# Qlik

Qlik declares [12 subprocessors](https://thirdpartyindex.com/vendors/qlik#subprocessors), plus 23 of its own affiliates, in [its subprocessor list](https://pages.qlik.com/qlik_subprocessor_list.html), which we last checked on 2026-11-11 ([evidence](https://thirdpartyindex.com/evidence/1702)). They include [Amazon Web Services](https://thirdpartyindex.com/vendors/amazon-web-services), [Microsoft](https://thirdpartyindex.com/vendors/microsoft) and [Salesforce](https://thirdpartyindex.com/vendors/salesforce). No published changes since we first read it on 2026-09-21. [19 tracked vendors](https://thirdpartyindex.com/vendors/qlik#used-by) name Qlik as a subprocessor, including [Vanta](https://thirdpartyindex.com/vendors/vanta), [2NDSITE Inc. (Freshbooks)](https://thirdpartyindex.com/vendors/2ndsite-inc-freshbooks) and [Check Point Software Technologies](https://thirdpartyindex.com/vendors/check-point-software-technologies).

Qlik (qlik.com): subprocessors, data processing agreement, security documents and changes, as monitored by Third Party Index.

- Page: https://thirdpartyindex.com/vendors/qlik
- Documents last verified: 2026-11-11
- Transparency rating: 84/100 (how much it publishes, not how secure it is): Subprocessor list 30/30; Processing locations 8/8; Purposes 7/7; Data processing addendum 12/12; Trust center 8/8; Privacy policy 6/6; security.txt 0/6 (not found); Security page 0/5 (not found); Status page 5/5; Vulnerability disclosure 0/5 (not found); Pages still reachable 8/8
- Supply chain: relies on 7 tracked vendors directly, 75 within two hops, 326 within three; 19 tracked vendors rely on it directly, 183 within two hops, 440 within three
- Cite as: Qlik, Third Party Index, https://thirdpartyindex.com/vendors/qlik (data CC BY 4.0)

## Documents

| Document | URL | Last verified | Last changed |
|---|---|---|---|
| Trust center | https://www.qlik.com/us/trust | 2026-11-11 | 2026-09-21 |
| Subprocessor list | https://pages.qlik.com/qlik\_subprocessor\_list.html | 2026-11-11 | 2026-09-21 |
| Data processing addendum | https://assets.qlik.com/image/upload/v1717166902/qlik/docs/Legal/addendums/qlik-data-processing-addendum\_rlbhor.pdf | 2026-11-11 | 2026-09-21 |
| Privacy policy | https://www.qlik.com/us/legal/product-privacy-notice | 2026-11-11 | 2026-09-21 |
| Terms | https://www.qlik.com/us/legal/terms-of-use | 2026-11-11 | 2026-09-21 |
| Status page | https://status.qlikcloud.com/ | 2026-11-11 | 2026-09-21 |

## Subprocessors (12)

As its own list states them.

| Subprocessor | Purpose | Location | Listed since |
|---|---|---|---|
| [Ada](https://thirdpartyindex.com/vendors/ada.md) | Support Chatbot | Germany | 2026-09-21 |
| [Amazon Web Services (AWS)](https://thirdpartyindex.com/vendors/amazon-web-services.md) | Qlik Cloud is hosted through AWS; Support case management tools; These Talend Cloud locations are hosted through AWS | Germany; See Qlik Cloud locations at; See Talend Cloud locations at: https://www.qlik.com/us/regions; https://www.qlik.com/us/regions | 2026-09-21 |
| [Atlassian (Jira Cloud)](https://thirdpartyindex.com/vendors/atlassian.md) | R&D support management tool | Germany, Ireland (Back-up) | 2026-09-21 |
| Blendr NV | These affiliates may provide services, such as Consulting or Support, depending on your location and agreement(s) with us. Our Support Services are predominantly performed in the customer's region: EMEA – France, Sweden, Spain, Israel; Americas – USA; APAC – Japan, Australia, India. | Belgium | 2026-09-22 |
| GlobalLogic | Customers who utilize Cloud migration services support | India | 2026-09-21 |
| [Google Firebase](https://thirdpartyindex.com/vendors/firebase.md) | Push notifications | United States | 2026-09-21 |
| [Microsoft](https://thirdpartyindex.com/vendors/microsoft.md) | Customer may send data through Office 365 | United States | 2026-09-21 |
| [Microsoft Azure](https://thirdpartyindex.com/vendors/microsoft.md) | These Talend Cloud locations are hosted through Microsoft Azure | See Talend Cloud locations at: https://www.qlik.com/us/regions | 2026-09-21 |
| [MongoDB](https://thirdpartyindex.com/vendors/mongodb.md) | Any data inputted into the DataPrep and Stewardship modules of Talend Cloud. Hosted in the same region as the customer's Talend Cloud environment on AWS or Microsoft Azure, as selected by the customer.; Any data inputted into the Notes feature in Qlik Cloud | See Qlik Cloud locations at; See Talend Cloud locations at: https://www.qlik.com/us/regions; https://www.qlik.com/us/regions | 2026-09-21 |
| Persistent | R&D Support Services | India | 2026-09-21 |
| [Salesforce](https://thirdpartyindex.com/vendors/salesforce.md) | Support case management tools | UK | 2026-09-21 |
| Stretch Qonnect APs | 2nd line support for the Qlik Analytics Migration Tool | Denmark | 2026-09-21 |

