Cisco offer disclosures as an evidence class

Verified 2026-09-05 · 36 claims · sources tier 2

Also known as CAIQ, CSA STAR, Common Control Framework, Offer Disclosure, Privacy Data Sheet, Statement of Volatility, Transfer Impact Assessment, Trust Package, Trust Portal, subcontractor, subprocessor.

WarmTransfer's reading of the sources is that an Offer Disclosure is a Cisco document type that states for 1 named offer what personal data it handles, for what purpose, how long it is kept, where it is stored and processed, who it is shared with, and what security controls apply 33. An Offer Disclosure states that it complements the General Disclosures and the Cisco Online Privacy Statement, and each disclosure carries its own precedence and annual review wording in its preamble 6.

Document scope and structure

WarmTransfer's reading of the sources is that an Offer Disclosure is scoped to a commercial offer rather than to a product family, so a customer buying 2 Cisco contact centre offers is covered by 2 different disclosures 5. Cisco publishes 3 separate contact centre offer disclosures: 1 for the Webex Contact Center Service 1 for Webex Contact Center Enterprise and 1 for the Cisco Contact Center Enterprise Solution 28. The Cisco Webex Contact Center Service Offer Disclosure is the document covering the cloud contact centre product, and it carries the full section set: an overview, data handling with tables 1 to 3, security with the access and controls table at table 6, and an artificial intelligence section with table 7 34.

In the field, 3 of the 4 disclosures read follow the same section order: an overview, then data handling with collection purpose and retention, then storage and processing, then access and sharing, then security with access control and encryption and reports and resources, and finally artificial intelligence 18. However, field reports suggest section numbers are not portable across Offer Disclosures because the on-premises Contact Center Enterprise Solution disclosure folds data handling into section 1 and numbers security as section 2, while the 3 cloud disclosures number data handling 2 and security 3 20.

Field reports suggest Table 1 in an Offer Disclosure lists customer content data categories, and the count varies by offer from 2 categories in the Webex Contact Center Enterprise disclosure to 11 in the on-premises Contact Center Enterprise Solution disclosure 24. In the field, Table 2 lists customer systems information categories and is where retention periods for telemetry events and configuration data are published 25. In the field, the access and controls table is numbered Table 6 in all 3 cloud disclosures and Table 3 in the on-premises Contact Center Enterprise Solution disclosure 27. Table numbering within a disclosure can also skip; for example, the Webex Contact Center Enterprise disclosure labels a table Table 5 although it contains no Table 4 because it merges subcontractors and subprocessors into a single table 23.

Storage, processing, and third parties

An Offer Disclosure distinguishes subcontractors, which assist with broader data processing services, from subprocessors, which specifically process personal data on Cisco's behalf to support the functionality of the offer 22.

Table 3 in a cloud Offer Disclosure lists data centre locations, and the Webex Contact Center disclosure lists 12 Cisco locations plus 11 AWS regions, while the Webex Contact Center Enterprise disclosure lists 7 Cisco locations and names no AWS regions, and the Webex Engage disclosure lists 7 AWS regions and names no Cisco owned data centre 26. The Webex Engage disclosure names 5 subprocessors: Amazon Web Services, Mailgun, Sendgrid, Maxmind, and Meta 7.

In contrast, the Contact Center Enterprise Solution disclosure states that the offer does not rely on its own data centres or third-party operated co-location facilities, that it is an on-premise solution, and that the location of data centres is determined by the customer 13. That disclosure states that because the solution is not hosted or operated by Cisco, it is provided without sending personal data to any third-party service providers 14. It also states of the outbound campaign contact list and of termination call detail records that the personal data is unencrypted, and that the customer may elect to apply IPsec or TLS for data in transit and self-managed encryption 15. WarmTransfer's reading of the sources is that where the on-premises disclosure omits the data centre, subprocessor, and artificial intelligence sections, it says why rather than leaving them blank 12.

Artificial intelligence disclosures

The generative and agentic AI table lists 7 features in the Webex Contact Center disclosure and 5 in the Webex Contact Center Enterprise disclosure 2. The Webex Engage disclosure contains no artificial intelligence section and no generative and agentic AI table 1.

Distinction from other document types

WarmTransfer's reading of the sources is that a Transfer Impact Assessment is a different document type from an Offer Disclosure, noting that the Webex Contact Center 1 runs to about 4,000 characters against 46,000 for the disclosure and points to resources rather than publishing data handling tables 29. The Webex Customer Experience service level agreement and service level objective is also a separate document type that states availability commitments and is not where data handling or retention is published 21.

