# Hugging Face Hugging Face declares [12 subprocessors](https://thirdpartyindex.com/vendors/hugging-face#subprocessors), plus 1 of its own affiliates, in [its subprocessor list](https://cdn-media.huggingface.co/landing/assets/Subprocessors.pdf), which we last checked on 2026-11-11 ([evidence](https://thirdpartyindex.com/evidence/5244)). They include [Amazon Web Services](https://thirdpartyindex.com/vendors/amazon-web-services), [Google Cloud](https://thirdpartyindex.com/vendors/google-cloud) and [Microsoft](https://thirdpartyindex.com/vendors/microsoft). No published changes since we first read it on 2026-09-22. [2 tracked vendors](https://thirdpartyindex.com/vendors/hugging-face#used-by) name Hugging Face as a subprocessor, including [LandingAI](https://thirdpartyindex.com/vendors/landingai) and [Expertly](https://thirdpartyindex.com/vendors/expertly). Hugging Face (huggingface.co): subprocessors, data processing agreement, security documents and changes, as monitored by Third Party Index. - Page: https://thirdpartyindex.com/vendors/hugging-face - Documents last verified: 2026-11-11 - Transparency rating: 95/100 (how much it publishes, not how secure it is): Subprocessor list 30/30; Processing locations 8/8; Purposes 7/7; Data processing addendum 12/12; Trust center 8/8; Privacy policy 6/6; security.txt 6/6; Security page 5/5; Status page 5/5; Vulnerability disclosure 0/5 (not found); Pages still reachable 8/8 - Supply chain: relies on 10 tracked vendors directly, 101 within two hops, 375 within three; 2 tracked vendors rely on it directly, 3 within two hops, 3 within three - Cite as: Hugging Face, Third Party Index, https://thirdpartyindex.com/vendors/hugging-face (data CC BY 4.0) ## Documents | Document | URL | Last verified | Last changed | |---|---|---|---| | Trust center | https://huggingface.co/trust | 2026-11-11 | 2026-09-21 | | Subprocessor list | https://cdn-media.huggingface.co/landing/assets/Subprocessors.pdf | 2026-11-11 | 2026-09-22 | | Data processing addendum | https://huggingface.co/DPA | 2026-11-11 | 2026-11-11 | | Privacy policy | https://huggingface.co/privacy | 2026-11-11 | 2026-09-21 | | Terms | https://huggingface.co/terms-of-service | 2026-11-11 | 2026-09-21 | | Security page | https://huggingface.co/security | 2026-11-11 | 2026-11-11 | | security.txt | https://huggingface.co/.well-known/security.txt | 2026-11-11 | 2026-09-21 | | Status page | https://status.huggingface.co/ | 2026-11-11 | 2026-11-05 | ## Subprocessors (12) As its own list states them. | Subprocessor | Purpose | Location | Listed since | |---|---|---|---| | [Amazon Web Services, Inc.](https://thirdpartyindex.com/vendors/amazon-web-services.md) | Hosting/Infrastructure | United States | 2026-09-22 | | [AWS SES](https://thirdpartyindex.com/vendors/amazon-web-services.md) | Emails | United States | 2026-09-22 | | [Azure](https://thirdpartyindex.com/vendors/microsoft.md) | Hosting/Infrastructure | United States | 2026-09-22 | | [Circle CI Software](https://thirdpartyindex.com/vendors/circleci.md) | Integration and testing platform | United States | 2026-09-22 | | [Discourse](https://thirdpartyindex.com/vendors/discourse.md) | Forum | United States | 2026-09-22 | | [Github](https://thirdpartyindex.com/vendors/github.md) | Hosting code | United States | 2026-09-22 | | [Google Analytics](https://thirdpartyindex.com/vendors/google-cloud.md) | Analytics | United States | 2026-09-22 | | [Google Cloud Platform](https://thirdpartyindex.com/vendors/google-cloud.md) | Hosting/Infrastructure | United States/EMEA | 2026-09-22 | | [MongoDB Atlas](https://thirdpartyindex.com/vendors/mongodb.md) | Database | United States | 2026-09-22 | | [Slack Technologies](https://thirdpartyindex.com/vendors/slack.md) | Communication | United States | 2026-09-22 | | [Stripe](https://thirdpartyindex.com/vendors/stripe.md) | Payment | United States | 2026-09-22 | | [Zendesk](https://thirdpartyindex.com/vendors/zendesk.md) | Support platform | United States | 2026-09-22 | Read from ([evidence](https://thirdpartyindex.com/evidence/5244)). CSV: https://thirdpartyindex.com/vendors/hugging-face/subprocessors.csv ### Its own affiliates (1) - Hugging Face SAS (wholly-owned subsidiary) (Canada; France) ## Web Technologies Hugging Face's homepage made 64 requests to 4 domains, and 2 services controlled by another company. Loaded on 2026-11-03 by a browser that accepted nothing; other visits may load more or less. What a page loads is not a list of who receives customer data. 2 third parties by category: Payment processors 1 (Stripe); Security 1 (Amazon Web Services). Each company that appears controlled by another organization is counted once, under the main category of the technologies detected from it on this homepage or, when none was, the category recorded from the company's own page (marked reviewed) or else the one it is usually detected as on other published homepages (marked as such); unclassified: none of these. ### Third parties (2) - Stripe: 6 requests to stripe.com, stripe.network; Stripe dahlia (its subprocessor list names it too) - Amazon Web Services: 4 requests to awswaf.com; AWS WAF Bot Control (its subprocessor list names it too) ### First party (1) - Hugging Face: 54 requests to huggingface.co; Amazon CloudFront, Amazon Web Services, HSTS, HTTP/3, KaTeX, Open Graph, Plausible, RSS, Svelte ## Subprocessor of (2) Tracked vendors whose own subprocessor lists name it, and what they say they use it for. - [Expertly](https://thirdpartyindex.com/vendors/expertly.md) - [LandingAI](https://thirdpartyindex.com/vendors/landingai.md): AI model hosting and machine learning infrastructure; AI model hosting and machine learning infrastructure used to support advanced data processing and inferenc… ## Service status Incidents it reported on its own status page. - Last 90 days: 2 reported incidents (0 major or critical, 2 minor, 0 with no impact stated) - Typical time to resolve: 2 days - Status page last read: 2026-11-12 - 2026-09-24: Some GPU Jobs and Spaces failing to start (minor) - 2026-09-22: Slower downloads in the Asia-Pacific region (minor) - 2026-08-07: Elevated error rate - AWS CDN (Singapore) (minor) - 2026-07-16: Hub unavailable (major) ## Incidents reported by Hugging Face's subprocessors Incidents reported in the last 30 days on their own status pages by 4 vendors Hugging Face lists as subprocessors. A subprocessor list names a company, not the service an incident touched. - 2026-11-11: [GitHub](https://thirdpartyindex.com/vendors/github#status), which Hugging Face lists as a subprocessor, reported Impact across multiple GitHub products including Actions, Pages, and Copilot products. (critical) - 2026-11-11: [GitHub](https://thirdpartyindex.com/vendors/github#status), which Hugging Face lists as a subprocessor, reported Incident with Webhooks (minor) - 2026-11-10: [GitHub](https://thirdpartyindex.com/vendors/github#status), which Hugging Face lists as a subprocessor, reported Incident with Git Operations and Pull Requests (critical) - 2026-11-09: [GitHub](https://thirdpartyindex.com/vendors/github#status), which Hugging Face lists as a subprocessor, reported Degraded availability for GPT-5.3 Codex and GPT-5.6 models in Copilot (major) - 2026-11-09: [GitHub](https://thirdpartyindex.com/vendors/github#status), which Hugging Face lists as a subprocessor, reported Incident with Actions and Checks API (critical) - 2026-11-09: [GitHub](https://thirdpartyindex.com/vendors/github#status), which Hugging Face lists as a subprocessor, reported Incident with Webhooks and Actions (major) - 2026-11-09: [GitHub](https://thirdpartyindex.com/vendors/github#status), which Hugging Face lists as a subprocessor, reported Increased timeouts due to surge in anonymous users (minor) - 2026-11-08: [GitHub](https://thirdpartyindex.com/vendors/github#status), which Hugging Face lists as a subprocessor, reported Increase in timeouts for some unauthenticated users (minor) - 2026-11-05: [GitHub](https://thirdpartyindex.com/vendors/github#status), which Hugging Face lists as a subprocessor, reported Degraded performance for multiple GitHub services (minor) - 2026-11-05: [GitHub](https://thirdpartyindex.com/vendors/github#status), which Hugging Face lists as a subprocessor, reported Incident with Actions (minor) - 2026-11-04: [GitHub](https://thirdpartyindex.com/vendors/github#status), which Hugging Face lists as a subprocessor, reported Incident with Actions (major) - 2026-11-04: [GitHub](https://thirdpartyindex.com/vendors/github#status), which Hugging Face lists as a subprocessor, reported Incident with Actions and Pages (major) - 2026-11-04: [GitHub](https://thirdpartyindex.com/vendors/github#status), which Hugging Face lists as a subprocessor, reported Incident with Pull Requests, Git Operations and Issues (major) - 2026-11-04: [GitHub](https://thirdpartyindex.com/vendors/github#status), which Hugging Face lists as a subprocessor, reported Increased task-related errors for Copilot Mission Control (minor) - 2026-11-03: [GitHub](https://thirdpartyindex.com/vendors/github#status), which Hugging Face lists as a subprocessor, reported Incident with Git Operations (minor) - 2026-11-03: [CircleCI](https://thirdpartyindex.com/vendors/circleci#status), which Hugging Face lists as a subprocessor, reported Increased wait time for Machine and Remote Docker jobs (minor) - 2026-11-03: [GitHub](https://thirdpartyindex.com/vendors/github#status), which Hugging Face lists as a subprocessor, reported Incident with API, Git, and Copilot requests (minor) - 2026-11-02: [GitHub](https://thirdpartyindex.com/vendors/github#status), which Hugging Face lists as a subprocessor, reported Elevated errors on GPT-5.4 Nano (minor) - 2026-11-01: [Stripe](https://thirdpartyindex.com/vendors/stripe#status), which Hugging Face lists as a subprocessor, reported Elevated Instant Payouts failures (no impact stated) - 2026-10-30: [GitHub](https://thirdpartyindex.com/vendors/github#status), which Hugging Face lists as a subprocessor, reported Incident with Dependabot (minor) - 2026-10-30: [GitHub](https://thirdpartyindex.com/vendors/github#status), which Hugging Face lists as a subprocessor, reported Incident with Actions, Pages, and Webhooks (major) - 2026-10-30: [GitHub](https://thirdpartyindex.com/vendors/github#status), which Hugging Face lists as a subprocessor, reported Disruption with GitHub services (critical) - 2026-10-29: [GitHub](https://thirdpartyindex.com/vendors/github#status), which Hugging Face lists as a subprocessor, reported Disruption with Copilot Cloud services (minor) - 2026-10-28: [CircleCI](https://thirdpartyindex.com/vendors/circleci#status), which Hugging Face lists as a subprocessor, reported Delays for gen2 dedicated IP range jobs (minor) - 2026-10-28: [Stripe](https://thirdpartyindex.com/vendors/stripe#status), which Hugging Face lists as a subprocessor, reported Elevated Issuing errors from 17:13 - 20:41 UTC (minor) - 2026-10-28: [GitHub](https://thirdpartyindex.com/vendors/github#status), which Hugging Face lists as a subprocessor, reported Disruption with some Copilot services (critical) - 2026-10-27: [GitHub](https://thirdpartyindex.com/vendors/github#status), which Hugging Face lists as a subprocessor, reported Elevated 404s for GitHub App s2s tokens in git/API (no impact stated) - 2026-10-26: [GitHub](https://thirdpartyindex.com/vendors/github#status), which Hugging Face lists as a subprocessor, reported Incident with Actions, Issues, API Requests and Pull Requests (minor) - 2026-10-24: [Stripe](https://thirdpartyindex.com/vendors/stripe#status), which Hugging Face lists as a subprocessor, reported Elevated Blik errors (no impact stated) - 2026-10-23: [GitHub](https://thirdpartyindex.com/vendors/github#status), which Hugging Face lists as a subprocessor, reported Grok 4.6 and Grok 4.7 Service Issues (minor) - 2026-10-23: [GitHub](https://thirdpartyindex.com/vendors/github#status), which Hugging Face lists as a