# IBM

[41 tracked vendors](https://thirdpartyindex.com/vendors/ibm#used-by) name IBM as a subprocessor, including [Google Cloud](https://thirdpartyindex.com/vendors/google-cloud), [Elasticsearch](https://thirdpartyindex.com/vendors/elasticsearch) and [Gainsight Software](https://thirdpartyindex.com/vendors/gainsight-software). We have not found a subprocessor list published by IBM. We monitor 6 of its documents, which we last checked on 2026-11-11.

IBM (ibm.com): subprocessors, data processing agreement, security documents and changes, as monitored by Third Party Index.

- Page: https://thirdpartyindex.com/vendors/ibm
- Documents last verified: 2026-11-11
- Transparency rating: 45/100 (how much it publishes, not how secure it is): Subprocessor list 0/30 (not found); Processing locations 0/8 (no list); Purposes 0/7 (no list); Data processing addendum 12/12; Trust center 8/8; Privacy policy 6/6; security.txt 6/6; Security page 5/5; Status page 0/5 (not found); Vulnerability disclosure 0/5 (not found); Pages still reachable 8/8
- Companies part of it: [Apptio](https://thirdpartyindex.com/vendors/apptio), [HashiCorp](https://thirdpartyindex.com/vendors/hashicorp)
- Supply chain: relies on 0 tracked vendors directly, 0 within two hops, 0 within three; 41 tracked vendors rely on it directly, 2029 within two hops, 2798 within three
- Cite as: IBM, Third Party Index, https://thirdpartyindex.com/vendors/ibm (data CC BY 4.0)

## Documents

| Document | URL | Last verified | Last changed |
|---|---|---|---|
| Trust center | https://www.ibm.com/trust | 2026-11-11 | 2026-09-21 |
| Data processing addendum | https://www.ibm.com/legal | 2026-11-11 | 2026-09-21 |
| Privacy policy | https://www.ibm.com/us-en/privacy | 2026-11-11 | 2026-09-30 |
| Terms | https://www.ibm.com/support/customer/csol/terms/ | 2026-11-11 | 2026-10-22 |
| Security page | https://www.ibm.com/solutions/security | 2026-11-11 | 2026-10-10 |
| security.txt | https://www.ibm.com/.well-known/security.txt | 2026-11-11 | 2026-11-11 |

## Subprocessors (0)

No subprocessor list has been found or read for this vendor.

## Compliance

As its trust center lists them.

- FedRAMP Marketplace: Moderate · 25 agency authorizations · since Jun 4, 2026
- FedRAMP Marketplace: Moderate · 11 agency authorizations · since Mar 12, 2019
- FedRAMP Marketplace: High · 4 agency authorizations · since Nov 14, 2019
- FedRAMP Marketplace: Moderate · 1 agency authorization · since Feb 10, 2026
- FedRAMP Marketplace: LI-SaaS · 1 agency authorization · since Sep 13, 2024
- FedRAMP Marketplace: High · 2 agency authorizations · since Nov 13, 2025
- FedRAMP Marketplace: Moderate · 5 agency authorizations · since Jun 8, 2023
- FedRAMP Marketplace: Moderate · 9 agency authorizations · since Jul 17, 2015
- FedRAMP Marketplace: High · 4 agency authorizations · since Nov 14, 2019
- FedRAMP Marketplace: High

## Web Technologies

IBM's homepage made 495 requests to 47 domains, 21 services controlled by another company, and 6 domains not identified. Loaded on 2026-11-03 by a browser that accepted nothing; other visits may load more or less. What a page loads is not a list of who receives customer data.

21 third parties by category: Advertising 9 (Microsoft, The Trade Desk, Inc., ID5 Technology Ltd, Reddit, Inc.; reviewed: Eyeota, Index Exchange Inc.; usually detected as Advertising: Magnite, Inc., Xandr, PubMatic); Analytics 6 (Google Cloud, Magellan AI, Bombora, Demandbase, LinkedIn, Medallia); Customer data platform 2 (Segment; reviewed: LiveRamp); Tag managers 1 (Tealium); Marketing automation 1 (Adobe); Cookie compliance 1 (TrustArc); Unclassified 1 (Kaltura). Each company that appears controlled by another organization is counted once, under the main category of the technologies detected from it on this homepage or, when none was, the category recorded from the company's own page (marked reviewed) or else the one it is usually detected as on other published homepages (marked as such); unclassified: none of these.

