# Belvo

Belvo declares [5 subprocessors](https://thirdpartyindex.com/vendors/belvo#subprocessors) in [its subprocessor list](https://trust.belvo.com/subprocessors), which we last checked on 2026-11-11 ([evidence](https://thirdpartyindex.com/evidence/53812)). They include [Amazon Web Services](https://thirdpartyindex.com/vendors/amazon-web-services), [Google Cloud](https://thirdpartyindex.com/vendors/google-cloud) and [Cloudflare](https://thirdpartyindex.com/vendors/cloudflare). No published changes since we first read it on 2026-09-22.

Belvo (belvo.com): subprocessors, data processing agreement, security documents and changes, as monitored by Third Party Index.

- Page: https://thirdpartyindex.com/vendors/belvo
- Documents last verified: 2026-11-11
- Transparency rating: 83/100 (how much it publishes, not how secure it is): Subprocessor list 30/30; Processing locations 8/8; Purposes 7/7; Data processing addendum 0/12 (not found); Trust center 8/8; Privacy policy 6/6; security.txt 6/6; Security page 5/5; Status page 5/5; Vulnerability disclosure 0/5 (not found); Pages still reachable 8/8
- Supply chain: relies on 5 tracked vendors directly, 55 within two hops, 224 within three; 0 tracked vendors rely on it directly, 0 within two hops, 0 within three
- Cite as: Belvo, Third Party Index, https://thirdpartyindex.com/vendors/belvo (data CC BY 4.0)

## Documents

| Document | URL | Last verified | Last changed |
|---|---|---|---|
| Trust center | https://trust.belvo.com/ | 2026-11-11 | 2026-11-11 |
| Subprocessor list | https://trust.belvo.com/subprocessors | 2026-11-11 | 2026-10-06 |
| Privacy policy | https://belvo.com/privacy-policy-clients/ | 2026-11-11 | 2026-09-22 |
| Terms | https://belvo.com/terms-service/ | 2026-11-11 | 2026-09-22 |
| Security page | https://belvo.com/security/ | 2026-11-11 | 2026-10-20 |
| security.txt | https://belvo.com/.well-known/security.txt | 2026-11-11 | 2026-10-19 |
| Status page | https://status.belvo.com/ | 2026-11-11 | 2026-11-11 |

## Subprocessors (5)

As its own list states them.

| Subprocessor | Purpose | Location | Listed since |
|---|---|---|---|
| [Amazon Web Services](https://thirdpartyindex.com/vendors/amazon-web-services.md) | Infrastructure Provider; container management, networking, dns, intrusion detection, VPN | United States | 2026-10-01 |
| [Cloudflare](https://thirdpartyindex.com/vendors/cloudflare.md) | WAF, schema validation, rate-limits, owasp, leaked credentials, intrusion detection; Web Application Firewall | Global | 2026-10-01 |
| [Datadog](https://thirdpartyindex.com/vendors/datadog.md) | Monitoring, alerting, and anomaly detection; Observation | United States | 2026-10-01 |
| [GitHub](https://thirdpartyindex.com/vendors/github.md) | Source Code Management and Security Tooling; Source Code Repositories, Static Application Security Testing (SAST), Software Composition Analysis (SCA) | United States | 2026-10-01 |
| [Google Workspace](https://thirdpartyindex.com/vendors/google-cloud.md) | Corporate email, document management, calendars, video conferencing, zero trust; Productivity | United States | 2026-10-01 |

Read from ([evidence](https://thirdpartyindex.com/evidence/8956)). CSV: https://thirdpartyindex.com/vendors/belvo/subprocessors.csv

## Compliance

As its trust center lists them.

- Audited: ISO/IEC 27001, PCI DSS ([evidence](https://thirdpartyindex.com/evidence/14071))

## Web Technologies

Belvo's homepage made 51 requests to 1 domain. Loaded on 2026-11-09 by a browser that accepted nothing; other visits may load more or less. What a page loads is not a list of who receives customer data.

### First party (1)

- Belvo: 51 requests to belvo.com; Cloudflare, HSTS, HTTP/3, LazySizes, Moove GDPR Consent, MySQL, Open Graph, PHP, Priority Hints, WP Engine, WP Rocket 3.24, WPML 5.2.0, WordPress, WordPress Block Editor, Yoast SEO 28.8, jQuery 3.7.1

## Subprocessor of (0)

No tracked vendor lists it.

