How many subprocessors does Intruder use?

Intruder lists 17 subprocessors on its published list, including Google Cloud Platform, Anthropic, Posthog, Hubspot, and BuildBetter and 12 more.

Where does Intruder process customer data?

The subprocessors named by Intruder are located in United States, United Kingdom, EU, Ireland, United States of America, and United states and 1 other locations, as stated on its list.

Does Intruder use customer data to train AI models?

According to its terms of service, Intruder does not use customer data to train AI models: “Customer data ingested by the AI Pentest is not used to train, fine-tune or otherwise improve any AI model.”

How quickly does Intruder report a personal data breach to customers?

According to its DPA, Intruder reports a personal data breach to customers without undue delay, with no set deadline: “Supplier shall notify Customer without undue delay after becoming aware of a Personal Data Breach.”

How much notice does Intruder give before adding a subprocessor?

Intruder's DPA gives 7 days' notice of a new subprocessor, the time customers have to object: “Customer shall be deemed to have approved the engagement of the Sub-processor if it has not served a notice in writing on Supplier objecting (in accordance with this clause 2.6(a)(v)) to such appointment within seven days of the date that the notice is deemed to be received by Customer in accordance with clause 2.6(a)(ii)”

Which security certifications does Intruder list?

Intruder's trust page lists HIPAA.

When was Intruder's subprocessor list last checked?

ClauseTrail last checked Intruder's subprocessor list on November 2, 2026. Lists are re-checked daily.

How do I find out when Intruder adds or removes a subprocessor?

ClauseTrail monitors Intruder's subprocessor list, DPA, privacy policy and terms and emails you the exact change — who was added or removed and what the page said before and after. The first vendors are free.

Intruder Subprocessors List (November 2026): Changes and History

Intruder names 17 subprocessors on its published list. Read from the vendor's own page and re-checked daily.

Last checked November 2, 2026 Official source ↗

Intruder subprocessors (November 2026)

#	Subprocessor	Purpose	Location
1	Google Cloud Platform	Cloud infrastructure	United Kingdom
2	Anthropic	AI usage for employees via claude.ai, LLM models for Intruder portal via claude API	United States
3	Posthog	Product analytics	EU
4	Hubspot	CRM	United States
5	BuildBetter	AI call recording and customer feedback analysis	United States
6	Intercom	Client interaction and customer support	United States
7	Elastic Cloud	Log storage and analysis application	United Kingdom
8	ChartMogul	Financial analytics and tracking	EU
9	Count	Data analysis platform	United Kingdom
10	Fivetran	Fivetran is the automated data movement platform moving data out of, into and across your cloud data platforms.	EU
11	Jiminny	Call recording and Coaching software for sales & CS	United States of America, Ireland, the United Kingdom
12	Lunos.ai	Accounts receivable automation	United states
13	Sendgrid	Send emails from Intruder portal	United States
14	Slack	Team communication	United States
15	Stripe	Card payments processor	United States, Ireland
16	Xero	Accounting system	United Kingdom
17	Zapier	API connector	United States

Get an email when Intruder changes its subprocessors

ClauseTrail re-checks this list every day and tells you exactly who was added or removed — including when a vendor starts sending data to an AI provider. The first vendors are free.

Track Intruder free

AI and customer data at Intruder

What Intruder's own documents say, with the sentence each answer comes from.

Trains AI models on customer data: No

“Customer data ingested by the AI Pentest is not used to train, fine-tune or otherwise improve any AI model.”
Terms of service, www.intruder.io ↗
Sends customer data to AI model providers: Yes

“AI model providers used in delivering the AI Pentest act as sub-processors.”
Terms of service, www.intruder.io ↗
How to opt out: Not stated in the documents we track.
How long AI features keep data: Source code and other data ingested by the AI Pentest are processed only within the testing container for the engagement and deleted on teardown, with any retained excerpts deleted within 30 days.

“Notwithstanding section 3(a), source code excerpts may be retained for improving the AI Pentest service, but will be deleted within 30 days of engagement teardown.”
Terms of service, www.intruder.io ↗

Key DPA terms at Intruder

What Intruder's data processing agreement commits to, with the sentence each answer comes from.