### Third parties (21)

- Kaltura: 49 requests to kaltura.com
- Google Cloud: 25 requests to doubleclick.net, google.com, google-analytics.com, googleadservices.com, googletagmanager.com; DoubleClick Floodlight, Google Ads Conversion Tracking, Google Analytics, Google Tag Manager
- Tealium: 24 requests to tiqcdn.com, tealiumiq.com; Tealium, Tealium AudienceStream
- Adobe: 14 requests to adobedtm.com, demdex.net, marketo.net, rum.hlx.page; Marketo
- Microsoft: 14 requests to clarity.ms, bing.com; Microsoft Advertising
- The Trade Desk, Inc.: 10 requests to adsrvr.org; theTradeDesk
- Segment: 8 requests to segment.com, segment.io; Segment 1.84.3
- TrustArc: 7 requests to trustarc.com; TrustArc
- Magellan AI: 5 requests to mgln.ai; Magellan AI
- Bombora: 4 requests to ml314.com; Bombora
- Demandbase: 4 requests to company-target.com, demandbase.com; Demandbase 11.8.0
- ID5 Technology Ltd: 4 requests to eu-1-id5-sync.com, id5-sync.com; ID5 1.0.99
- LinkedIn: 3 requests to linkedin.com, licdn.com; Linkedin Insight Tag
- LiveRamp: 3 requests to rlcdn.com
- Magnite, Inc.: 3 requests to rubiconproject.com, tremorhub.com
- Reddit, Inc.: 3 requests to reddit.com, redditstatic.com; Reddit Ads
- Eyeota: 2 requests to eyeota.net
- Xandr: 2 requests to adnxs.com
- Index Exchange Inc.: 1 request to casalemedia.com
- Medallia: 1 request to decibelinsight.net; Decibel
- PubMatic: 1 request to pubmatic.com

### Unknown (6)

Domains not identified yet: o11.tech, d2c7xlmseob604.cloudfront.net, securedvisit.com, usbrowserspeed.com, aistudio-cdata-dev1.s3.us-east-1.amazonaws.com, videoamp.com

### First party (1)

- IBM: 273 requests to ibm.com, s81c.com, ns1p-aws-backed.global.ssl.fastly.net, ns1p.net, ns1pcdn.net; Adobe Client Data Layer 2.0.2, Adobe Experience Manager, Adobe Experience Platform Launch, Adobe Target, Akamai, Akamai Bot Manager, Amazon Web Services, Emotion, Fastly, Google Ads, HSTS, IBM Carbon Design System, Java, Kaltura, Lightbox, MUI, Material UI, Microsoft Clarity, Open Graph, Prebid, Priority Hints, React, core-js 3.36.1, jQuery 1.12.4, lit-element 3.3.3, lit-html 2.8.0

14 tracked companies loaded by the homepage are not in IBM's subprocessor list. A website can use a service without it processing customer data.

## Subprocessor of (41)

Tracked vendors whose own subprocessor lists name it, and what they say they use it for.

- [Agilysys](https://thirdpartyindex.com/vendors/agilysys.md)
- [Airtable](https://thirdpartyindex.com/vendors/airtable.md): AI model provider
- [Apolicy](https://thirdpartyindex.com/vendors/apolicy.md): Data Storage
- [AudioStack](https://thirdpartyindex.com/vendors/audiostack.md): Text to speech provider
- [Box](https://thirdpartyindex.com/vendors/box.md)
- [Bullhorn](https://thirdpartyindex.com/vendors/bullhorn.md): Cloud database management services; Cloud hosting services
- [Celonis](https://thirdpartyindex.com/vendors/celonis.md): ● AI inferences and AI services
- [Certara](https://thirdpartyindex.com/vendors/certara.md): Cloud hosting (IBM Cloud)
- [Check Point Software Technologies](https://thirdpartyindex.com/vendors/check-point-software-technologies.md): Support
- [ConnectWise](https://thirdpartyindex.com/vendors/connectwise.md): Data Center Provider; United States
- [Daytona](https://thirdpartyindex.com/vendors/daytona.md): Cloud Infrastructure
- [Dispel](https://thirdpartyindex.com/vendors/dispel.md): Cloud service provider; Data Controller
- [EasyPost](https://thirdpartyindex.com/vendors/easypost.md): Cloud Providers
- [Elasticsearch](https://thirdpartyindex.com/vendors/elasticsearch.md): Hosting
- [Experian](https://thirdpartyindex.com/vendors/experian.md): Mainframe software and support services.; Sub-contractor; Sub-processor
- [Fonn Group](https://thirdpartyindex.com/vendors/fonn-group.md): AI functionality (speech-to-text services).
- [Gainsight Software](https://thirdpartyindex.com/vendors/gainsight-software.md): Cloud Service Provider for Certain Generative Artificial Intelligence features.; Natural Language Processing and Cloud Service Provider
- [Google Cloud](https://thirdpartyindex.com/vendors/google-cloud.md): Assured Support (US); Technical Support
- [Heap](https://thirdpartyindex.com/vendors/heap.md): Performs analytics and reporting on Customer Data within the VOC
- [Higher Logic](https://thirdpartyindex.com/vendors/higher-logic.md): AI assistant & Elastic Search
- [HorizonIQ](https://thirdpartyindex.com/vendors/horizoniq.md): IBM provides SoftLayer, a dedicated server, managed hosting, and cloud computing provider.
- [Kryterion](https://thirdpartyindex.com/vendors/kryterion.md)
- [Medallia](https://thirdpartyindex.com/vendors/medallia.md): Watson natural language processing for sentiment analysis.
- [Naviam](https://thirdpartyindex.com/vendors/naviam.md): Cloud Infrastructure Operations; Cloud Service Provider
- [PartnerTap](https://thirdpartyindex.com/vendors/partnertap.md): Engineering; Enterprise software and cloud services.
- [Persona](https://thirdpartyindex.com/vendors/persona.md)
- [Precisely Software](https://thirdpartyindex.com/vendors/precisely-software.md): Data Infrastructure
- [Qualtrics](https://thirdpartyindex.com/vendors/qualtrics.md): Data hosting facilities.
- [Red Box](https://thirdpartyindex.com/vendors/red-box.md): Large-scale cloud database built on Apache Cassandra
- [Sirion](https://thirdpartyindex.com/vendors/sirion.md): Sirion Platform, where all customer data is stored and processed, is; hosted on IBM Cloud
- [SolarWinds](https://thirdpartyindex.com/vendors/solarwinds.md)
- [Sysdig](https://thirdpartyindex.com/vendors/sysdig.md): Data Storage
- [Temporal](https://thirdpartyindex.com/vendors/temporal.md): Datastax Database
- [Textkernel](https://thirdpartyindex.com/vendors/textkernel.md): Cloud database management services; Cloud hosting services
- [ThoughtExchange](https://thirdpartyindex.com/vendors/thoughtexchange.md): Natural Language API
- [Together AI](https://thirdpartyindex.com/vendors/together-ai.md): Hosting and cloud infrastructure
- [Tungsten Automation](https://thirdpartyindex.com/vendors/tungsten-automation.md): Database plugin running on Azure; Tungsten Products or Service(s): Printix
- [UKG](https://thirdpartyindex.com/vendors/ukg.md)
- [Uniphore](https://thirdpartyindex.com/vendors/uniphore.md): Large-scale cloud database built on Apache Cassandra
- [Virtuozzo](https://thirdpartyindex.com/vendors/virtuozzo.md): Hosting provider for Support Gateway
- [Wasabi](https://thirdpartyindex.com/vendors/wasabi.md): Compute