## Service status

Incidents it reported on its own status page.

- Last 90 days: 0 reported incidents (0 major or critical, 0 minor, 0 with no impact stated)
- Status page last read: 2026-11-12
- No incidents reported in the last 12 months
- 2026-06-01: API showing high error rate (minor)
- 2026-05-30: API showing high error rate (major)
- 2026-05-19: API showing high error rate (critical)
- 2026-05-15: Public API service returning 5XX errors (major)
- 2026-05-05: Latency in processing Aggregation Async resources (minor)
- 2026-04-29: Public API High error rate (major)
- 2026-04-08: OFDA: Increased errors on Open Finance Operations (minor)
- 2026-03-16: Public API Instability (major)

## Incidents reported by Belvo's subprocessors

Incidents reported in the last 30 days on their own status pages by 2 vendors Belvo lists as subprocessors. A subprocessor list names a company, not the service an incident touched.

- 2026-11-11: [GitHub](https://thirdpartyindex.com/vendors/github#status), which Belvo lists as a subprocessor, reported Impact across multiple GitHub products including Actions, Pages, and Copilot products. (critical)
- 2026-11-11: [GitHub](https://thirdpartyindex.com/vendors/github#status), which Belvo lists as a subprocessor, reported Incident with Webhooks (minor)
- 2026-11-10: [GitHub](https://thirdpartyindex.com/vendors/github#status), which Belvo lists as a subprocessor, reported Incident with Git Operations and Pull Requests (critical)
- 2026-11-09: [GitHub](https://thirdpartyindex.com/vendors/github#status), which Belvo lists as a subprocessor, reported Degraded availability for GPT-5.3 Codex and GPT-5.6 models in Copilot (major)
- 2026-11-09: [GitHub](https://thirdpartyindex.com/vendors/github#status), which Belvo lists as a subprocessor, reported Incident with Actions and Checks API (critical)
- 2026-11-09: [GitHub](https://thirdpartyindex.com/vendors/github#status), which Belvo lists as a subprocessor, reported Incident with Webhooks and Actions (major)
- 2026-11-09: [GitHub](https://thirdpartyindex.com/vendors/github#status), which Belvo lists as a subprocessor, reported Increased timeouts due to surge in anonymous users (minor)
- 2026-11-08: [GitHub](https://thirdpartyindex.com/vendors/github#status), which Belvo lists as a subprocessor, reported Increase in timeouts for some unauthenticated users (minor)
- 2026-11-05: [GitHub](https://thirdpartyindex.com/vendors/github#status), which Belvo lists as a subprocessor, reported Degraded performance for multiple GitHub services (minor)
- 2026-11-05: [GitHub](https://thirdpartyindex.com/vendors/github#status), which Belvo lists as a subprocessor, reported Incident with Actions (minor)
- 2026-11-04: [GitHub](https://thirdpartyindex.com/vendors/github#status), which Belvo lists as a subprocessor, reported Incident with Actions (major)
- 2026-11-04: [GitHub](https://thirdpartyindex.com/vendors/github#status), which Belvo lists as a subprocessor, reported Incident with Actions and Pages (major)
- 2026-11-04: [GitHub](https://thirdpartyindex.com/vendors/github#status), which Belvo lists as a subprocessor, reported Incident with Pull Requests, Git Operations and Issues (major)
- 2026-11-04: [GitHub](https://thirdpartyindex.com/vendors/github#status), which Belvo lists as a subprocessor, reported Increased task-related errors for Copilot Mission Control (minor)
- 2026-11-03: [GitHub](https://thirdpartyindex.com/vendors/github#status), which Belvo lists as a subprocessor, reported Incident with Git Operations (minor)
- 2026-11-03: [GitHub](https://thirdpartyindex.com/vendors/github#status), which Belvo lists as a subprocessor, reported Incident with API, Git, and Copilot requests (minor)
- 2026-11-02: [GitHub](https://thirdpartyindex.com/vendors/github#status), which Belvo lists as a subprocessor, reported Elevated errors on GPT-5.4 Nano (minor)
