Webex Contact Center recording and contact data retention. See also Third-party model and speech vendors behind Webex contact centre AI. See also Webex service level agreements and objectives. See also Fidelity of the corpus text extraction pipeline.

Applicability

Applies to: Cisco Trust Portal, Cisco Webex Contact Center Enterprise, Cisco Webex Engage, Cisco Contact Center Enterprise Solution, and Cisco Webex Contact Center. Deployments: cloud and on-premises. Sources checked 2026-09-05.

What remains uncertain

Whether two different post-termination retention periods appear in 1 Webex CCE table cell is not covered by the sources below. The details of the 41 AI Transparency documents beyond the 9 contact centre notes are not covered by the sources below. What a DORA Disclosure covers is not covered by the sources below. Which specific Cisco offers have a disclosure and which do not is not covered by the sources below. Whether the Trust Portal search endpoint is stable enough to depend on is not covered by the sources below. Retention values in the Contact Center Enterprise Solution disclosure are not covered by the sources below. The true total size of the Cisco Trust Portal is not covered by the sources below. Whether a compliance bundle record lists every document for a product is not covered by the sources below.

See also

Applies to

Parent of

Published through

Related to

Referenced by

Sources

  1. 1
    Cisco describes Offer Disclosures as covering personal-data protection, processing purposes, processing locations, third-party subprocessors, customer data access and nonpersonal data processing.
    Security, Privacy, and Trust (Purpose Reporting Hub) · Security, Privacy, and Trust hub page, Offer Disclosures paragraph · Checked 2026-09-30
  2. 2
    In fiscal 2025, Cisco's privacy center of excellence (PCOE) sent data questionnaires to product developers and turned the responses into public-facing Offer Disclosures published through the Cisco Trust Portal.
    Prioritizing security, privacy, and trust in the AI era (FY25 Purpose Report) · blog post, PCOE and Offer Disclosures paragraph · Checked 2026-09-30
  3. 3
    Customers can subscribe to email notifications about updates to the processing operations of Cisco offers that are published in Privacy Data Sheets or Offer Disclosures.
    Data Protection Agreement (DPA) · DPA page, subscription paragraph · Checked 2026-09-30
  4. 4
    To subscribe, a user clicks the Subscribe icon in the upper-right corner of a Privacy Data Sheet or Offer Disclosure, and then gets an email each time that document is updated.
    Data Protection Agreement (DPA) · DPA page, subscription paragraph · Checked 2026-09-30
  5. 5
    The Webex Engage disclosure contains no artificial intelligence section and no generative and agentic AI table.
    Cisco Webex Engage Offer Disclosure · whole document · Checked 2026-09-05
  6. 6
    The generative and agentic AI table lists 7 features in the Webex Contact Center disclosure and 5 in the Webex Contact Center Enterprise disclosure.
    Cisco Webex Contact Center Service Offer Disclosure · Table 7 compared across two documents · Checked 2026-09-05
  7. 7
    41 documents carrying the AI Transparency type were observed in the sample which is more than the 9 contact centre notes this corpus has catalogued.field report
    Cisco Trust Portal document search endpoint · twenty query census of the Trust Portal search endpoint on 2026-09-05 · Checked 2026-09-05
  8. 8
    Some Trust Portal records carry several document types and no document URL of their own and act as per-product compliance bundles rather than as documents.field report
    Cisco Trust Portal document search endpoint · twenty query census of the Trust Portal search endpoint on 2026-09-05 · Checked 2026-09-05
  9. 9
    An Offer Disclosure is scoped to a commercial offer rather than to a product family so a customer buying 2 Cisco contact centre offers is covered by 2 different disclosures.inferred
    Cisco Webex Contact Center Service Offer Disclosure · preamble and section 1 Overview compared across four documents · Checked 2026-09-05
  10. 10
    An Offer Disclosure states that it complements the General Disclosures and the Cisco Online Privacy Statement and each disclosure carries its own precedence and annual review wording in its preamble.
    Cisco Webex Contact Center Service Offer Disclosure · preamble · Checked 2026-09-05
  11. 11
    The Webex Engage disclosure names 5 subprocessors: Amazon Web Services Mailgun Sendgrid Maxmind and Meta.
    Cisco Webex Engage Offer Disclosure · Table 5 Subprocessors · Checked 2026-09-05
  12. 12
    A document type existing for 1 product is no evidence that it exists for another and an expected but absent disclosure must be treated as unknown rather than assumed.inferred
    Cisco Trust Portal document search endpoint · twenty query census of the Trust Portal search endpoint on 2026-09-05 · Checked 2026-09-05
  13. 13
    Trust Portal document paths carry a product family segment and the families observed include collaboration security services software datacenter DNA and iot.field report
