# Coveo

Coveo declares [6 subprocessors](https://thirdpartyindex.com/vendors/coveo#subprocessors), plus 5 of its own affiliates, in [its subprocessor list](https://www.coveo.com/en/company/legal/privacy-and-security/sub-processors), which we last checked on 2026-11-11 ([evidence](https://thirdpartyindex.com/evidence/3284)). They include [Amazon Web Services](https://thirdpartyindex.com/vendors/amazon-web-services), [Microsoft](https://thirdpartyindex.com/vendors/microsoft) and [Snowflake](https://thirdpartyindex.com/vendors/snowflake). No published changes since we first read it on 2026-09-22. [4 tracked vendors](https://thirdpartyindex.com/vendors/coveo#used-by) name Coveo as a subprocessor, including [Salesforce](https://thirdpartyindex.com/vendors/salesforce), [MongoDB](https://thirdpartyindex.com/vendors/mongodb) and [Tableau](https://thirdpartyindex.com/vendors/tableau).

Coveo (coveo.com): subprocessors, data processing agreement, security documents and changes, as monitored by Third Party Index.

- Page: https://thirdpartyindex.com/vendors/coveo
- Documents last verified: 2026-11-12
- Transparency rating: 95/100 (how much it publishes, not how secure it is): Subprocessor list 30/30; Processing locations 8/8; Purposes 7/7; Data processing addendum 12/12; Trust center 8/8; Privacy policy 6/6; security.txt 6/6; Security page 5/5; Status page 5/5; Vulnerability disclosure 0/5 (not found); Pages still reachable 8/8
- Supply chain: relies on 5 tracked vendors directly, 38 within two hops, 189 within three; 4 tracked vendors rely on it directly, 927 within two hops, 2626 within three
- Cite as: Coveo, Third Party Index, https://thirdpartyindex.com/vendors/coveo (data CC BY 4.0)

## Documents

| Document | URL | Last verified | Last changed |
|---|---|---|---|
| Trust center | https://trust.coveo.com/ | 2026-11-12 | 2026-11-07 |
| Subprocessor list | https://www.coveo.com/en/company/legal/privacy-and-security/sub-processors | 2026-11-11 | 2026-09-22 |
| Data processing addendum | https://www.coveo.com/en/company/legal/terms-and-agreements/data-processing-addendum | 2026-11-11 | 2026-09-22 |
| Privacy policy | https://www.coveo.com/en/company/legal/privacy-and-security/privacy-notice | 2026-11-11 | 2026-09-29 |
| Terms | https://www.coveo.com/en/company/legal/terms-and-agreements/website-terms-of-use | 2026-11-11 | 2026-09-22 |
| Security page | https://www.coveo.com/en/platform/security | 2026-11-11 | 2026-11-10 |
| security.txt | https://www.coveo.com/.well-known/security.txt | 2026-11-11 | 2026-09-22 |
| Status page | https://status.cloud.coveo.com/ | 2026-11-11 | 2026-11-11 |

## Subprocessors (6)

As its own list states them.

| Subprocessor | Purpose | Location | Listed since |
|---|---|---|---|
| [Amazon Web Services Canada, Inc.](https://thirdpartyindex.com/vendors/amazon-web-services.md) (AI model provider: Amazon Bedrock) | Cloud provider for all Hosted Services functionalities. It includes applications hosting, data repositories, data processing services and AI-powered functionalities and features, such as generative and other AI services provided through Amazon Bedrock (such as Coveo AI agents and other AI-driven capabilities). | Australia; Canada; Ireland (with back-ups in France); United States | 2026-09-22 |
| [Databricks, Inc.](https://thirdpartyindex.com/vendors/databricks.md) | Data processing, data governance, data management and enhanced analytics. It also provides AI-powered tools, agents and services to support and enhance service delivery. | N/A | 2026-09-22 |
| [Microsoft Corporation](https://thirdpartyindex.com/vendors/microsoft.md) | Provider of advanced AI functionalities, including generative AI services or other AI services, including AI-agents and AI-driven capabilities. | United States | 2026-09-22 |
| Qubit Inc. | Provision of the Services | Entity: United States; Processing Location: Australia; Processing Location: Canada; Processing Location: European Union; Processing Location: United Kingdom; Processing Location: United States | 2026-09-22 |
| [Snowflake, Inc.](https://thirdpartyindex.com/vendors/snowflake.md) | Data warehousing, data processing, data governance and enhanced analytics. It also provides AI-powered tools, agents and services to support and enhance service delivery. | Australia; Canada; Ireland (with back-ups in France); United States | 2026-09-22 |
| [Wiz, Inc. (wholly owned subsidiary of Google LLC)](https://thirdpartyindex.com/vendors/wiz-io.md) | Cloud security monitoring, threat detection, vulnerability/posture management | N/A | 2026-09-22 |

