How many subprocessors does Malwarebytes use?

Malwarebytes lists 22 subprocessors on its published list, including Ada Support Inc., Amazon Web Services, Inc., Amplitude, Inc., Array US, Inc., and Atlassian Corporation Plc. and 17 more.

Where does Malwarebytes process customer data?

The subprocessors named by Malwarebytes are located in USA, Canada, and Sweden, as stated on its list.

How quickly does Malwarebytes report a personal data breach to customers?

According to its DPA, Malwarebytes reports a personal data breach to customers without undue delay, with no set deadline: “Company agrees to provide written notice without undue delay to Customer's Designated POC.”

How much notice does Malwarebytes give before adding a subprocessor?

Malwarebytes's DPA gives 10 days' notice of a new subprocessor, the time customers have to object: “Company shall notify Customer prior to engaging any new Subprocessor by updating the Subprocessor List and give Customer ten (10) days to object from the date the Subprocessor List is updated.”

How does Malwarebytes transfer personal data outside the EU?

Malwarebytes's DPA relies on standard contractual clauses and the EU–US Data Privacy Framework: “Company is a participant in the EU-U.S. Data Privacy Framework, the Swiss-U.S. Data Privacy Framework, and the UK Extension to the EU-U.S. Data Privacy Framework (collectively, the "Data Privacy Framework").”

When was Malwarebytes's subprocessor list last checked?

ClauseTrail last checked Malwarebytes's subprocessor list on September 28, 2026. Lists are re-checked daily.

How do I find out when Malwarebytes adds or removes a subprocessor?

ClauseTrail monitors Malwarebytes's subprocessor list, DPA, privacy policy and terms and emails you the exact change — who was added or removed and what the page said before and after. The first vendors are free.

Malwarebytes Subprocessors List (September 2026): Changes and History

Malwarebytes names 22 subprocessors on its published list. Read from the vendor's own page and re-checked daily.

Last checked September 28, 2026 Official source ↗

Malwarebytes subprocessors (September 2026)

#	Subprocessor	Purpose	Location
1	Ada Support Inc.	Chatbot	Canada
2	Amazon Web Services, Inc.	Hosting	USA
3	Amplitude, Inc.	Product Analytics	USA
4	Array US, Inc.	Identity Theft Protection and Data-Broker Removal Services	USA
5	Atlassian Corporation Plc.	Customer Feedback	USA
6	Calendly LLC	Book time with PM feature	USA
7	CloudFlare, Inc.	DNS Filtering	USA
8	Functional Software, Inc. d/b/a Sentry	Application performance monitoring & error tracking	USA
9	Gainsight, Inc.	Customer success and product experience	USA
10	Google LLC	Website Analytics	USA
11	Google LLC (Firebase)	Mobile app analytics and diagnostics	USA
12	Iterable, Inc.	Messaging Delivery	USA
13	Microsoft Corporation	Email	USA
14	Mullvad VPN AB	VPN	Sweden
15	OpenAI, LLC	AI-enabled functionality	USA
16	OVH US LLC dba OVHcloud	Hosting	USA
17	RevenueCat, Inc.	In-app purchase and subscription management	USA
18	Snowflake, Inc.	Telemetry Storage	USA
19	Sontiq, Inc. (a TransUnion company)	Identity Theft Protection Services	USA
20	tvScientific, Inc.	Connected TV advertising platform	USA
21	Twilio, Inc.	Identity verification and account security validation	USA
22	Zendesk Inc.	Customer Support	USA

Get an email when Malwarebytes changes its subprocessors

ClauseTrail re-checks this list every day and tells you exactly who was added or removed — including when a vendor starts sending data to an AI provider. The first vendors are free.

Track Malwarebytes free

Key DPA terms at Malwarebytes

What Malwarebytes's data processing agreement commits to, with the sentence each answer comes from. SCCs or the Data Privacy Framework: what's the difference?

Breach notification: Without undue delay, with no set deadline

“Company agrees to provide written notice without undue delay to Customer's Designated POC.”
DPA, www.malwarebytes.com ↗
Notice of a new subprocessor: 10 days ahead

“Company shall notify Customer prior to engaging any new Subprocessor by updating the Subprocessor List and give Customer ten (10) days to object from the date the Subprocessor List is updated.”
DPA, www.malwarebytes.com ↗
Transfers outside the EU: Standard contractual clauses and the EU–US Data Privacy Framework

“Company is a participant in the EU-U.S. Data Privacy Framework, the Swiss-U.S. Data Privacy Framework, and the UK Extension to the EU-U.S. Data Privacy Framework (collectively, the "Data Privacy Framework").”

“the parties agree that such transfer of Customer Personal Data shall be governed by the Standard Contractual Clauses and UK Addendum (as applicable), as set forth in Annex III.”
DPA, www.malwarebytes.com ↗
Customer data after the contract ends: Deleted or returned when the contract ends

“At the expiry or termination of the Agreement, Company will delete all Customer Personal Data (excluding any back-up or archival copies, which shall be deleted in accordance with Company's data retention schedule), except where Company is required to retain copies under applicable laws”
DPA, www.malwarebytes.com ↗
Audit rights: Once a year

“any audit or assessment shall be limited to once per year, unless an audit or assessment is carried out at the direction of a government authority having proper jurisdiction.”
DPA, www.malwarebytes.com ↗

Documents we track for Malwarebytes

DPA: checked September 28, 2026 www.malwarebytes.com ↗
Privacy policy: checked September 28, 2026 www.malwarebytes.com ↗
Subprocessor list: checked September 28, 2026 www.malwarebytes.com ↗
Terms of service: checked September 28, 2026 www.malwarebytes.com ↗

Change history

Tracking since September 28, 2026. No change has been published since; additions, removals and document changes will appear here as they're published.

Malwarebytes subprocessors FAQ

How many subprocessors does Malwarebytes use?: Malwarebytes lists 22 subprocessors on its published list, including Ada Support Inc., Amazon Web Services, Inc., Amplitude, Inc., Array US, Inc., and Atlassian Corporation Plc. and 17 more.
Where does Malwarebytes process customer data?: The subprocessors named by Malwarebytes are located in USA, Canada, and Sweden, as stated on its list.
How quickly does Malwarebytes report a personal data breach to customers?: According to its DPA, Malwarebytes reports a personal data breach to customers without undue delay, with no set deadline: “Company agrees to provide written notice without undue delay to Customer's Designated POC.”
How much notice does Malwarebytes give before adding a subprocessor?: Malwarebytes's DPA gives 10 days' notice of a new subprocessor, the time customers have to object: “Company shall notify Customer prior to engaging any new Subprocessor by updating the Subprocessor List and give Customer ten (10) days to object from the date the Subprocessor List is updated.”
How does Malwarebytes transfer personal data outside the EU?: Malwarebytes's DPA relies on standard contractual clauses and the EU–US Data Privacy Framework: “Company is a participant in the EU-U.S. Data Privacy Framework, the Swiss-U.S. Data Privacy Framework, and the UK Extension to the EU-U.S. Data Privacy Framework (collectively, the "Data Privacy Framework").”
When was Malwarebytes's subprocessor list last checked?: ClauseTrail last checked Malwarebytes's subprocessor list on September 28, 2026. Lists are re-checked daily.
How do I find out when Malwarebytes adds or removes a subprocessor?: ClauseTrail monitors Malwarebytes's subprocessor list, DPA, privacy policy and terms and emails you the exact change — who was added or removed and what the page said before and after. The first vendors are free.