How many subprocessors does GitGuardian use?

GitGuardian lists 23 subprocessors on its published list, including Amazon Web services (AWS), Auth0, Customer.io, Datadog, and GitHub and 18 more.

Where does GitGuardian process customer data?

The subprocessors named by GitGuardian are located in United States, Europe, Germany, Canada, and Sweden, as stated on its list.

How quickly does GitGuardian report a personal data breach to customers?

According to its DPA, GitGuardian reports a personal data breach to customers within 72 hours: “notify you without undue delay, but in no event in more than 72 hours, after becoming aware of the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Personal Data”

How much notice does GitGuardian give before adding a subprocessor?

GitGuardian's DPA gives 10 days' notice of a new subprocessor, the time customers have to object: “If you object in writing within ten (10) days at the latest to the proposed subcontracting on reasonable grounds relating to the protection of the Personal Data”

How does GitGuardian transfer personal data outside the EU?

GitGuardian's DPA relies on standard contractual clauses and adequacy decisions: “GitGuardian shall perform such Processing in accordance with the SCC, which are incorporated into this DPA by reference”

Does GitGuardian have a SOC 2 Type II report?

Yes. GitGuardian's trust page lists a SOC 2 Type II report: “Compliance: SOC 2 Type II (maintained since 2022). Auditor: Prescient Assurance.”

Which security certifications does GitGuardian list?

GitGuardian's trust page lists SOC 2 Type II.

When was GitGuardian's subprocessor list last checked?

ClauseTrail last checked GitGuardian's subprocessor list on September 28, 2026. Lists are re-checked daily.

How do I find out when GitGuardian adds or removes a subprocessor?

ClauseTrail monitors GitGuardian's subprocessor list, DPA, privacy policy and terms and emails you the exact change — who was added or removed and what the page said before and after. The first vendors are free.

GitGuardian Subprocessors List (September 2026): Changes and History

GitGuardian names 23 subprocessors on its published list. Read from the vendor's own page and re-checked daily.

Last checked September 28, 2026 Official source ↗

GitGuardian subprocessors (September 2026)

#	Subprocessor	Purpose	Location
1	Amazon Web services (AWS)	Cloud Service provider, hosting Platform and Public Monitoring; Generative AI technology used to enhance AI features (AWS Bedrock)	United States, Germany
2	Auth0	Authentication service for Public Monitoring customers	United States
3	Customer.io	Data analytics allowing user dashboard, behavior monitoring and profile data on Platform and Public Monitoring	United States
4	Datadog	Workload monitoring	United States
5	GitHub	Source code management for ggshield	United States
6	Sentry	Cloud service monitoring errors and performance for our web applications	United States
7	Segment	Customer data platform	United States
8	Sendgrid	Email sending service	United States
9	OVH	Cloud and bare metal hosting provider that hosts development servers, and internal services such as our main source code management instance.	Europe, Canada
10	Snowflake	Data Warehouse (Dwaas)	United States
11	Amplitude	Product usage data visualization	United States
12	Beamer	In-app notifications and surveys	United States
13	Cloudflare Inc.	Web Application Firewall (WAF)	United States, Germany
14	Google LLC	Cloud Infrastructure, email and office applications; AI model hosting and inference used to enhance AI features (Gemini and Vertex AI)	United States, Europe
15	Zendesk	Customer Support Platform	United States, Europe
16	Coralogix	Observability (log analytics, monitoring, and error tracking)	Sweden
17	Supabase	Backend database services for internal operational tooling	United States
18	OpenAI	AI/ML services for specific AI-driven capabilities	United States
19	ClickHouse, Inc.	Managed OLAP database for high-scale analytics, search and feature computation across the GitGuardian platform	United States, Europe
20	LangChain, Inc. (LangSmith)	LLM observability and evaluation for Al-assisted features	United States, Europe
21	Anthropic, PBC	AI model hosting and inference used to enhance AI features (Claude); AI assistant used for internal business operations	United States
22	FUEL SASU (BlackFuel)	AI model hosting and inference for open-weight models, used to enhance AI features and for internal engineering operations	United States, Europe
23	Railway Corp.	Platform-as-a-service hosting for internal applications and proof-of-concepts	United States, Europe

Get an email when GitGuardian changes its subprocessors

ClauseTrail re-checks this list every day and tells you exactly who was added or removed — including when a vendor starts sending data to an AI provider. The first vendors are free.