In the field, 55 distinct document type values were observed across 865 deduplicated Cisco Trust Portal documents in a 20 query sample taken on 5 September 2026 32. Field reports suggest Offer Disclosure was the most frequent document type in the sample at 270 of the 865 documents observed 11. In the field, other document types observed in the sample include Statement of Volatility ISO Transfer Impact Assessment AI Transparency Penetration Test CSA STAR White Paper ENS SLO SLA CAIQ SOC 2 C5 Security Brief Corporate Policy SOC 3 Transparency Report DORA Disclosure TX-RAMP SIG HIPAA PCI DSS FedRAMP ISMAP FIPS 140-2 EU COC HDS and Common Criteria 16. Field reports suggest 41 documents carrying the AI Transparency type were observed in the sample, which is more than the 9 contact centre notes this corpus has catalogued 3.

Portal distribution and extraction patterns

Field reports suggest Offer Disclosures are served from 2 URL path prefixes: a legacy privacydatasheet path and a current offer-disclosure path, with 136 and 116 of the 270 observed disclosures on each respectively 31. WarmTransfer's reading of the sources is that the persistence of a privacydatasheet path for documents titled Offer Disclosure, together with older documents that still use the words Privacy Data Sheet in their body, is consistent with the document type having been renamed from Privacy Data Sheet to Offer Disclosure 17.

In the field, localised Trust Portal documents carry a locale segment in the path, and 51 French and 23 Japanese offer disclosures were observed in the sample against 196 with no locale segment 10. In the field, Trust Portal document paths carry a product family segment, and the families observed include collaboration, security, services, software, datacenter, DNA, and iot 9. Field reports suggest some Trust Portal records carry several document types and no document URL of their own, acting as per-product compliance bundles rather than as documents 4.

Field reports suggest the Cisco Trust Portal exposes an undocumented and unversioned search endpoint that accepts an Elasticsearch style query body and returns document names, types, identifiers, and URLs 19. Furthermore, field reports suggest Trust Portal document PDFs under a c slash dam slash r slash ctp slash docs path are retrievable directly with an ordinary HTTP client, and the 404 behaviour previously recorded for this host applies to its application routes rather than to these document paths 30.

WarmTransfer's reading of the sources is that a document type existing for 1 product is no evidence that it exists for another, and an expected but absent disclosure must be treated as unknown rather than assumed 8. When extracting text, the Webex Contact Center Enterprise Offer Disclosure encodes its ff, fi, fl, and ffi ligatures as Private Use Area codepoints, so extracted text contains an unmapped character in place of each ligature 35. Specifically, the Webex Contact Center Enterprise Offer Disclosure contains 50 Private Use Area ligature characters: U+E023 for "fi", U+E026 for "ff", U+E025 for "fl", and U+E027 for "ffi"; a plain-text search of the document for "Offer" returns 1 hit instead of the actual 15 occurrences 36.

See also

See also The Cisco Trust Portal as a monitorable document source. See also Webex Contact Center Enterprise as a distinct product. See also Webex Engage as the digital channel product. See also Cisco AI transparency technical notes. See also The Cisco AI transparency note set beyond the contact centre. See also Cisco Statement of Volatility as a document type. See also Cisco DORA Disclosure as a document type. See also Webex Contact Center data locality by country. See also Webex Contact Center recording and contact data retention. See also Third-party model and speech vendors behind Webex contact centre AI. See also Webex service level agreements and objectives. See also Fidelity of the corpus text extraction pipeline.

Applicability

Across the claims in this article, the evidence covers Cisco Trust Portal, Cisco Webex Contact Center Enterprise, Cisco Webex Engage, Cisco Contact Center Enterprise Solution, and Cisco Webex Contact Center across cloud and on-premises deployments, verified as of 2026-09-05.

What remains uncertain

Whether two different post-termination retention periods appear in 1 Webex CCE table cell is not covered by any claim in this article. The details of the 41 AI Transparency documents beyond the 9 contact centre notes are not covered by any claim in this article. What a DORA Disclosure covers is not covered by any claim in this article. Which specific Cisco offers have a disclosure and which do not is not covered by any claim in this article. Whether the Trust Portal search endpoint is stable enough to depend on is not covered by any claim in this article. Retention values in the Contact Center Enterprise Solution disclosure are not covered by any claim in this article. The true total size of the Cisco Trust Portal is not covered by any claim in this article. Whether a compliance bundle record lists every document for a product is not covered by any claim in this article.

WarmTransfer. (2026, September 5). Cisco offer disclosures as an evidence class. WarmTransfer. https://warmtransfer.net/knowledge/cisco-offer-disclosures

@misc{warmtransfer-cisco-offer-disclosures,
  title  = {Cisco offer disclosures as an evidence class},
  author = {{WarmTransfer}},
  year   = {2026},
  url    = {https://warmtransfer.net/knowledge/cisco-offer-disclosures},
  note   = {Verified 2026-09-05}
}