Read from ([evidence](https://thirdpartyindex.com/evidence/3284)). CSV: https://thirdpartyindex.com/vendors/coveo/subprocessors.csv

AI model providers (or a cloud provider's AI model service) among these entries: 1. All vendors that list one: https://thirdpartyindex.com/ai

### Its own affiliates (5)

- Coveo (Europe) B.V. (Entity: The Netherlands; Processing Location: Australia; Processing Location: Canada; Processing Location: European Union; Processing Location: United Kingdom; Processing Location: United States)
- Coveo Australia Pty Limited (Entity: Australia; Processing Location: Australia; Processing Location: Canada; Processing Location: European Union; Processing Location: United Kingdom; Processing Location: United States)
- Coveo EMEA Ltd (Entity: United Kingdom; Processing Location: Australia; Processing Location: Canada; Processing Location: European Union; Processing Location: United Kingdom; Processing Location: United States)
- Coveo Software Corp. (Entity: United States; Processing Location: Australia; Processing Location: Canada; Processing Location: European Union; Processing Location: United Kingdom; Processing Location: United States)
- Coveo Solutions Inc. (Entity: Canada; Processing Location: Australia; Processing Location: Canada; Processing Location: European Union; Processing Location: United Kingdom; Processing Location: United States)

## Web Technologies

Coveo's homepage made 454 requests to 41 domains, 22 services controlled by another company, and 3 domains not identified. Loaded on 2026-11-05 by a browser that accepted nothing; other visits may load more or less. What a page loads is not a list of who receives customer data.

22 third parties by category: Analytics 7 (Amplitude, Hotjar, ZoomInfo, Meta, LinkedIn, Demandbase, Cloudflare); Marketing automation 5 (6Sense Insights, Inc., GetVector, Inc., HubSpot, Artisan AI; usually detected as Marketing automation: Adobe); Advertising 4 (Google Cloud, X Corp., Microsoft, Podscribe); Live chat 1 (Qualified.com, Inc.); Cookie compliance 1 (OneTrust); CDN 1 (jsDelivr); Issue trackers 1 (usually detected as Issue trackers: Sentry); SEO 1 (BrightEdge); Video players 1 (usually detected as Video players: Wistia). Each company that appears controlled by another organization is counted once, under the main category of the technologies detected from it on this homepage or, when none was, the category recorded from the company's own page (marked reviewed) or else the one it is usually detected as on other published homepages (marked as such); unclassified: none of these.

### Third parties (22)

- Wistia: 43 requests to wistia.com
- Qualified.com, Inc.: 34 requests to qualified.com; Qualified
- Google Cloud: 29 requests to google.com, doubleclick.net, googletagmanager.com; DoubleClick Floodlight, Google Analytics, Google Tag Manager
- 6Sense Insights, Inc.: 18 requests to 6sc.co, 6sense.com; 6sense
- Amplitude: 14 requests to amplitude.com; Amplitude
- Adobe: 13 requests to typekit.net
- OneTrust: 12 requests to cookielaw.org, onetrust.com; OneTrust
- GetVector, Inc.: 11 requests to vector.co; Vector
- Hotjar: 7 requests to hotjar.com, hotjar.io; Hotjar
- ZoomInfo: 6 requests to zoominfo.com, zi-scripts.com; Zoominfo
- Meta: 5 requests to facebook.net, facebook.com; Facebook Pixel 2.9.435
- X Corp.: 5 requests to t.co, twitter.com, ads-twitter.com; Twitter Ads
- HubSpot: 4 requests to hs-analytics.net, hs-banner.com, hs-scripts.com, hubspot.com; HubSpot
- LinkedIn: 3 requests to linkedin.com, licdn.com; Linkedin Insight Tag
- Microsoft: 3 requests to bing.com; Microsoft Advertising (its subprocessor list names it too)
- Podscribe: 3 requests to podscribe.com, d34r8q7sht0t9k.cloudfront.net; Podscribe
- Artisan AI: 2 requests to artisan.co; Artisan
- BrightEdge: 2 requests to bc0a.com; BrightEdge
- Demandbase: 2 requests to company-target.com, demandbase.com; Demandbase
- Sentry: 2 requests to sentry.io
- Cloudflare: 1 request to cloudflareinsights.com; Cloudflare Browser Insights
- jsDelivr: 1 request to jsdelivr.net; jsDelivr

### Unknown (3)

Domains not identified yet: pocustrack.com, d2mvefebd70kbz.cloudfront.net, usbrowserspeed.com

### First party (1)

- Coveo: 230 requests to coveo.com; Amazon CloudFront, Amazon Web Services, Contentsquare, Coveo, Glide.js, HSTS, Microsoft ASP.NET, Open Graph, Priority Hints, Sentry, Sitecore, Vue.js 2.7.13, core-js 3.49.0, jQuery 3.7.1

13 tracked companies loaded by the homepage are not in Coveo's subprocessor list. A website can use a service without it processing customer data.