    Cisco Trust Portal document search endpoint · twenty query census of the Trust Portal search endpoint on 2026-09-05 · Checked 2026-09-05
  14. 14
    Localised Trust Portal documents carry a locale segment in the path and 51 French and 23 Japanese offer disclosures were observed in the sample against 196 with no locale segment.field report
    Cisco Trust Portal document search endpoint · twenty query census of the Trust Portal search endpoint on 2026-09-05 · Checked 2026-09-05
  15. 15
    Offer Disclosure was the most frequent document type in the sample at 270 of the 865 documents observed.field report
    Cisco Trust Portal document search endpoint · twenty query census of the Trust Portal search endpoint on 2026-09-05 · Checked 2026-09-05
  16. 16
    Where the on-premises disclosure omits the data centre subprocessor and artificial intelligence sections it says why rather than leaving them blank.inferred
    Cisco Contact Center Enterprise Solution Offer Disclosure · storage and processing section · Checked 2026-09-05
  17. 17
    The Contact Center Enterprise Solution disclosure states that the offer does not rely on its own data centres or third-party operated co-location facilities that it is an on-premise solution and that the location of data centres is determined by the customer.
    Cisco Contact Center Enterprise Solution Offer Disclosure · Data Centers paragraph · Checked 2026-09-05
  18. 18
    The Contact Center Enterprise Solution disclosure states that because the solution is not hosted or operated by Cisco it is provided without sending personal data to any third-party service providers.
    Cisco Contact Center Enterprise Solution Offer Disclosure · storage and processing section · Checked 2026-09-05
  19. 19
    The Contact Center Enterprise Solution disclosure states of the outbound campaign contact list and of termination call detail records that the personal data is unencrypted and that the customer may elect to apply IPsec or TLS for data in transit and self-managed encryption.
    Cisco Contact Center Enterprise Solution Offer Disclosure · Table 1 rows Outbound Campaign Contact List and Termination Call Detail records · Checked 2026-09-05
  20. 20
    Other document types observed in the sample include Statement of Volatility ISO Transfer Impact Assessment AI Transparency Penetration Test CSA STAR White Paper ENS SLO SLA CAIQ SOC 2 C5 Security Brief Corporate Policy SOC 3 Transparency Report DORA Disclosure TX-RAMP SIG HIPAA PCI DSS FedRAMP ISMAP FIPS 140-2 EU COC HDS and Common Criteria.field report
    Cisco Trust Portal document search endpoint · twenty query census of the Trust Portal search endpoint on 2026-09-05 · Checked 2026-09-05
  21. 21
    The persistence of a privacydatasheet path for documents titled Offer Disclosure together with older documents that still use the words Privacy Data Sheet in their body is consistent with the document type having been renamed from Privacy Data Sheet to Offer Disclosure.inferred
    Cisco Trust Portal document search endpoint · twenty query census of the Trust Portal search endpoint on 2026-09-05 together with the wording of the Transfer Impact Assessment and the two Enterprise disclosures · Checked 2026-09-05
  22. 22
    3 of the 4 disclosures read follow the same section order: an overview then data handling with collection purpose and retention then storage and processing then access and sharing then security with access control and encryption and reports and resources and finally artificial intelligence.field report
    Cisco Webex Contact Center Service Offer Disclosure · section headings compared across four documents · Checked 2026-09-05
  23. 23
    The Cisco Trust Portal exposes an undocumented and unversioned search endpoint that accepts an Elasticsearch style query body and returns document names types identifiers and URLs.field report
    Cisco Trust Portal document search endpoint · endpoint behaviour observed on 2026-09-05 · Checked 2026-09-05
  24. 24
    Section numbers are not portable across Offer Disclosures because the on-premises Contact Center Enterprise Solution disclosure folds data handling into section 1 and numbers security as section 2 while the 3 cloud disclosures number data handling 2 and security 3.field report
    Cisco Contact Center Enterprise Solution Offer Disclosure · section headings compared across four documents · Checked 2026-09-05
  25. 25
    The Webex Customer Experience service level agreement and service level objective is a separate document type that states availability commitments and is not where data handling or retention is published.
    Webex Customer Experience Service Level Agreement and Service Level Objective · whole document · Checked 2026-09-05
  26. 26
    An Offer Disclosure distinguishes subcontractors which assist with broader data processing services from subprocessors which specifically process personal data on Cisco's behalf to support the functionality of the offer.
    Cisco Contact Center Enterprise Solution Offer Disclosure · storage and processing section · Checked 2026-09-05