## Security record

CISA's Known Exploited Vulnerabilities catalog lists 9 vulnerabilities in its software:

- CVE-2026-123218 (Aspera Faspex), listed 2026-11-09: IBM Aspera Faspex Incorrect Authorization Vulnerability
- CVE-2026-9198 (Langflow), listed 2026-08-04: IBM Langflow Code Injection Vulnerability
- CVE-2022-47986 (Aspera Faspex), listed 2023-02-21: IBM Aspera Faspex Code Execution Vulnerability (known ransomware use)
- CVE-2013-3993 (InfoSphere BigInsights), listed 2022-05-25: IBM InfoSphere BigInsights Invalid Input Vulnerability (known ransomware use)
- CVE-2015-7450 (WebSphere Application Server and Server Hypervisor Edition), listed 2022-01-10: IBM WebSphere Application Server and Server Hypervisor Edition Code Injection.
- CVE-2019-4716 (Planning Analytics), listed 2021-11-03: IBM Planning Analytics Remote Code Execution Vulnerability
- CVE-2020-4427 (Data Risk Manager), listed 2021-11-03: IBM Data Risk Manager Security Bypass Vulnerability
- CVE-2020-4428 (Data Risk Manager), listed 2021-11-03: IBM Data Risk Manager Remote Code Execution Vulnerability
- CVE-2020-4430 (Data Risk Manager), listed 2021-11-03: IBM Data Risk Manager Directory Traversal Vulnerability

## Recent changes

Changes to its documents and subprocessor list since monitoring began.

- 2026-10-22: Changed registry listing: fedramp:FR2607452240 ([evidence](https://thirdpartyindex.com/evidence/141337))
- 2026-10-07: Changed registry listing: fedramp:FR2607452240 ([evidence](https://thirdpartyindex.com/evidence/61906))
- 2026-10-03: Changed registry listing: fedramp:FR2607452240 ([evidence](https://thirdpartyindex.com/evidence/40338))
- 2026-09-30: Changed registry listing: fedramp:FR2607452240 ([evidence](https://thirdpartyindex.com/evidence/25653))

Feed: https://thirdpartyindex.com/vendors/ibm/changes.atom

## Security contact

From its security.txt (https://www.ibm.com/.well-known/security.txt) ([evidence](https://thirdpartyindex.com/evidence/255927)):

- Contact: https://www.ibm.com/trust/security-psirt
- Contact: https://hackerone.com/ibm?type=team
- Contact: mailto:psirt@us.ibm.com
- Encryption key: https://www.ibm.com/downloads/documents/us-en/15db45ee46d2037d
- Acknowledgments: https://www.ibm.com/blogs/psirt/ibm-acknowledgement/
- Valid until 2026-12-11

---

Third Party Index (https://thirdpartyindex.com) monitors vendors' public security and privacy documents and keeps each version as evidence. Data CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/); vendors' own documents are theirs. API: https://thirdpartyindex.com/api