Breach notification: Without undue delay, with no set deadline

“Supplier shall notify Customer without undue delay after becoming aware of a Personal Data Breach.”
DPA, www.intruder.io ↗
Notice of a new subprocessor: 7 days ahead

“Customer shall be deemed to have approved the engagement of the Sub-processor if it has not served a notice in writing on Supplier objecting (in accordance with this clause 2.6(a)(v)) to such appointment within seven days of the date that the notice is deemed to be received by Customer in accordance with clause 2.6(a)(ii)”
DPA, www.intruder.io ↗
Customer data after the contract ends: Deleted or returned when the contract ends

“Upon termination of Services that required the Processing of Customer Personal Data (in whole or in part) Supplier shall, at the election of Customer, deliver up or destroy such Customer Personal Data which is in the possession of, or under the control of, Supplier unless European Law requires Supplier to store such Customer Personal Data.”
DPA, www.intruder.io ↗
Audit rights: Once a year

“the Customer may perform such audits no more than once per year, save that further audits may be performed if an audit reveals any material non-compliance”
DPA, www.intruder.io ↗

Certifications at Intruder

What Intruder's trust page lists, with the text each one comes from.

HIPAA: Active

“ComplianceSOC 2, ISO, HIPAA, DORA”
Trust page, www.intruder.io ↗

Documents we track for Intruder

DPA: checked November 3, 2026 www.intruder.io ↗
Privacy policy: checked November 3, 2026 www.intruder.io ↗
Subprocessor list: checked November 2, 2026 trust.intruder.io ↗
Terms of service: checked November 3, 2026 changed November 1, 2026 www.intruder.io ↗
Trust page: checked November 3, 2026 www.intruder.io ↗

Change history

October 30, 2026 – November 1, 2026 2 minor wording edits (Terms of service) Show Hide Reworded without changing what the documents say.
1. November 1, 2026
  
  Terms of service changed
  
  The Terms of Service renumbers sections 11 through 17 (now 12-17) to make room for a new header "11 Sexual Harassment Policy" that labels the existing anti-harassment clause, and the full text of the separate Sexual Harassment Policy (previously duplicated inline on the page) along with its menu link have been removed, leaving only a reference to it "available here."
2. October 30, 2026
  
  Terms of service changed
  
  The Sexual Harassment Policy notice (five sentences) was moved from its position after clause 5.3 to a new position after clause 10.7, with no change to its wording.

Tracking since October 21, 2026. Every change links to the two versions of the document it came from. All vendors' changes →

Intruder subprocessors FAQ

How many subprocessors does Intruder use?: Intruder lists 17 subprocessors on its published list, including Google Cloud Platform, Anthropic, Posthog, Hubspot, and BuildBetter and 12 more.
Where does Intruder process customer data?: The subprocessors named by Intruder are located in United States, United Kingdom, EU, Ireland, United States of America, and United states and 1 other locations, as stated on its list.
Does Intruder use customer data to train AI models?: According to its terms of service, Intruder does not use customer data to train AI models: “Customer data ingested by the AI Pentest is not used to train, fine-tune or otherwise improve any AI model.”
How quickly does Intruder report a personal data breach to customers?: According to its DPA, Intruder reports a personal data breach to customers without undue delay, with no set deadline: “Supplier shall notify Customer without undue delay after becoming aware of a Personal Data Breach.”
How much notice does Intruder give before adding a subprocessor?: Intruder's DPA gives 7 days' notice of a new subprocessor, the time customers have to object: “Customer shall be deemed to have approved the engagement of the Sub-processor if it has not served a notice in writing on Supplier objecting (in accordance with this clause 2.6(a)(v)) to such appointment within seven days of the date that the notice is deemed to be received by Customer in accordance with clause 2.6(a)(ii)”
Which security certifications does Intruder list?: Intruder's trust page lists HIPAA.
When was Intruder's subprocessor list last checked?: ClauseTrail last checked Intruder's subprocessor list on November 2, 2026. Lists are re-checked daily.
How do I find out when Intruder adds or removes a subprocessor?: ClauseTrail monitors Intruder's subprocessor list, DPA, privacy policy and terms and emails you the exact change — who was added or removed and what the page said before and after. The first vendors are free.