Track GitGuardian free

Key DPA terms at GitGuardian

What GitGuardian's data processing agreement commits to, with the sentence each answer comes from. SCCs or the Data Privacy Framework: what's the difference?

Breach notification: Within 72 hours

“notify you without undue delay, but in no event in more than 72 hours, after becoming aware of the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Personal Data”
DPA, www.gitguardian.com ↗
Notice of a new subprocessor: 10 days ahead

“If you object in writing within ten (10) days at the latest to the proposed subcontracting on reasonable grounds relating to the protection of the Personal Data”
DPA, www.gitguardian.com ↗
Transfers outside the EU: Standard contractual clauses and adequacy decisions

“GitGuardian shall perform such Processing in accordance with the SCC, which are incorporated into this DPA by reference”

“other jurisdiction approved as having adequate legal protections for data by the European Commission”
DPA, www.gitguardian.com ↗
Customer data after the contract ends: Deleted or returned when the contract ends

“GitGuardian shall return your Data or, delete your Data in accordance with the procedures and timeframes specified in the Security Documentation, or upon written request from you approved by the GitGuardian.”
DPA, www.gitguardian.com ↗
Audit rights: Once a year

“You may, at your sole expense, and not more than once per calendar year, request to audit GitGuardian to verify compliance with the terms and conditions of this DPA”
DPA, www.gitguardian.com ↗

Certifications at GitGuardian

What GitGuardian's trust page lists, with the text each one comes from. SOC 2 Type I or Type II: what's the difference?

SOC 2 Type II: Active

“Compliance: SOC 2 Type II (maintained since 2022). Auditor: Prescient Assurance.”
Trust page, trust.gitguardian.com ↗

Documents we track for GitGuardian

AI terms: checked September 28, 2026 www.gitguardian.com ↗
DPA: checked September 28, 2026 www.gitguardian.com ↗
Privacy policy: checked September 28, 2026 www.gitguardian.com ↗
Subprocessor list: checked September 28, 2026 www.gitguardian.com ↗
Terms of service: checked September 28, 2026 www.gitguardian.com ↗
Trust page: checked September 28, 2026 trust.gitguardian.com ↗

Change history

Tracking since September 28, 2026. No change has been published since; additions, removals and document changes will appear here as they're published.

GitGuardian subprocessors FAQ

How many subprocessors does GitGuardian use?: GitGuardian lists 23 subprocessors on its published list, including Amazon Web services (AWS), Auth0, Customer.io, Datadog, and GitHub and 18 more.
Where does GitGuardian process customer data?: The subprocessors named by GitGuardian are located in United States, Europe, Germany, Canada, and Sweden, as stated on its list.
How quickly does GitGuardian report a personal data breach to customers?: According to its DPA, GitGuardian reports a personal data breach to customers within 72 hours: “notify you without undue delay, but in no event in more than 72 hours, after becoming aware of the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Personal Data”
How much notice does GitGuardian give before adding a subprocessor?: GitGuardian's DPA gives 10 days' notice of a new subprocessor, the time customers have to object: “If you object in writing within ten (10) days at the latest to the proposed subcontracting on reasonable grounds relating to the protection of the Personal Data”
How does GitGuardian transfer personal data outside the EU?: GitGuardian's DPA relies on standard contractual clauses and adequacy decisions: “GitGuardian shall perform such Processing in accordance with the SCC, which are incorporated into this DPA by reference”
Does GitGuardian have a SOC 2 Type II report?: Yes. GitGuardian's trust page lists a SOC 2 Type II report: “Compliance: SOC 2 Type II (maintained since 2022). Auditor: Prescient Assurance.”
Which security certifications does GitGuardian list?: GitGuardian's trust page lists SOC 2 Type II.
When was GitGuardian's subprocessor list last checked?: ClauseTrail last checked GitGuardian's subprocessor list on September 28, 2026. Lists are re-checked daily.
How do I find out when GitGuardian adds or removes a subprocessor?: ClauseTrail monitors GitGuardian's subprocessor list, DPA, privacy policy and terms and emails you the exact change — who was added or removed and what the page said before and after. The first vendors are free.