How many subprocessors does Hugging Face use?

Hugging Face lists 15 subprocessors on its published list, including 🗓 Last Updated, Subprocessor, Discourse, Zendesk, and AWS SES and 10 more.

Where does Hugging Face process customer data?

The subprocessors named by Hugging Face are located in United States, EMEA, France, and Location of Processing, as stated on its list.

How quickly does Hugging Face report a personal data breach to customers?

According to its DPA, Hugging Face reports a personal data breach to customers within 72 hours: “Provider shall notify Customer without undue delay, and in any event within 72 hours after Provider becomes aware of a Security Breach.”

How much notice does Hugging Face give before adding a subprocessor?

Hugging Face's DPA gives 30 days' notice of a new subprocessor, the time customers have to object: “If Customer objects to such engagement in a written notice to Provider within 30 days after the publication of the updated list on reasonable grounds relating to the protection of Personal Data”

How does Hugging Face transfer personal data outside the EU?

Hugging Face's DPA relies on standard contractual clauses: “such transfer will be governed by the EU SCCs, the terms of which are hereby incorporated into this DPA.”

When was Hugging Face's subprocessor list last checked?

ClauseTrail last checked Hugging Face's subprocessor list on October 1, 2026. Lists are re-checked daily.

How do I find out when Hugging Face adds or removes a subprocessor?

ClauseTrail monitors Hugging Face's subprocessor list, DPA, privacy policy and terms and emails you the exact change — who was added or removed and what the page said before and after. The first vendors are free.

Hugging Face Subprocessors List (October 2026): Changes and History

Hugging Face names 15 subprocessors on its published list. Read from the vendor's own page and re-checked daily.

Last checked October 1, 2026 Official source ↗

Hugging Face subprocessors (October 2026)

#	Subprocessor	Purpose	Location
1	🗓 Last Updated	January 23, 2025	—
2	Subprocessor	Description of Subprocessing	Location of Processing
3	Discourse	Forum	United States
4	Zendesk	Support platform	United States
5	AWS SES	Emails	United States
6	Stripe	Payment	United States
7	Google Cloud Platform	Hosting/Infrastructure	United States, EMEA
8	Circle CI Software	Integration and testing platform	United States
9	Github	Hosting code	United States
10	Amazon Web Services, Inc.	Hosting/Infrastructure	United States
11	Azure	Hosting/Infrastructure	United States
12	Google Analytics	Analytics	United States
13	Slack Technologies	Communication	United States
14	MongoDB Atlas	Database	United States
15	Hugging Face SAS	All of the above	France

Get an email when Hugging Face changes its subprocessors

ClauseTrail re-checks this list every day and tells you exactly who was added or removed — including when a vendor starts sending data to an AI provider. The first vendors are free.

Track Hugging Face free

Key DPA terms at Hugging Face

What Hugging Face's data processing agreement commits to, with the sentence each answer comes from. SCCs or the Data Privacy Framework: what's the difference?

Breach notification: Within 72 hours

“Provider shall notify Customer without undue delay, and in any event within 72 hours after Provider becomes aware of a Security Breach.”
DPA, cdn-media.huggingface.co ↗
Notice of a new subprocessor: 30 days ahead

“If Customer objects to such engagement in a written notice to Provider within 30 days after the publication of the updated list on reasonable grounds relating to the protection of Personal Data”
DPA, cdn-media.huggingface.co ↗
Transfers outside the EU: Standard contractual clauses

“such transfer will be governed by the EU SCCs, the terms of which are hereby incorporated into this DPA.”
DPA, cdn-media.huggingface.co ↗
Customer data after the contract ends: Deleted within 180 days of the contract ending

“Provider will comply with such instruction as soon as reasonably practicable and no later than 180 days after such expiration or termination, unless Applicable Data Protection Laws require storage.”
DPA, cdn-media.huggingface.co ↗
Audit rights: Once a year

“Customer may audit Provider's compliance with its obligations under this DPA up to once per year as required by Applicable Data Privacy Laws”
DPA, cdn-media.huggingface.co ↗

Documents we track for Hugging Face

DPA: checked October 1, 2026 cdn-media.huggingface.co ↗
Privacy policy: checked September 30, 2026 huggingface.co ↗
Subprocessor list: checked October 1, 2026 cdn-media.huggingface.co ↗
Terms of service: checked September 30, 2026 huggingface.co ↗

Change history

Tracking since October 1, 2026. No change has been published since; additions, removals and document changes will appear here as they're published.

Hugging Face subprocessors FAQ

How many subprocessors does Hugging Face use?: Hugging Face lists 15 subprocessors on its published list, including 🗓 Last Updated, Subprocessor, Discourse, Zendesk, and AWS SES and 10 more.
Where does Hugging Face process customer data?: The subprocessors named by Hugging Face are located in United States, EMEA, France, and Location of Processing, as stated on its list.
How quickly does Hugging Face report a personal data breach to customers?: According to its DPA, Hugging Face reports a personal data breach to customers within 72 hours: “Provider shall notify Customer without undue delay, and in any event within 72 hours after Provider becomes aware of a Security Breach.”
How much notice does Hugging Face give before adding a subprocessor?: Hugging Face's DPA gives 30 days' notice of a new subprocessor, the time customers have to object: “If Customer objects to such engagement in a written notice to Provider within 30 days after the publication of the updated list on reasonable grounds relating to the protection of Personal Data”
How does Hugging Face transfer personal data outside the EU?: Hugging Face's DPA relies on standard contractual clauses: “such transfer will be governed by the EU SCCs, the terms of which are hereby incorporated into this DPA.”
When was Hugging Face's subprocessor list last checked?: ClauseTrail last checked Hugging Face's subprocessor list on October 1, 2026. Lists are re-checked daily.
How do I find out when Hugging Face adds or removes a subprocessor?: ClauseTrail monitors Hugging Face's subprocessor list, DPA, privacy policy and terms and emails you the exact change — who was added or removed and what the page said before and after. The first vendors are free.