  27. 27
    Table numbering within a disclosure can skip: the Webex Contact Center Enterprise disclosure labels a table Table 5 although it contains no Table 4 because it merges subcontractors and subprocessors into a single table.
    Cisco Webex Contact Center Enterprise Offer Disclosure · Table 5 · Checked 2026-09-05
  28. 28
    Table 1 in an Offer Disclosure lists customer content data categories and the count varies by offer from 2 categories in the Webex Contact Center Enterprise disclosure to 11 in the on-premises Contact Center Enterprise Solution disclosure.field report
    Cisco Contact Center Enterprise Solution Offer Disclosure · Table 1 compared across four documents · Checked 2026-09-05
  29. 29
    Table 2 in an Offer Disclosure lists customer systems information categories and is where retention periods for telemetry events and configuration data are published.field report
    Cisco Webex Contact Center Service Offer Disclosure · Table 2 · Checked 2026-09-05
  30. 30
    Table 3 in a cloud Offer Disclosure lists data centre locations and the Webex Contact Center disclosure lists 12 Cisco locations plus 11 AWS regions while the Webex Contact Center Enterprise disclosure lists 7 Cisco locations and names no AWS regions and the Webex Engage disclosure lists 7 AWS regions and names no Cisco owned data centre.
    Cisco Webex Contact Center Service Offer Disclosure · Table 3 compared across three cloud documents · Checked 2026-09-05
  31. 31
    The access and controls table is numbered Table 6 in all 3 cloud disclosures and Table 3 in the on-premises Contact Center Enterprise Solution disclosure.field report
    Cisco Contact Center Enterprise Solution Offer Disclosure · access and controls table across four documents · Checked 2026-09-05
  32. 32
    Cisco publishes 3 separate contact centre offer disclosures: 1 for the Webex Contact Center Service 1 for Webex Contact Center Enterprise and 1 for the Cisco Contact Center Enterprise Solution.
    Cisco Contact Center Enterprise Solution Offer Disclosure · document titles across three disclosures · Checked 2026-09-05
  33. 33
    A Transfer Impact Assessment is a different document type from an Offer Disclosure and the Webex Contact Center 1 runs to about 4,000 characters against 46,000 for the disclosure and points to resources rather than publishing data handling tables.inferred
    Cisco Webex Contact Center Transfer Impact Assessment Resources · whole document compared with the Offer Disclosure · Checked 2026-09-05
  34. 34
    Trust Portal document PDFs under a c slash dam slash r slash ctp slash docs path are retrievable directly with an ordinary HTTP client and the 404 behaviour previously recorded for this host applies to its application routes rather than to these document paths.field report
    Cisco Trust Portal document search endpoint · retrieval of nine technical notes and four disclosures on 2026-09-05 · Checked 2026-09-05
  35. 35
    Offer Disclosures are served from 2 URL path prefixes: a legacy privacydatasheet path and a current offer-disclosure path with 136 and 116 of the 270 observed disclosures on each respectively.field report
    Cisco Trust Portal document search endpoint · twenty query census of the Trust Portal search endpoint on 2026-09-05 · Checked 2026-09-05
  36. 36
    55 distinct document type values were observed across 865 deduplicated Cisco Trust Portal documents in a 20 query sample taken on 5 September 2026.field report
    Cisco Trust Portal document search endpoint · twenty query census of the Trust Portal search endpoint on 2026-09-05 · Checked 2026-09-05
  37. 37
    An Offer Disclosure is a Cisco document type that states for 1 named offer what personal data it handles for what purpose how long it is kept where it is stored and processed who it is shared with and what security controls apply.inferred
    Cisco Webex Contact Center Service Offer Disclosure · preamble and section headings · Checked 2026-09-05
  38. 38
    The Cisco Webex Contact Center Service Offer Disclosure is the document covering the cloud contact centre product, and it carries the full section set: an overview, data handling with tables 1 to 3, security with the access and controls table at table 6, and an artificial intelligence section with table 7.
    Cisco Webex Contact Center Service Offer Disclosure · title page and section headings · Checked 2026-09-05
  39. 39
    The Webex Contact Center Enterprise Offer Disclosure encodes its ff fi fl and ffi ligatures as Private Use Area codepoints so extracted text contains an unmapped character in place of each ligature.
    Cisco Webex Contact Center Enterprise Offer Disclosure · whole document text layer · Checked 2026-09-05
  40. 40
    The Webex Contact Center Enterprise Offer Disclosure contains 50 Private Use Area ligature characters: U+E023 for "fi", U+E026 for "ff", U+E025 for "fl", and U+E027 for "ffi"; a plain-text search of the document for "Offer" returns 1 hit instead of the actual 15 occurrences.
    Cisco Webex Contact Center Enterprise Offer Disclosure · whole document text layer · Checked 2026-09-05

