# NCC Group

NCC Group declares [19 subprocessors](https://thirdpartyindex.com/vendors/ncc-group#subprocessors) in [its subprocessor list](https://www.nccgroup.com/terms-and-conditions/sub-processors/), which we last checked on 2026-10-26 ([evidence](https://thirdpartyindex.com/evidence/91560)). They include [Microsoft](https://thirdpartyindex.com/vendors/microsoft), [DigitalOcean](https://thirdpartyindex.com/vendors/digitalocean) and [Amazon](https://thirdpartyindex.com/vendors/amazon). No published changes since we first read it on 2026-10-13.

NCC Group (nccgroup.com): subprocessors, data processing agreement, security documents and changes, as monitored by Third Party Index.

- Page: https://thirdpartyindex.com/vendors/ncc-group
- Documents last verified: 2026-10-26
- Transparency rating: 70/100 (how much it publishes, not how secure it is): Subprocessor list 30/30; Processing locations 8/8; Purposes 7/7; Data processing addendum 0/12 (not found); Trust center 0/8 (not found); Privacy policy 6/6; security.txt 6/6; Security page 0/5 (not found); Status page 0/5 (not found); Vulnerability disclosure 5/5; Pages still reachable 8/8
- Supply chain: relies on 14 tracked vendors directly, 79 within two hops, 317 within three; 0 tracked vendors rely on it directly, 0 within two hops, 0 within three
- Cite as: NCC Group, Third Party Index, https://thirdpartyindex.com/vendors/ncc-group (data CC BY 4.0)

## Documents

| Document | URL | Last verified | Last changed |
|---|---|---|---|
| Subprocessor list | https://www.nccgroup.com/terms-and-conditions/sub-processors/ | 2026-10-26 | 2026-10-13 |
| Privacy policy | https://www.nccgroup.com/privacy-notice/ | 2026-10-26 | 2026-10-13 |
| Terms | https://www.nccgroup.com/media/fb3jvlzd/ncc-group-short-form-terms-and-conditions-and-dpa-effective-2-december-2024-v13.pdf | 2026-10-26 | 2026-10-14 |
| security.txt | https://www.nccgroup.com/.well-known/security.txt | 2026-10-26 | 2026-10-13 |
| Security advisories | https://www.nccgroup.com/vulnerability-disclosure-programme/ | 2026-10-26 | 2026-10-13 |

## Subprocessors (19)

As its own list states them.

