# AvePoint AvePoint declares [9 subprocessors](https://thirdpartyindex.com/vendors/avepoint#subprocessors), plus 16 of its own affiliates, in [its subprocessor list](https://cdn.avepoint.com/pdfs/en/brochures/AvePoint-Sub-Processors-List.pdf), which we last checked on 2026-11-12 ([evidence](https://thirdpartyindex.com/evidence/11611)). They include [Amazon Web Services](https://thirdpartyindex.com/vendors/amazon-web-services), [Google Cloud](https://thirdpartyindex.com/vendors/google-cloud) and [Microsoft](https://thirdpartyindex.com/vendors/microsoft). No published changes since we first read it on 2026-09-28. [1 tracked vendor](https://thirdpartyindex.com/vendors/avepoint#used-by), [Aztec Software](https://thirdpartyindex.com/vendors/aztec-software), names AvePoint as a subprocessor. AvePoint (avepoint.com): subprocessors, data processing agreement, security documents and changes, as monitored by Third Party Index. - Page: https://thirdpartyindex.com/vendors/avepoint - Documents last verified: 2026-11-12 - Transparency rating: 69/100 (how much it publishes, not how secure it is): Subprocessor list 30/30; Processing locations 5/8 (partial); Purposes 0/7 (partial); Data processing addendum 12/12; Trust center 8/8; Privacy policy 6/6; security.txt 0/6 (not found); Security page 0/5 (not found); Status page 0/5 (not found); Vulnerability disclosure 0/5 (not found); Pages still reachable 8/8 - Supply chain: relies on 3 tracked vendors directly, 36 within two hops, 146 within three; 1 tracked vendors rely on it directly, 1 within two hops, 1 within three - Cite as: AvePoint, Third Party Index, https://thirdpartyindex.com/vendors/avepoint (data CC BY 4.0) ## Documents | Document | URL | Last verified | Last changed | |---|---|---|---| | Trust center | https://www.avepoint.com/company/trust-center | 2026-11-12 | 2026-11-04 | | Subprocessor list | https://cdn.avepoint.com/pdfs/en/brochures/AvePoint-Sub-Processors-List.pdf | 2026-11-12 | 2026-09-28 | | Data processing addendum | https://cdn.avepoint.com/pdfs/en/brochures/AvePoint-Data-Processing-Addendum.pdf | 2026-11-12 | 2026-09-28 | | Privacy policy | https://www.avepoint.com/company/privacy-notice | 2026-11-12 | 2026-09-28 | | Terms | https://www.avepoint.com/company/terms-and-conditions | 2026-11-12 | 2026-09-28 | ## Subprocessors (9) As its own list states them. | Subprocessor | Purpose | Location | Listed since | |---|---|---|---| | [Amazon Web Services, Inc.](https://thirdpartyindex.com/vendors/amazon-web-services.md) | — | — | 2026-09-28 | | Combined Knowledge Limited | — | United Kingdom | 2026-09-28 | | [Google LLC](https://thirdpartyindex.com/vendors/google-cloud.md) | — | — | 2026-09-28 | | I-Access Solutions Pte Ltd | — | Singapore | 2026-09-28 | | MaivenPoint Pte. Ltd. | — | Singapore | 2026-09-28 | | [Microsoft Corporation](https://thirdpartyindex.com/vendors/microsoft.md) | — | — | 2026-09-28 | | Shanghai AvePoint Software Technology Corporation Limited | — | China | 2026-09-28 | | Ydentic B.V. | — | The Netherlands | 2026-09-28 | | Ydentic Holding B.V. | — | The Netherlands | 2026-09-28 | Read from ([evidence](https://thirdpartyindex.com/evidence/11611)). CSV: https://thirdpartyindex.com/vendors/avepoint/subprocessors.csv ### Its own affiliates (16) - AvePoint, Inc. (USA) - AvePoint AU Pty Ltd (Australia) - AvePoint Beijing Technology Ltd. (China) - AvePoint Canada LTD. (Canada) - AvePoint Deutschland GmbH (Germany, France, The Netherlands, Sweden, Switzerland) - AvePoint Gulf FZCO (Dubai / United Arab Emirates) - AvePoint Hanoi Company Limited (Vietnam) - AvePoint Holdings USA, LLC (USA, Philippines) - AvePoint Japan K.K. (Japan) - AvePoint Korea Co., Ltd. (South Korea) - AvePoint Malaysia Sdn Bhd (Malaysia) - AvePoint Public Sector, Inc. (USA) - AvePoint Singapore Pte. Ltd. (Singapore) - AvePoint Technology Changchun Co. Ltd. (China) - AvePoint UK, Ltd. (United Kingdom, South Africa) - AvePoint Vietnam Company Limited (Vietnam) ## Compliance As its trust center lists them. - FedRAMP Marketplace: Moderate · 8 agency authorizations · since Mar 31, 2021 - FedRAMP Marketplace: High ## Security program What AvePoint, Inc.'s Form 10-K for fiscal 2025, filed Feb 26, 2026 (Item 1C) says, in its words (https://www.sec.gov/Archives/edgar/data/1777921/000143774926005907/0001437749-26-005907-index.htm). - Led