- 2026-10-30: [GitHub](https://thirdpartyindex.com/vendors/github#status), which Belvo lists as a subprocessor, reported Incident with Dependabot (minor)
- 2026-10-30: [GitHub](https://thirdpartyindex.com/vendors/github#status), which Belvo lists as a subprocessor, reported Incident with Actions, Pages, and Webhooks (major)
- 2026-10-30: [GitHub](https://thirdpartyindex.com/vendors/github#status), which Belvo lists as a subprocessor, reported Disruption with GitHub services (critical)
- 2026-10-29: [GitHub](https://thirdpartyindex.com/vendors/github#status), which Belvo lists as a subprocessor, reported Disruption with Copilot Cloud services (minor)
- 2026-10-28: [Datadog](https://thirdpartyindex.com/vendors/datadog#status), which Belvo lists as a subprocessor, reported Metrics query are disrupted (major)
- 2026-10-28: [GitHub](https://thirdpartyindex.com/vendors/github#status), which Belvo lists as a subprocessor, reported Disruption with some Copilot services (critical)
- 2026-10-27: [GitHub](https://thirdpartyindex.com/vendors/github#status), which Belvo lists as a subprocessor, reported Elevated 404s for GitHub App s2s tokens in git/API (no impact stated)
- 2026-10-26: [GitHub](https://thirdpartyindex.com/vendors/github#status), which Belvo lists as a subprocessor, reported Incident with Actions, Issues, API Requests and Pull Requests (minor)
- 2026-10-26: [Datadog](https://thirdpartyindex.com/vendors/datadog#status), which Belvo lists as a subprocessor, reported Elevated Error Rates for Workflow Automation, App Builder, Bits Code, Bits Agent Builder (major)
- 2026-10-23: [GitHub](https://thirdpartyindex.com/vendors/github#status), which Belvo lists as a subprocessor, reported Grok 4.6 and Grok 4.7 Service Issues (minor)
- 2026-10-23: [GitHub](https://thirdpartyindex.com/vendors/github#status), which Belvo lists as a subprocessor, reported Disruption with Dependabot Alerts (minor)
- 2026-10-23: [GitHub](https://thirdpartyindex.com/vendors/github#status), which Belvo lists as a subprocessor, reported Delayed Actions status check results (minor)
- 2026-10-22: [GitHub](https://thirdpartyindex.com/vendors/github#status), which Belvo lists as a subprocessor, reported Project updates delayed (minor)
- 2026-10-22: [GitHub](https://thirdpartyindex.com/vendors/github#status), which Belvo lists as a subprocessor, reported Incident with Actions (minor)
- 2026-10-21: [GitHub](https://thirdpartyindex.com/vendors/github#status), which Belvo lists as a subprocessor, reported Delays for Pull Requests and Webhook deliveries (critical)
- 2026-10-19: [GitHub](https://thirdpartyindex.com/vendors/github#status), which Belvo lists as a subprocessor, reported Degraded availability for GitHub Actions, GitHub Pages and Webhooks (critical)
- 2026-10-15: [GitHub](https://thirdpartyindex.com/vendors/github#status), which Belvo lists as a subprocessor, reported CCA Automations are delayed when starting an Automation (minor)
- 2026-10-13: [GitHub](https://thirdpartyindex.com/vendors/github#status), which Belvo lists as a subprocessor, reported \[Retroactive\] Actions workflow run logs delayed (minor)

The subprocessor list as we read it on any date: https://thirdpartyindex.com/labs/time-machine/belvo

## Security contact

From its security.txt (https://belvo.com/.well-known/security.txt) ([evidence](https://thirdpartyindex.com/evidence/121993)):

- Contact: mailto:security@belvo.com
- Disclosure policy: https://bugbop.com/programs/1a81a23b-23b2-4112-b37e-741ba53d5424
- Encryption key: https://belvo.com/.well-known/security.gpg
- Acknowledgments: https://bugbop.com/programs/1a81a23b-23b2-4112-b37e-741ba53d5424
- Security jobs: https://belvo.com/careers/
- Languages: en, es
- Valid until 2027-10-15
- Signed

---

Third Party Index (https://thirdpartyindex.com) monitors vendors' public security and privacy documents and keeps each version as evidence. Data CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/); vendors' own documents are theirs. API: https://thirdpartyindex.com/api