| Subprocessor | Purpose | Location | Listed since |
|---|---|---|---|
| [Amazon](https://thirdpartyindex.com/vendors/amazon.md) | Amazon Web Services (for hosting, connectivity layer and middleware) | APAC; Asia Pacific (Singapore) Region; Australia (Sydney) Region; Europe; Europe (Frankfurt) Region; Europe (Ireland) Region; Europe (London) Region; Europe (Paris) Region; Multi-region: EU, UK, US and APAC; US East (Northern Virginia) Region; US East (Ohio) Region; US West (Northern California) Region; US West (Oregon) Region; United States | 2026-10-13 |
| [Broadcom (VMWare Carbon Black)](https://thirdpartyindex.com/vendors/broadcom.md) | Security data analytics service (Endpoint protection) | & GCP-hosted: by default Europe West (Belgium) Region; AWS-hosted: by default Europe (Frankfurt) Region; NA and APAC customers: US Central (Iowa) Region; NA and APAC customers: US East (South Carolina) Region | 2026-10-13 |
| [CrowdStrike](https://thirdpartyindex.com/vendors/crowdstrike.md) | Security data analytics service (Endpoint protection) | By default: Europe (Frankfurt) Region; NA and APAC NA customers: US Central (Iowa) Region | 2026-10-13 |
| [CyCognito](https://thirdpartyindex.com/vendors/cycognito.md) | External Attack Surface Management Service | (potentially also in Israel in case of support); GCP-hosted: Europe West (Belgium) Region | 2026-10-13 |
| [Digital Ocean](https://thirdpartyindex.com/vendors/digitalocean.md) | Hosting (Digital Ocean Cloud); Self service linux machines for short term projects | APAC: Australia (Sydney), Singapore; EU: Europe (Frankfurt) or Amsterdam); Multi region: EU, UK, US and APAC; NA: US (New York or San Francisco), Canada (Toronto); UK: Europe (London) | 2026-10-13 |
| [Horizon3.ai (NodeZero)](https://thirdpartyindex.com/vendors/horizon3-ai.md) | Providing automated testing services | EU: Europe (Frankfurt) Region; NA: US West (Oregon) Region | 2026-10-13 |
| [IASME](https://thirdpartyindex.com/vendors/iasme.md) | Vulnerability scan & audit platform service | Azure-hosted: UK (London) Region | 2026-10-13 |
| Intermax Cloudsourcing | Private hosting service | NL (Amsterdam, Rotterdam, Delft) | 2026-10-13 |
| [Microsoft](https://thirdpartyindex.com/vendors/microsoft.md) | Azure (for hosting, security data analytics and connectivity layer), Office 365 (several office applications) and EntraID (for active directory); Hosting (Azure Cloud), security data analytics service (Azure Sentinel), connectivity layer (Azure Lighthouse), and active directory (EntraID) | Mentioned regions are the primary choice by default. Other regions are dependent on client choice; Multi-region: EU, UK and US; North Europe (Ireland) Region; UK South (London) Region (regarding all e-mail data); West Europe (Netherlands) Region; West Europe (Netherlands) Region, North Europe (Ireland) Region, UK South (London) Region | 2026-10-13 |
| Mindgame | Awareness campaign tool | DigitalOcean-hosted: Europe (Amsterdam) Region | 2026-10-13 |
| [Qualys](https://thirdpartyindex.com/vendors/qualys.md) | Internal & External Attack Surface Management Services | APAC: Australia (Sydney) Region; EU: Europe (Amsterdam) Region; NA: US (Phoenix) Region; Oracle-hosted: Region by choice of Client; Qualys support: India and the US; UK: UK (London) Region | 2026-10-13 |
| Reveal Data Corporation | eDiscovery platform service | (potentially also in UK and US for support on a case-by-case basis); AWS-hosted: Europe (Frankfurt) Region | 2026-10-13 |
| [Searchlight Cyber](https://thirdpartyindex.com/vendors/searchlight-cyber.md) | Web monitoring service | Digital Ocean & AWS hosted: Europe (London) Region | 2026-10-13 |
| [SentinelOne](https://thirdpartyindex.com/vendors/sentinelone.md) | Security data analytics service (Endpoint protection) | By default: Europe (Frankfurt) Region; NA and APAC customers: US East (Virginia) Region | 2026-10-13 |
| [ServiceNow](https://thirdpartyindex.com/vendors/servicenow.md) | Security incident management platform service | Azure-hosted: UK South (London) Region; For EU-only clients, the option for onboarding in West Europe (NL) region and North Europa (Ireland) Region is available | 2026-10-13 |
| [Splunk](https://thirdpartyindex.com/vendors/splunk.md) | Security data analytics (SIEM) service | APAC: Asia Pacific (Sydney) Region; AWS hosted: Region by choice of Client.; EU: Europe (Frankfurt) Region; NA: US West (N. California) Region; UK: Europe (London) Region | 2026-10-13 |
| Thinkst Canary | Threat detection and deception service | APAC: Asia Pacific (Sydney) Region; AWS-hosted: Region by choice of Client.; EU: Europe (Ireland) Region,; NA: US West (N. California) Region; UK: Europe (London) Region | 2026-10-13 |
| [Umbrio (Davinsi)](https://thirdpartyindex.com/vendors/umbrio.md) | Support service | Azure-hosted: West Europe Region (NL) | 2026-10-13 |
| ZyLAB ONE | eDiscovery platform service | Azure-hosted: West Europe (Netherlands) Region | 2026-10-13 |

Read from ([evidence](https://thirdpartyindex.com/evidence/91560)). CSV: https://thirdpartyindex.com/vendors/ncc-group/subprocessors.csv

## Web Technologies

NCC Group's homepage made 104 requests to 7 domains, and 4 services controlled by another company. Loaded on 2026-10-14 by a browser that accepted nothing; other visits may load more or less. What a page loads is not a list of who receives customer data.

4 third parties by category: Advertising 1 (usually detected as Advertising: Google Cloud); Cookie compliance 1 (Civic Computing (CIVIC)); CDN 1 (jsDelivr); Video players 1 (reviewed: Vimeo). Each company that appears controlled by another organization is counted once, under the main category of the technologies detected from it on this homepage or, when none was, the category recorded from the company's own page (marked reviewed) or else the one it is usually detected as on other published homepages (marked as such); unclassified: none of these.

