NCC Group uses sub-processors to support the delivery of our services to you.
A sub-processor is an external service provider or another member of NCC Group that is enlisted to deliver the service to you, where we are delivering a service to you in the role of processor. Therefore, this page doesn’t include the processing activities and services we deliver in the role of controller.
To deliver our service to you we may share certain personal information with one or more sub-processors. We have written contracts between NCC Group and all our sub-processors, which include obligations in relation to technical and organisational measures and compliance with applicable privacy laws.
Whether any sub-processor is used for any particular client engagement will depend on the country in which services are provided, the nature of the services and any specific client terms or processes agreed.
The below provides information about the sub-processors we may use to deliver services to you:
|
Name
|
Processing activity
|
Processing location
|
|
Amazon Web Services EMEA SARL
|
Amazon Web Services (for hosting, connectivity layer and middleware) |
Multi-region: EU, UK, US and APAC
Europe (Frankfurt) Region is the primary choice by default. Other regions are dependent on client choice:
Europe
United States
APAC
|
|
Microsoft Ireland Operations Ltd
|
Azure (for hosting, security data analytics and connectivity layer), Office 365 (several office applications) and EntraID (for active directory)
|
Multi-region: EU, UK and US
- West Europe (Netherlands) Region - North Europe (Ireland) Region - UK South (London) Region (regarding all e-mail data)
Mentioned regions are the primary choice by default. Other regions are dependent on client choice |
Sub-processors we use, depending on specific service procured:
|
Service line
|
Name
|
Processing activity |
Processing location (primary choice by default)
|
|
Consulting and Implementation |
Mindgame
|
Awareness campaign tool
|
DigitalOcean-hosted: Europe (Amsterdam) Region
|
|
|
Avertro Pty Ltd (CyberHQ) |
Technical support of the compliance risk governance (GRC) platform |
Europe (London) Region (NCC’s AWS-environment) (potentially access from US or AUS in case of support) |
|
Digital Forensic Incident Response |
Reveal Data Corporation |
eDiscovery platform service |
AWS-hosted: Europe (Frankfurt) Region
(potentially also in UK and US for support on a case-by-case basis) |
|
ZyLAB ONE |
eDiscovery platform service |
Azure-hosted: West Europe (Netherlands) Region |
|
|
Global Managed Services |
Amazon Web Services EMEA SARL |
Amazon Web Services (for hosting, connectivity layer and middleware) |
Europe (Frankfurt) Region |
|
|
Broadcom Inc (VMWare Carbon Black) |
Security data analytics service (Endpoint protection) |
AWS-hosted: by default Europe (Frankfurt) Region
& GCP-hosted: by default Europe West (Belgium) Region
|
|
|
Check Point Software Technologies Ltd |
Managed Firewall service |
Per choice of client |
|
|
Cisco Systems Inc |
Managed Firewall service |
Per choice of client |
|
|
CrowdStrike Inc |
Security data analytics service (Endpoint protection)
|
AWS-hosted:
|
|
|
CyCognito Ltd |
External Attack SurfaceExposure Management Service services (ASM and CTEM) |
GCP-hosted: Europe West (Belgium) Region
(potentially also in Israel in case of support) |
|
|
Fortinet Inc |
Managed Firewall service |
Per choice of client |
|
|
Horizon 3 AI Inc (NodeZero) |
Exposure Management services (CEV or CTEM) |
AWS-hosted: primary choice of NCC Group per client location:
Additionally, data may be processed in the US (in case of support) |
|
|
IASME Consortium Ltd |
Vulnerability scan & audit platform service |
Azure-hosted: UK (London) Region |
|
|
Intermax Cloudsourcing BV |
Private hosting service |
NL (Amsterdam, Rotterdam, Delft) |
|
|
Microsoft Ireland Operations Ltd |
Hosting (Azure Cloud), security data analytics service (Azure Sentinel), connectivity layer (Azure Lighthouse), and active directory (EntraID) |
West Europe (Netherlands) Region, North Europe (Ireland) Region, UK South (London) Region |
|
|
|
Unified Cyber Platform (UCP) enrichment / automation engine |
UK South (London) Region
For EU-onlyhosted clients, the option for onboarding in West Europe (NL) region and North Europa (Ireland) Region is available |
|
|
Palo Alto Networks Inc |
Managed Firewall service |
Per choice of client |
|
|
QevlarAI SAS |
AI Triage module |
GCP-hosted: Region by choice of client:
QevlarAI makes use of Microsoft Azure OpenAI which is hosted in Europe (Sweden) Region. |
|
|
Qualys Ltd |
Internal & External Attack SurfaceExposure Management Services (VMA, ASM or CTEM) |
Oracle-hosted: Region by choice of Client
Primary choice of NCC Group per Client location:
Qualys support: India and the US |
|
|
Searchlight Cyber |
Web monitoring service |
Digital Ocean & AWS hosted: Europe (London) Region |
|
|
SentinelOne Inc |
Security data analytics service (Endpoint protection) |
AWS-hosted:
|
|
|
ServiceNow Ltd |
Security incident management platform service |
Azure-hosted: UK South (London and Newport) Region |
|
|
Splunk Services Ltd |
Security data analytics (SIEM) service and SOAR) services |
AWS hosted: Region by choice of Client.
Primary choice of NCC Group per Clientclient location:
|
|
|
Thinkst CanaryApplied Research Pty Ltd |
Threat detection and deception service |
AWS-hosted: Region by choice of Clientclient.
Primary choice of NCC Group per Clientclient location:
|
|
|
Umbrio BV (Davinsi Labs NV) |
Support service |
Azure-hosted: West Europe Region (NL) |
|
Global Threat Intelligence |
Filigran SAS (OpenCTI) |
Technical support of the threat intelligence platform |
Europe (Ireland) Region (NCC’s AWS-environment) |
|
Technical Assurance Services |
Digital Ocean |
Hosting (Digital Ocean Cloud) Self service linux machines for short term projects |
Multi regionPer choice of client. Primary choice of NCC Group per client location: EU, UK, US and APAC
|
|
|
Horizon3.aiHorizon 3 AI Inc (NodeZero) |
Providing automated testing services |
AWS-hosted: primary choice of NCC Group per client location:
|
|
|
PortSwigger Ltd |
Providing web application testing services |
AWS hosted: Europe(Ireland) Region |
|
|
Cytix Ltd |
Providing automated orchestration services |
AWS-hosted: Europe (London) Region |
A full list of the subsidiaries of NCC Group plc who may be engaged to support the delivery of our services to you is available here
Further information regarding the sub-processors used by NCC Group, for the specific services we provide to you, can be obtained from your local contact/account manager.
Please note that some of our sub-processors are international companies, that may engage in intra-group data transfers or otherwise engage sub-processors outside of the EU. For more in-depth information on each sub-processor and how they process personal data, please also consult their website.
If you have questions related to the legal basis used for a specific transfer, you can ask for further information from dataprotection@nccgroup.com
Last updated: November 3, 2026