subprocessor, reported Disruption with Dependabot Alerts (minor) - 2026-10-23: [GitHub](https://thirdpartyindex.com/vendors/github#status), which Hugging Face lists as a subprocessor, reported Delayed Actions status check results (minor) - 2026-10-22: [Stripe](https://thirdpartyindex.com/vendors/stripe#status), which Hugging Face lists as a subprocessor, reported Elevated Bancontact errors (no impact stated) - 2026-10-22: [GitHub](https://thirdpartyindex.com/vendors/github#status), which Hugging Face lists as a subprocessor, reported Project updates delayed (minor) - 2026-10-22: [Stripe](https://thirdpartyindex.com/vendors/stripe#status), which Hugging Face lists as a subprocessor, reported Elevated Bancontact errors (no impact stated) - 2026-10-22: [GitHub](https://thirdpartyindex.com/vendors/github#status), which Hugging Face lists as a subprocessor, reported Incident with Actions (minor) - 2026-10-21: [CircleCI](https://thirdpartyindex.com/vendors/circleci#status), which Hugging Face lists as a subprocessor, reported Increased Docker gen2 wait times (minor) - 2026-10-21: [GitHub](https://thirdpartyindex.com/vendors/github#status), which Hugging Face lists as a subprocessor, reported Delays for Pull Requests and Webhook deliveries (critical) - 2026-10-20: [CircleCI](https://thirdpartyindex.com/vendors/circleci#status), which Hugging Face lists as a subprocessor, reported Increased wait times for macOS jobs on m4pro.large (minor) - 2026-10-20: [Stripe](https://thirdpartyindex.com/vendors/stripe#status), which Hugging Face lists as a subprocessor, reported Spike in cancellations and expired errors with PayByBank payments (no impact stated) - 2026-10-20: [MongoDB](https://thirdpartyindex.com/vendors/mongodb#status), which Hugging Face lists as a subprocessor, reported GCP Availability Zone europe-west2-b connectivity issues (minor) - 2026-10-20: [Stripe](https://thirdpartyindex.com/vendors/stripe#status), which Hugging Face lists as a subprocessor, reported Elevated Revolut Pay errors (no impact stated) - 2026-10-19: [GitHub](https://thirdpartyindex.com/vendors/github#status), which Hugging Face lists as a subprocessor, reported Degraded availability for GitHub Actions, GitHub Pages and Webhooks (critical) - 2026-10-15: [Stripe](https://thirdpartyindex.com/vendors/stripe#status), which Hugging Face lists as a subprocessor, reported Elevated declines on Mastercard (no impact stated) - 2026-10-15: [GitHub](https://thirdpartyindex.com/vendors/github#status), which Hugging Face lists as a subprocessor, reported CCA Automations are delayed when starting an Automation (minor) - 2026-10-15: [Stripe](https://thirdpartyindex.com/vendors/stripe#status), which Hugging Face lists as a subprocessor, reported Elevated declines on Visa (no impact stated) - 2026-10-15: [Stripe](https://thirdpartyindex.com/vendors/stripe#status), which Hugging Face lists as a subprocessor, reported Elevated Amazon Pay errors (no impact stated) - 2026-10-14: [CircleCI](https://thirdpartyindex.com/vendors/circleci#status), which Hugging Face lists as a subprocessor, reported Delays starting macOS jobs that use Xcode 26.6.0 (minor) - 2026-10-13: [GitHub](https://thirdpartyindex.com/vendors/github#status), which Hugging Face lists as a subprocessor, reported \[Retroactive\] Actions workflow run logs delayed (minor) The subprocessor list as we read it on any date: https://thirdpartyindex.com/labs/time-machine/hugging-face ## Security contact From its security.txt (https://huggingface.co/.well-known/security.txt) ([evidence](https://thirdpartyindex.com/evidence/924)): - Contact: mailto:security@huggingface.co - Security jobs: https://huggingface.co/careers - Languages: en - Valid until 2030-07-01 --- Third Party Index (https://thirdpartyindex.com) monitors vendors' public security and privacy documents and keeps each version as evidence. Data CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/); vendors' own documents are theirs. API: https://thirdpartyindex.com/api