by: Chief Information Security Officer - Board oversight: Governance Committee - Frameworks named: NIST CSF, SOC 2, HITRUST, FedRAMP - Practices named: Incident response plan, Tabletop exercises, Threat intelligence, Security training, Cyber insurance - Engages outside assessors or consultants - Reviews its suppliers' security - Says no cybersecurity incident has materially affected it ## Web Technologies AvePoint's homepage made 186 requests to 38 domains, 20 services controlled by another company, and 2 domains not identified. Loaded on 2026-11-10 by a browser that accepted nothing; other visits may load more or less. What a page loads is not a list of who receives customer data. 20 third parties by category: Advertising 6 (Google Cloud, Microsoft, X Corp., Reddit, Inc.; reviewed: Clickagy; usually detected as Advertising: Xandr); Analytics 5 (Wingify, ZoomInfo, LinkedIn, Meta, UserGems); Marketing automation 3 (6Sense Insights, Inc., Adobe, Clearbit); Cookie compliance 1 (Osano); CDN 1 (jsDelivr); Customer data platform 1 (usually detected as Customer data platform: Segment); Issue trackers 1 (usually detected as Issue trackers: Sentry); SEO 1 (Ahrefs); Security 1 (usually detected as Security: Amazon Web Services). Each company that appears controlled by another organization is counted once, under the main category of the technologies detected from it on this homepage or, when none was, the category recorded from the company's own page (marked reviewed) or else the one it is usually detected as on other published homepages (marked as such); unclassified: none of these. ### Third parties (20) - 6Sense Insights, Inc.: 19 requests to 6sc.co, 6sense.com; 6sense - Google Cloud: 19 requests to google.com, doubleclick.net, google-analytics.com, googletagmanager.com, googlesyndication.com; DoubleClick Floodlight, Google Analytics, Google Tag Manager (its subprocessor list names it too) - Microsoft: 10 requests to clarity.ms, bing.com; Microsoft Advertising (its subprocessor list names it too) - Wingify: 9 requests to visualwebsiteoptimizer.com; VWO - Clickagy: 7 requests to clickagy.com - Segment: 5 requests to segment.io, segment.com - X Corp.: 5 requests to t.co, twitter.com, ads-twitter.com; Twitter Ads - ZoomInfo: 5 requests to zoominfo.com, zi-scripts.com; Zoominfo - Adobe: 4 requests to marketo.net, mktoresp.com; Marketo - Osano: 4 requests to osano.com; Osano - LinkedIn: 3 requests to linkedin.com, licdn.com; Linkedin Insight Tag - Meta: 3 requests to facebook.net, facebook.com; Facebook Pixel 2.9.439 - UserGems: 3 requests to usergems.com; UserGems - Clearbit: 2 requests to clearbitjs.com, clearbitscripts.com; Clearbit - Reddit, Inc.: 2 requests to reddit.com, redditstatic.com; Reddit Ads - Ahrefs: 1 request to ahrefs.com; Ahrefs - Amazon Web Services: 1 request to on.aws (its subprocessor list names it too) - Sentry: 1 request to sentry.io - Xandr: 1 request to adnxs.com - jsDelivr: 1 request to jsdelivr.net; jsDelivr ### Unknown (2) Domains not identified yet: ug-webapp-public-production.s3.amazonaws.com, usbrowserspeed.com ### First party (1) - AvePoint: 79 requests to avepoint.com; Astro, Azure, Azure Front Door, Craft CMS, Framer Motion, HSTS, Lucide, Microsoft Clarity, Open Graph, PHP, Priority Hints, SEOmatic, Segment 1.84.1, Sentry, Yii, core-js 3.32.2, lit-html 2.8.0 13 tracked companies loaded by the homepage are not in AvePoint's subprocessor list. A website can use a service without it processing customer data. ## Subprocessor of (1) Tracked vendors whose own subprocessor lists name it, and what they say they use it for. - [Aztec Software](https://thirdpartyindex.com/vendors/aztec-software.md): Scanning ## Recent changes Changes to its documents and subprocessor list since monitoring began. - 2026-10-03: Changed registry listing: fedramp:FR2025827270 ([evidence](https://thirdpartyindex.com/evidence/40338)) Feed: https://thirdpartyindex.com/vendors/avepoint/changes.atom The subprocessor list as we read it on any date: https://thirdpartyindex.com/labs/time-machine/avepoint --- Third Party Index (https://thirdpartyindex.com) monitors vendors' public security and privacy documents and keeps each version as evidence. Data CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/); vendors' own documents are theirs. API: https://thirdpartyindex.com/api