# CM.com

CM.com (cm.com): subprocessors, data processing agreement, security documents and changes, as monitored by Third Party Index.

- Page: https://thirdpartyindex.com/vendors/cm-com
- Documents last verified: 2026-10-06
- Transparency rating: 88/100 (how much it publishes, not how secure it is): Subprocessor list 30/30; Processing locations 8/8; Purposes 0/7 (partial); Data processing addendum 12/12; Trust center 8/8; Privacy policy 6/6; security.txt 6/6; Security page 5/5; Status page 5/5; Vulnerability disclosure 0/5 (not found); Pages still reachable 8/8
- Supply chain: relies on 10 tracked vendors directly, 81 within two hops, 306 within three; 0 tracked vendors rely on it directly, 0 within two hops, 0 within three
- Cite as: CM.com, Third Party Index, https://thirdpartyindex.com/vendors/cm-com (data CC BY 4.0)

## Documents

| Document | URL | Last verified | Last changed |
|---|---|---|---|
| Trust center | https://www.cm.com/trust-center/ | 2026-10-05 | 2026-10-05 |
| Subprocessor list | https://www.cm.com/cdn/web/en/file/subprocessors-2026-5.pdf | 2026-10-06 | 2026-10-06 |
| Data processing addendum | https://www.cm.com/en-gb/app/legal/connect-engage/data-processing-addendum-dpa/ | 2026-10-05 | 2026-10-05 |
| Privacy policy | https://www.cm.com/app/legal/miscellaneous/privacy-statement/ | 2026-10-05 | 2026-10-05 |
| Terms | https://www.cm.com/app/legal/cmcom-terms-and-conditions/ | 2026-10-05 | 2026-10-05 |
| Security page | https://www.cm.com/trust-center/security/ | 2026-10-05 | 2026-10-05 |
| security.txt | https://www.cm.com/.well-known/security.txt | 2026-10-05 | 2026-10-05 |
| Status page | https://status.cm.com/ | 2026-10-05 | 2026-10-05 |

## Subprocessors (21)

As its own list states them.

| Subprocessor | Purpose | Location | Listed since |
|---|---|---|---|
| [Amazon Web Services EMEA SARL](https://thirdpartyindex.com/vendors/amazon-web-services.md) | — | 38 Avenue John F. Kennedy, L-1855 Luxembourg, Luxembourg | 2026-10-06 |
| [Cloudflare, Inc.](https://thirdpartyindex.com/vendors/cloudflare.md) | — | 101 Townsend Street, San Francisco, CA 94107, United States; Francisco, CA 94107, United; Francisco, CA 94107, United States | 2026-10-06 |
| Cloudflare, Inc. (Optional Global endpoint | — | See vendor corporate details / | 2026-10-06 |
| CYSO B.V. Mobile Identity | — | EU/EEA | 2026-10-06 |
| [Datadog, Inc.](https://thirdpartyindex.com/vendors/datadog.md) | — | 620 8th Avenue, 45th Floor, New York, NY 10018, United States | 2026-10-06 |
| [Elevenlabs, Inc. (Optional)](https://thirdpartyindex.com/vendors/elevenlabs.md) (AI model provider: ElevenLabs) | — | 169 Madison Ave #2484, New York, NY 10016, United States | 2026-10-06 |
| [Fullstory, Inc.](https://thirdpartyindex.com/vendors/fullstory.md) | — | 1745 Peachtree Street NE, Suite N, Atlanta, GA 30309, United States | 2026-10-06 |
| [Google Ireland Ltd.](https://thirdpartyindex.com/vendors/google-cloud.md) | — | EU/EEA, primarily Google Cloud regions in the Netherlands; Gordon House, Barrow Street, Dublin 4, D E5W, Ireland | 2026-10-06 |
| Google Ireland Ltd. Customer Data | — | EU/EEA, primarily Google Cloud regions in the Netherlands | 2026-10-06 |
| Inspire Used for platform | — | — | 2026-10-06 |
| [MaxMind, Inc.](https://thirdpartyindex.com/vendors/maxmind.md) | — | 51 Pleasant Street, #1020, Malden, MA 02148, United States | 2026-10-06 |
| Microsoft Ireland | — | One Microsoft Place, South County | 2026-10-06 |
| [Microsoft Ireland Operations Limited](https://thirdpartyindex.com/vendors/microsoft.md) | — | EU/EEA, primarily Microsoft Azure regions in the Netherlands; One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D P521, Ireland; applicable) One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D P521, Ireland | 2026-10-06 |
| OBI4wan B.V. (Only for Clients connected before 30 June 2023) | — | Korte Hogendijk 2, 1506 MA Zaandam, The Netherlands | 2026-10-06 |
| Operations Limited | — | Business Park, Leopardstown, Dublin 18, D P521, Ireland 101 Townsend Street, San | 2026-10-06 |
| please see our developer docs) | — | registered office | 2026-10-06 |
| Sekura Mobile Intelligence, Ltd. | — | United Kingdom | 2026-10-06 |
| [SendGrid, Inc.](https://thirdpartyindex.com/vendors/sendgrid.md) | — | 1801 California Street, Suite 500, Denver, CO 80202, United States; 500, Denver, CO 80202, United | 2026-10-06 |
| Subprocessor | — | Main establishment or registered office | 2026-10-06 |
| Surfly B.V. | — | Singel 373C, 1012 WL Amsterdam, The Netherlands | 2026-10-06 |
| [Wildbit LLC](https://thirdpartyindex.com/vendors/wildbit.md) | — | 2400 Market Street, No. 200, Suite 235B, Philadelphia, PA 19103, United States | 2026-10-06 |

Read from ([evidence](https://thirdpartyindex.com/evidence/50778)). CSV: https://thirdpartyindex.com/vendors/cm-com/subprocessors.csv

AI model providers (or a cloud provider's AI model service) among these entries: 1. All vendors that list one: https://thirdpartyindex.com/ai

### Its own affiliates (1)

- CM.com Affiliates (CM.com N.V. and affiliated group entities, Konijnenberg 30, 4825 BD The Netherlands (and other group establishments within the EEA where applicable); EU/EEA)

## Subprocessor of (0)

No tracked vendor lists it.

## Security contact

From its security.txt (https://www.cm.com/.well-known/security.txt) ([evidence](https://thirdpartyindex.com/evidence/49963)):

- Contact: mailto:security@cm.com
- Disclosure policy: https://www.cm.com/responsible-disclosure-policy/
- Security jobs: https://jobs.cm.com/
- Languages: en, nl
- Valid until 2026-12-31

---

Third Party Index (https://thirdpartyindex.com) monitors vendors' public security and privacy documents and keeps each version as evidence. Data CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/); vendors' own documents are theirs. API: https://thirdpartyindex.com/api