### Third parties (4)

- Vimeo: 18 requests to vimeocdn.com, vimeo.com
- Google Cloud: 3 requests to gstatic.com, fonts.googleapis.com
- Civic Computing (CIVIC): 2 requests to civiccomputing.com; CIVIC, Cookie Control
- jsDelivr: 1 request to jsdelivr.net; jsDelivr

### First party (1)

- NCC Group: 80 requests to nccgroup.com; Azure, Azure Front Door, Glide.js, Google Tag Manager, HSTS, MathJax 3.2.2, Open Graph, Vimeo, core-js 3.46.0

3 tracked companies loaded by the homepage are not in NCC Group's subprocessor list. A website can use a service without it processing customer data.

## Subprocessor of (0)

No tracked vendor lists it.

## Incidents reported by NCC Group's subprocessors

Incidents reported in the last 30 days on their own status pages by 3 vendors NCC Group lists as subprocessors. A subprocessor list names a company, not the service an incident touched.

- 2026-10-23: [Qualys](https://thirdpartyindex.com/vendors/qualys#status), which NCC Group lists as a subprocessor, reported US Platform 1: Performance Degradation for UAI/ETM (IM-12931) (minor)
- 2026-10-22: [Qualys](https://thirdpartyindex.com/vendors/qualys#status), which NCC Group lists as a subprocessor, reported EU Platform 2: Performance Degradation in multiple modules (IM-12933) (minor)
- 2026-10-21: [Qualys](https://thirdpartyindex.com/vendors/qualys#status), which NCC Group lists as a subprocessor, reported US Platform 01: Users accessing VMDR module getting redirected to login page \[IM-12932\] (minor)
- 2026-10-20: [Broadcom](https://thirdpartyindex.com/vendors/broadcom#status), which NCC Group lists as a subprocessor, reported New Configuration Propagation Delays (no impact stated)
- 2026-10-20: [Broadcom](https://thirdpartyindex.com/vendors/broadcom#status), which NCC Group lists as a subprocessor, reported Web Isolation Degraded Performance in Europe Region (no impact stated)
- 2026-10-20: [Broadcom](https://thirdpartyindex.com/vendors/broadcom#status), which NCC Group lists as a subprocessor, reported Degraded Performance in Europe Region (no impact stated)
- 2026-10-20: [Broadcom](https://thirdpartyindex.com/vendors/broadcom#status), which NCC Group lists as a subprocessor, reported Performance issues in Europe Region (no impact stated)
- 2026-10-16: [Qualys](https://thirdpartyindex.com/vendors/qualys#status), which NCC Group lists as a subprocessor, reported EU Platform 2: High Portal-Indexing lag \[IM-12919\] (minor)
- 2026-10-15: [Broadcom](https://thirdpartyindex.com/vendors/broadcom#status), which NCC Group lists as a subprocessor, reported Web Isolation Connectivity Issue (no impact stated)
- 2026-10-14: [Broadcom](https://thirdpartyindex.com/vendors/broadcom#status), which NCC Group lists as a subprocessor, reported Event Processing Delays in the US Region (no impact stated)
- 2026-10-13: [DigitalOcean](https://thirdpartyindex.com/vendors/digitalocean#status), which NCC Group lists as a subprocessor, reported App Platform Deployments (no impact stated)
- 2026-10-12: [Qualys](https://thirdpartyindex.com/vendors/qualys#status), which NCC Group lists as a subprocessor, reported US Platform 1: Delay in Data Processing (IM-12916) (minor)
- 2026-10-11: [DigitalOcean](https://thirdpartyindex.com/vendors/digitalocean#status), which NCC Group lists as a subprocessor, reported DNS Resolution for Managed Kubernetes (minor)
- 2026-10-08: [Broadcom](https://thirdpartyindex.com/vendors/broadcom#status), which NCC Group lists as a subprocessor, reported Investigate Page Search Degraded Performance - APJ and EU Regions (no impact stated)
- 2026-10-08: [Broadcom](https://thirdpartyindex.com/vendors/broadcom#status), which NCC Group lists as a subprocessor, reported SMS Delivery Delays from Twilio to Verizon Wireless United States (no impact stated)
- 2026-10-08: [Qualys](https://thirdpartyindex.com/vendors/qualys#status), which NCC Group lists as a subprocessor, reported US Platform 4: VM Scans Erroring Out (IM-12906) (minor)
- 2026-10-08: [Broadcom](https://thirdpartyindex.com/vendors/broadcom#status), which NCC Group lists as a subprocessor, reported Data Feed API Unavailable (no impact stated)
- 2026-10-07: [Broadcom](https://thirdpartyindex.com/vendors/broadcom#status), which NCC Group lists as a subprocessor, reported US Region Quarantine Portal Login Unavailable (no impact stated)
