NCC Group
NCC Group declares 19 subprocessors in its subprocessor list, which we last checked on Oct 25, 2026 (evidence). They include Microsoft, DigitalOcean and Amazon. No published changes since we first read it on Oct 13, 2026.
Not listed by any tracked vendor.
Not loaded by any published homepage.
Subprocessors CSV of NCC Group's subprocessors · Atom feed of NCC Group's subprocessors DORA draft CSV of NCC Group's subprocessors as declared by NCC Group what's this? ·
19 third parties.
| Name | Purpose | Location | Listed since |
|---|---|---|---|
| Amazon | Amazon Web Services (for hosting, connectivity layer and middleware) | APAC; Asia Pacific (Singapore) Region; Australia (Sydney) Region; Europe; Europe (Frankfurt) Region; Europe (Ireland) Region; Europe (London) Region; Europe (Paris) Region; Multi-region: EU, UK, US and APAC; US East (Northern Virginia) Region; US East (Ohio) Region; US West (Northern California) Region; US West (Oregon) Region; United States | |
| Broadcom (VMWare Carbon Black) | Security data analytics service (Endpoint protection) | & GCP-hosted: by default Europe West (Belgium) Region; AWS-hosted: by default Europe (Frankfurt) Region; NA and APAC customers: US Central (Iowa) Region; NA and APAC customers: US East (South Carolina) Region | |
| CrowdStrike | Security data analytics service (Endpoint protection) | By default: Europe (Frankfurt) Region; NA and APAC NA customers: US Central (Iowa) Region | |
| CyCognito | External Attack Surface Management Service | (potentially also in Israel in case of support); GCP-hosted: Europe West (Belgium) Region | |
| Digital Ocean | Hosting (Digital Ocean Cloud); Self service linux machines for short term projects | APAC: Australia (Sydney), Singapore; EU: Europe (Frankfurt) or Amsterdam); Multi region: EU, UK, US and APAC; NA: US (New York or San Francisco), Canada (Toronto); UK: Europe (London) | |
| Horizon3.ai (NodeZero) | Providing automated testing services | EU: Europe (Frankfurt) Region; NA: US West (Oregon) Region | |
| IASME | Vulnerability scan & audit platform service | Azure-hosted: UK (London) Region | |
| Intermax Cloudsourcing | Private hosting service | NL (Amsterdam, Rotterdam, Delft) | |
| Microsoft | Azure (for hosting, security data analytics and connectivity layer), Office 365 (several office applications) and EntraID (for active directory); Hosting (Azure Cloud), security data analytics service (Azure Sentinel), connectivity layer (Azure Lighthouse), and active directory (EntraID) | Mentioned regions are the primary choice by default. Other regions are dependent on client choice; Multi-region: EU, UK and US; North Europe (Ireland) Region; UK South (London) Region (regarding all e-mail data); West Europe (Netherlands) Region; West Europe (Netherlands) Region, North Europe (Ireland) Region, UK South (London) Region | |
| Mindgame | Awareness campaign tool | DigitalOcean-hosted: Europe (Amsterdam) Region | |
| Qualys | Internal & External Attack Surface Management Services | APAC: Australia (Sydney) Region; EU: Europe (Amsterdam) Region; NA: US (Phoenix) Region; Oracle-hosted: Region by choice of Client; Qualys support: India and the US; UK: UK (London) Region | |
| Reveal Data Corporation | eDiscovery platform service | (potentially also in UK and US for support on a case-by-case basis); AWS-hosted: Europe (Frankfurt) Region | |
| Searchlight Cyber | Web monitoring service | Digital Ocean & AWS hosted: Europe (London) Region | |
| SentinelOne | Security data analytics service (Endpoint protection) | By default: Europe (Frankfurt) Region; NA and APAC customers: US East (Virginia) Region | |
| ServiceNow | Security incident management platform service | Azure-hosted: UK South (London) Region; For EU-only clients, the option for onboarding in West Europe (NL) region and North Europa (Ireland) Region is available | |
| Splunk | Security data analytics (SIEM) service | APAC: Asia Pacific (Sydney) Region; AWS hosted: Region by choice of Client.; EU: Europe (Frankfurt) Region; NA: US West (N. California) Region; UK: Europe (London) Region | |
| Thinkst Canary | Threat detection and deception service | APAC: Asia Pacific (Sydney) Region; AWS-hosted: Region by choice of Client.; EU: Europe (Ireland) Region,; NA: US West (N. California) Region; UK: Europe (London) Region | |
| Umbrio (Davinsi) | Support service | Azure-hosted: West Europe Region (NL) | |
| ZyLAB ONE | eDiscovery platform service | Azure-hosted: West Europe (Netherlands) Region |
Web TechnologiesCSV of NCC Group's web technologies · Atom feed of NCC Group's web technologies
NCC Group's homepage made 104 requests to 7 domains, and 4 services controlled by another company.
4 third parties by category: Advertising 1Cookie compliance 1CDN 1Other 1
Third parties 4 · 24 requests
Civic Computing (CIVIC) CIVIC Cookie Control 2
First party 1 · 80 requests
NCC Group Azure Azure Front Door Glide.js Google Tag Manager HSTS MathJax 3.2.2 Open Graph Vimeo core-js 3.46.0 80
3 tracked companies loaded by the homepage are not in NCC Group's subprocessor list. A website can use a service without it processing customer data.
Incidents reported by NCC Group's subprocessorsCSV of incidents reported by vendors NCC Group lists · Atom feed of incidents reported by vendors NCC Group lists
36 reported incidents in the last 30 days, by 3 of the vendors NCC Group lists as subprocessors.
A subprocessor list names a company, not the service an incident touched. This does not show that NCC Group was involved.
And 11 more. All of them: CSV · Who is around them.
ChangesCSV of NCC Group's changes · Atom feed of NCC Group's changes
See the list as we read it on any date: Time machine
None since tracking began.
Rating badge for NCC Group's site
It updates with the rating.
<a href="https://thirdpartyindex.com/vendors/ncc-group"><img src="https://thirdpartyindex.com/badge/ncc-group.svg" alt="NCC Group transparency rating on Third Party Index" height="20"></a>[](https://thirdpartyindex.com/vendors/ncc-group)