Documents

tier 2 current vendor documentation

Cisco Contact Center Enterprise Solution Offer Disclosure

Cisco Systems, Inc. (Cisco Trust Portal) · accessed 2026-09-05

tier 2 current vendor documentation

Cisco Trust Portal document search endpoint

Cisco Systems, Inc. (Cisco Trust Portal) · accessed 2026-09-05

tier 2 current vendor documentation

Cisco Webex Contact Center Enterprise Offer Disclosure

Cisco Systems, Inc. (Cisco Trust Portal) · 2025-09-01 · accessed 2026-09-05

tier 2 current vendor documentation

Cisco Webex Contact Center Service Offer Disclosure

Cisco Systems, Inc. (Cisco Trust Portal) · 2026-06-01 · accessed 2026-09-05

tier 2 current vendor documentation

Cisco Webex Contact Center Transfer Impact Assessment Resources

Cisco Systems, Inc. (Cisco Trust Portal) · 2024-04-17 · accessed 2026-09-05

tier 2 current vendor documentation

Cisco Webex Engage Offer Disclosure

Cisco Systems, Inc. (Cisco Trust Portal) · 2025-09-01 · accessed 2026-09-05

tier 2 current vendor documentation

Data Protection Agreement (DPA)

Cisco Systems · accessed 2026-09-30

tier 2 current vendor documentation

Webex Customer Experience Service Level Agreement and Service Level Objective

Cisco Systems, Inc. (Cisco Trust Portal) · 2025-07-01 · accessed 2026-09-05

tier 4 archived vendor documentation

Prioritizing security, privacy, and trust in the AI era (FY25 Purpose Report)

Cisco Systems · 2026-04-08 · accessed 2026-09-30

tier 4 archived vendor documentation

Security, Privacy, and Trust (Purpose Reporting Hub)

Cisco Systems · accessed 2026-09-30

Cite this page

APA

WarmTransfer. (2026, September 30). Cisco offer disclosures as an evidence class. WarmTransfer. https://warmtransfer.net/knowledge/cisco-offer-disclosures

BibTeX

@misc{warmtransfer-cisco-offer-disclosures,
  title  = {Cisco offer disclosures as an evidence class},
  author = {{WarmTransfer}},
  year   = {2026},
  url    = {https://warmtransfer.net/knowledge/cisco-offer-disclosures},
  note   = {Verified 2026-09-30}
}