- 2026-10-07: [Broadcom](https://thirdpartyindex.com/vendors/broadcom#status), which NCC Group lists as a subprocessor, reported Broadcom Product Licensing is currently unavailable (no impact stated)
- 2026-10-07: [Qualys](https://thirdpartyindex.com/vendors/qualys#status), which NCC Group lists as a subprocessor, reported US Platform 1: Cloud Agent delay in data processing (IM-12901) (minor)
- 2026-10-07: [Qualys](https://thirdpartyindex.com/vendors/qualys#status), which NCC Group lists as a subprocessor, reported IN Platform 1: Performance issues observed on VMDR pages (IM-12904) (minor)
- 2026-10-06: [Broadcom](https://thirdpartyindex.com/vendors/broadcom#status), which NCC Group lists as a subprocessor, reported Event Processing Delays - US Region (no impact stated)
- 2026-10-06: [Broadcom](https://thirdpartyindex.com/vendors/broadcom#status), which NCC Group lists as a subprocessor, reported Network and Web Path Events not displaying (no impact stated)
- 2026-10-06: [Qualys](https://thirdpartyindex.com/vendors/qualys#status), which NCC Group lists as a subprocessor, reported EU Platform 1: Slowness on VMDR Module page (IM-12900) (minor)
- 2026-10-06: [Qualys](https://thirdpartyindex.com/vendors/qualys#status), which NCC Group lists as a subprocessor, reported IN Platform 1: UI logins and API Authencation failing(IM -12899) (critical)
- 2026-10-06: [Qualys](https://thirdpartyindex.com/vendors/qualys#status), which NCC Group lists as a subprocessor, reported US Platform 3: Container Security (CS) Users may experience a delay in scan processing for containers \[IM-12886\] (minor)
- 2026-10-05: [Broadcom](https://thirdpartyindex.com/vendors/broadcom#status), which NCC Group lists as a subprocessor, reported US Production Slowness (no impact stated)
- 2026-10-05: [DigitalOcean](https://thirdpartyindex.com/vendors/digitalocean#status), which NCC Group lists as a subprocessor, reported VPC Networking Availability (minor)
- 2026-10-04: [Broadcom](https://thirdpartyindex.com/vendors/broadcom#status), which NCC Group lists as a subprocessor, reported Sync API Logs Issue (no impact stated)
- 2026-10-03: [DigitalOcean](https://thirdpartyindex.com/vendors/digitalocean#status), which NCC Group lists as a subprocessor, reported A Network Disruption in BLR1 Region Impacted Multiple Products (Resolved) (no impact stated)
- 2026-10-03: [Qualys](https://thirdpartyindex.com/vendors/qualys#status), which NCC Group lists as a subprocessor, reported IN Platform 1: Users are unable to login to the UI (IM-12895) (critical)
- 2026-09-29: [Qualys](https://thirdpartyindex.com/vendors/qualys#status), which NCC Group lists as a subprocessor, reported US Platform 3: Delay in data processing to the UI for Portal modules (IM-12887) (minor)
- 2026-09-29: [Qualys](https://thirdpartyindex.com/vendors/qualys#status), which NCC Group lists as a subprocessor, reported US Platform 4: Delay in data processing to the UI for Portal modules \[IM-12885\] (minor)
- 2026-09-28: [Qualys](https://thirdpartyindex.com/vendors/qualys#status), which NCC Group lists as a subprocessor, reported US Platform 1: UI logins failing( IM-12884) (critical)
- 2026-09-28: [Qualys](https://thirdpartyindex.com/vendors/qualys#status), which NCC Group lists as a subprocessor, reported EU Platform 2: Users accessing VMDR module getting redirected to login page \[IM-12883\] (minor)
- 2026-09-27: [Broadcom](https://thirdpartyindex.com/vendors/broadcom#status), which NCC Group lists as a subprocessor, reported Intermittent drop in inbound transactions from Visa Directory Server (no impact stated)

The subprocessor list as we read it on any date: https://thirdpartyindex.com/labs/time-machine/ncc-group

## Security contact

From its security.txt (https://www.nccgroup.com/.well-known/security.txt) ([evidence](https://thirdpartyindex.com/evidence/91559)):

- Contact: https://www.nccgroup.com/us/vulnerability-disclosure-policy/
- Disclosure policy: https://www.nccgroup.com/us/vulnerability-disclosure-policy/
- Encryption key: https://www.nccgroup.com/.well-known/security-key.txt
- No expiry date

---

Third Party Index (https://thirdpartyindex.com) monitors vendors' public security and privacy documents and keeps each version as evidence. Data CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/); vendors' own documents are theirs. API: https://thirdpartyindex.com/api