# Commvault Systems Commvault Systems declares [9 subprocessors](https://thirdpartyindex.com/vendors/commvault-systems#subprocessors), plus 1 of its own affiliates, in [its subprocessor list](https://trust.commvault.com/subprocessors), which we last checked on 2026-11-11 ([evidence](https://thirdpartyindex.com/evidence/161143)). They include [Amazon Web Services](https://thirdpartyindex.com/vendors/amazon-web-services), [Google Cloud](https://thirdpartyindex.com/vendors/google-cloud) and [Microsoft](https://thirdpartyindex.com/vendors/microsoft). No published changes since we first read it on 2026-09-22. [4 tracked vendors](https://thirdpartyindex.com/vendors/commvault-systems#used-by) name Commvault Systems as a subprocessor, including [Rackspace](https://thirdpartyindex.com/vendors/rackspace), [Clumio by Commvault](https://thirdpartyindex.com/vendors/clumio-by-commvault) and [TierPoint](https://thirdpartyindex.com/vendors/tierpoint). Commvault Systems (commvault.com): subprocessors, data processing agreement, security documents and changes, as monitored by Third Party Index. - Page: https://thirdpartyindex.com/vendors/commvault-systems - Documents last verified: 2026-11-11 - Transparency rating: 79/100 (how much it publishes, not how secure it is): Subprocessor list 30/30; Processing locations 8/8; Purposes 7/7; Data processing addendum 12/12; Trust center 8/8; Privacy policy 6/6; security.txt 0/6 (not found); Security page 0/5 (not found); Status page 0/5 (not found); Vulnerability disclosure 0/5 (not found); Pages still reachable 8/8 - Supply chain: relies on 7 tracked vendors directly, 55 within two hops, 238 within three; 4 tracked vendors rely on it directly, 35 within two hops, 599 within three - Cite as: Commvault Systems, Third Party Index, https://thirdpartyindex.com/vendors/commvault-systems (data CC BY 4.0) ## Documents | Document | URL | Last verified | Last changed | |---|---|---|---| | Trust center | https://www.commvault.com/legal/trust-center | 2026-11-11 | 2026-09-22 | | Subprocessor list | https://trust.commvault.com/subprocessors | 2026-11-11 | 2026-10-26 | | Data processing addendum | https://www.commvault.com/legal/commvault-data-agreements | 2026-11-11 | 2026-09-22 | | Privacy policy | https://www.commvault.com/privacy-policy | 2026-11-11 | 2026-10-19 | | Terms | https://www.commvault.com/legal/master-terms-and-conditions | 2026-11-11 | 2026-10-21 | ## Subprocessors (9) As its own list states them. | Subprocessor | Purpose | Location | Listed since | |---|---|---|---| | [Amazon Web Services (AWS)](https://thirdpartyindex.com/vendors/amazon-web-services.md) | Applicable for SaaS workloads only; Cloud storage provider In case of cloud storage relevant AWS entity will be determined depending on the configuration choices made by the Customer. List of AWS sub-processors: | US/Other | 2026-09-28 | | [Clumio](https://thirdpartyindex.com/vendors/clumio-by-commvault.md) | Commvault has acquired Clumio’s highly scalable cloud data protection technology to support critical cloud data and workloads in AWS, including but not limited to Amazon Simple Storage Service (AWS S3) and Amazon DynamoDB. See our press release \[here\]( For more information on Clumio, see \[here\]( Please refer to the following link for the list of Sub-processors engaged by Clumio to support its cloud data protection services, see \[here\](; Integration with Commvault Cloud | US | 2026-09-28 | | [Egnyte](https://thirdpartyindex.com/vendors/egnyte.md) | Applicable for Threatwise only; Security and compliance tools for cloud content | US | 2026-09-28 | | [Google Cloud Platform](https://thirdpartyindex.com/vendors/google-cloud.md) | Cloud infrastructure and storage for Commvault SaaS workloads (e.g., Google Workspace Backup); Google Cloud Platform is used to host and store data processed as part of certain Commvault SaaS offerings, including Google Workspace Backup. Commvault manages and controls the deployment of the SaaS dataplane within GCP infrastructure. The specific GCP entity and region used depends on customer configuration and data residency preferences. GCP's list of authorized sub-processors can be found at: | US/Other | 2026-09-28 | | [Microsoft Corporation](https://thirdpartyindex.com/vendors/microsoft.md) (AI model provider: Azure OpenAI) | Commvault uses Microsoft for the following services/purposes: - Cloud storage - Security analytics (Sentinel) - Technical support platform - Azure OpenAI Service In case of cloud storage, the relevant Microsoft entity will be determined depending on the configuration choices made by the Customer. EU affiliate: Microsoft Ireland Operations Limited List of Microsoft sub-processors: | US/Other | 2026-09-28 | | [Oracle Corporation](https://thirdpartyindex.com/vendors/oracle.md) | Applicable for SaaS workloads only; Cloud storage provider In case of cloud storage relevant Oracle entity will be determined depending on the configuration choices made by the Customer. EU affiliate: Oracle EMEA Ltd List of Oracle affiliates: | US/Other | 2026-09-28 | | [Persistent Systems Malaysia Sdn Bhd](https://thirdpartyindex.com/vendors/persistent-systems.md) | Mandarin customer support and technical assistance | Malaysia | 2026-09-28 | | Satori | Commvault has acquired Satori, a leading data security platform that provides real-time data access controls, visibility, and compliance across cloud and hybrid environments. See our press release \[here\]( For more information on Satori, see \[here\]( Please refer to the following link for the list of Sub-processors engaged by Satori to support its cloud data protection services, see \[here\](; Integration with Commvault Cloud | US | 2026-09-28 | | Triple C Cloud Computing Ltd. | Applicable for Threatwise only; Colocation services | Israel | 2026-09-28 | Read from ([evidence](https://thirdpartyindex.com/evidence/13800)). CSV: https://thirdpartyindex.com/vendors/commvault-systems/subprocessors.csv AI model providers (or a cloud provider's AI model service) among these entries: 1. All vendors that list one: https://thirdpartyindex.com/ai ### Its own affiliates (1) - Commvault Systems Limited (Egypt; India; UK) ## Compliance As its trust center lists them. - FedRAMP Marketplace: High · 7 agency authorizations · since May 16, 2024 - FedRAMP Marketplace: Moderate ## Security program What COMMVAULT SYSTEMS INC's Form 10-K for fiscal 2026, filed May 11, 2026 (Item 1C) says, in its words (https://www.sec.gov/Archives/edgar/data/1169561/000116956126000017/0001169561-26-000017-index.htm). - Led by: Chief Information Security Officer - Board oversight: Audit Committee - Frameworks named: NIST CSF, ISO 27001, SOC 2, PCI DSS - Practices named: Incident response plan, Tabletop exercises, Penetration testing, Threat intelligence, Security training - Engages outside assessors or consultants - Reviews its suppliers' security - Says no cybersecurity incident has materially affected it - Since the fiscal 2025 report: security led by the Chief Information Security Officer (was the Chief Security Officer). ## Web Technologies Commvault Systems's homepage made 42 requests to 10 domains, and 5 services controlled by another company. Loaded on 2026-11-09 by a browser that accepted nothing; other visits may load more or less. What a page loads is not a list of who receives customer data. 5 third parties by category: Analytics 1 (Google Cloud); Marketing automation 1 (usually detected as Marketing automation: Adobe); RUM 1 (reviewed: New Relic); Security 1 (DataGrail); Video players 1 (Vidyard). Each company that appears controlled by another organization is counted once, under the main category of the technologies detected from it on this homepage or, when none was, the category recorded from the company's own page (marked reviewed) or else the one it is usually detected as on other published homepages (marked as such); unclassified: none of these. ### Third parties (5) - New Relic: 7 requests to nr-data.net, newrelic.com - Google Cloud: 6 requests to googletagmanager.com, youtube.com, google-analytics.com; Google Analytics, Google Tag Manager, YouTube (its subprocessor list names it too) - Adobe: 2 requests to adobedtm.com, demdex.net - Vidyard: 2 requests to vidyard.com; Vidyard - DataGrail: 1 request to datagrail.io; DataGrail ### First party (1) - Commvault Systems: 24 requests to commvault.com; Adobe Audience Manager, Adobe Client Data Layer 2.0.2, Adobe Experience Platform Launch, Fastly, HSTS, MariaDB, Max Mega Menu, MySQL, New Relic, Nginx, Open Graph, PHP, Pantheon, Priority Hints, Varnish, WordPress 3 tracked companies loaded by the homepage are not in Commvault Systems's subprocessor list. A website can use a service without it processing customer data. ## Subprocessor of (4) Tracked vendors whose own subprocessor lists name it, and what they say they use it for. - [Clumio by Commvault](https://thirdpartyindex.com/vendors/clumio-by-commvault.md): Commvault staff - [Lightedge](https://thirdpartyindex.com/vendors/lightedge.md): Data Center Infrastructure – Networking & Security - [Rackspace](https://thirdpartyindex.com/vendors/rackspace.md): Data Center Infrastructure – Networking & Security - [TierPoint](https://thirdpartyindex.com/vendors/tierpoint.md): Products & Services ## Security record CISA's Known Exploited Vulnerabilities catalog lists 2 vulnerabilities in its software: - CVE-2025-34028 (Command Center), listed 2025-05-02: Commvault Command Center Path Traversal Vulnerability - CVE-2025-3928 (Web Server), listed 2025-04-28: Commvault Web Server Unspecified Vulnerability ## Incidents reported by Commvault Systems's subprocessors Incidents reported in the last 30 days on their own status pages by 1 vendor Commvault Systems lists as a subprocessor. A subprocessor list names a company, not the service an incident touched. - 2026-11-11: [Egnyte](https://thirdpartyindex.com/vendors/egnyte#status), which Commvault Systems lists as a subprocessor, reported Intermittent issues in SFTP (US-East region) (minor) The subprocessor list as we read it on any date: https://thirdpartyindex.com/labs/time-machine/commvault-systems --- Third Party Index (https://thirdpartyindex.com) monitors vendors' public security and privacy documents and keeps each version as evidence. Data CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/); vendors' own documents are theirs. API: https://thirdpartyindex.com/api