## Subprocessor of (4)

Tracked vendors whose own subprocessor lists name it, and what they say they use it for.

- [Forcepoint](https://thirdpartyindex.com/vendors/forcepoint.md): SaaS Service, customer HU
- [MongoDB](https://thirdpartyindex.com/vendors/mongodb.md): Support Search Functionality
- [Salesforce](https://thirdpartyindex.com/vendors/salesforce.md)
- [Tableau](https://thirdpartyindex.com/vendors/tableau.md)

## Service status

Incidents it reported on its own status page.

- Last 90 days: 7 reported incidents (4 major or critical, 2 minor, 1 with no impact stated)
- Typical time to resolve: 5 h 26 min
- Status page last read: 2026-11-12
- 2026-10-27: \[US, EU, AU\] Document Logs API unavailable (minor)
- 2026-10-21: \[EU\] Analytics Reporting Issues (major)
- 2026-09-16: \[All Regions\] Platform login with Salesforce provider issues (major)
- 2026-09-16: \[All Regions\] Salesforce sources update Issues (major)
- 2026-09-16: \[All Regions\] Support portal Issues (minor)
- 2026-08-26: \[All Regions\] Hosted Search Pages issue (critical)
- 2026-08-18: \[US\] Group Invite Issues (no impact stated)
- 2026-08-04: US - Generative Answering Issues (major)

## Incidents reported by Coveo's subprocessors

Incidents reported in the last 30 days on their own status pages by 2 vendors Coveo lists as subprocessors. A subprocessor list names a company, not the service an incident touched.

- 2026-11-07: [Snowflake](https://thirdpartyindex.com/vendors/snowflake#status), which Coveo lists as a subprocessor, reported INC20000337 (minor)
- 2026-11-06: [Snowflake](https://thirdpartyindex.com/vendors/snowflake#status), which Coveo lists as a subprocessor, reported INC20000336 (minor)
- 2026-11-05: [wiz.io](https://thirdpartyindex.com/vendors/wiz-io#status), which Coveo lists as a subprocessor, reported Graph query reports could fail to generate in some data centers due to an AWS Neptune issue. We are working with AWS on a mitigation. (no impact stated)
- 2026-10-30: [Snowflake](https://thirdpartyindex.com/vendors/snowflake#status), which Coveo lists as a subprocessor, reported INC20000321 (minor)
- 2026-10-29: [Snowflake](https://thirdpartyindex.com/vendors/snowflake#status), which Coveo lists as a subprocessor, reported INC20000319 (minor)
- 2026-10-21: [Snowflake](https://thirdpartyindex.com/vendors/snowflake#status), which Coveo lists as a subprocessor, reported INC20000301 (critical)
- 2026-10-21: [Snowflake](https://thirdpartyindex.com/vendors/snowflake#status), which Coveo lists as a subprocessor, reported INC20000299 (minor)
- 2026-10-20: [Snowflake](https://thirdpartyindex.com/vendors/snowflake#status), which Coveo lists as a subprocessor, reported INC20000294 (critical)
- 2026-10-19: [Snowflake](https://thirdpartyindex.com/vendors/snowflake#status), which Coveo lists as a subprocessor, reported INC20000290 (minor)
- 2026-10-18: [wiz.io](https://thirdpartyindex.com/vendors/wiz-io#status), which Coveo lists as a subprocessor, reported We are investigating an issue affecting the security graph and dependent features in prod-US38. (no impact stated)
- 2026-10-16: [Snowflake](https://thirdpartyindex.com/vendors/snowflake#status), which Coveo lists as a subprocessor, reported INC20000287 (critical)
- 2026-10-14: [wiz.io](https://thirdpartyindex.com/vendors/wiz-io#status), which Coveo lists as a subprocessor, reported We are investigating an issue causing GitHub pull request scans to remain pending, potentially blocking merges where Wiz checks are required. (no impact stated)
- 2026-10-13: [Snowflake](https://thirdpartyindex.com/vendors/snowflake#status), which Coveo lists as a subprocessor, reported INC20000277 (minor)

The subprocessor list as we read it on any date: https://thirdpartyindex.com/labs/time-machine/coveo

## Security contact

From its security.txt (https://www.coveo.com/.well-known/security.txt) ([evidence](https://thirdpartyindex.com/evidence/3281)):

- Contact: https://app.intigriti.com/programs/coveo/coveovulnerabilitydisclosureprogram/preview/detail
- Security jobs: https://www.coveo.com/en/company/careers
- Languages: english
- Expired 2026-08-18

---

Third Party Index (https://thirdpartyindex.com) monitors vendors' public security and privacy documents and keeps each version as evidence. Data CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/); vendors' own documents are theirs. API: https://thirdpartyindex.com/api