Read from ([evidence](https://thirdpartyindex.com/evidence/1702)). CSV: https://thirdpartyindex.com/vendors/qlik/subprocessors.csv

### Its own affiliates (23)

- Qlik Analytics (ISR) Ltd. (Israel)
- Qlik Business Solutions Company (Kingdom of Saudi Arabia)
- Qlik Technology (Beijing) Limited (China)
- QlikTech GmbH (Austria; Canada; Germany; Switzerland; United States)
- QlikTech Australia Pty Ltd (Australia)
- QlikTech Brasil Comercialização (Brazil)
- QlikTech Denmark ApS (Denmark)
- QlikTech Finland OY (Finland)
- QlikTech France SARL, Talend SAS (France)
- QlikTech Hong Kong Limited (Hong Kong)
- QlikTech Iberica SL (Portugal; Spain)
- QlikTech India Private Limited (India)
- QlikTech International AB (Sweden)
- QlikTech International Markets AB (United Arab Emirates)
- QlikTech Italy S.r.l. (Italy)
- QlikTech Japan K.K. (Japan)
- QlikTech Latam AB (Sweden)
- QlikTech México S. de R.L. de C.V. (Mexico)
- QlikTech Netherlands BV (Belgium; Netherlands)
- QlikTech New Zealand Limited (New Zealand)
- QlikTech Nordic AB (Sweden)
- QlikTech Singapore Pte. Ltd. (Singapore)
- QlikTech UK Limited (United Kingdom)

## Web Technologies

Qlik's homepage made 131 requests to 11 domains, 6 services controlled by another company, and 1 domain not identified. Loaded on 2026-11-04 by a browser that accepted nothing; other visits may load more or less. What a page loads is not a list of who receives customer data.

6 third parties by category: Analytics 1 (Google Cloud); Live chat 1 (Ada Support); Cookie compliance 1 (OneTrust); Issue trackers 1 (usually detected as Issue trackers: Sentry); Search engines 1 (SearchUnify (Grazitti Interactive)); Unclassified 1 (Logos & Types). Each company that appears controlled by another organization is counted once, under the main category of the technologies detected from it on this homepage or, when none was, the category recorded from the company's own page (marked reviewed) or else the one it is usually detected as on other published homepages (marked as such); unclassified: none of these.

### Third parties (6)

- Ada Support: 25 requests to ada.support; Ada
- OneTrust: 11 requests to cookielaw.org, onetrust.com; OneTrust
- Google Cloud: 5 requests to google.com, googletagmanager.com, doubleclick.net; Google Analytics, Google Tag Manager
- Logos & Types: 1 request to logosandtypes.com
- SearchUnify (Grazitti Interactive): 1 request to searchunify.com; SearchUnify
- Sentry: 1 request to sentry.io

### Unknown (1)

Domains not identified yet: d2zcxm2u7ahqlt.cloudfront.net

### First party (1)

- Qlik: 86 requests to qlik.com; FingerprintJS, Gatsby 5.16.1, HSTS, Netlify, Open Graph, PWA, React, Webpack, core-js 3.48.0

4 tracked companies loaded by the homepage are not in Qlik's subprocessor list. A website can use a service without it processing customer data.

## Subprocessor of (19)

Tracked vendors whose own subprocessor lists name it, and what they say they use it for.

- [2NDSITE Inc. (Freshbooks)](https://thirdpartyindex.com/vendors/2ndsite-inc-freshbooks.md): Analytics
- [Auvik](https://thirdpartyindex.com/vendors/auvik.md): Integration and workflow automation
- [Bonusly](https://thirdpartyindex.com/vendors/bonusly.md): Data pipeline / ETL
- [Check Point Software Technologies](https://thirdpartyindex.com/vendors/check-point-software-technologies.md): Data Extraction Services
- [Clever](https://thirdpartyindex.com/vendors/clever.md): Data extract transform load (ETL) service to move data from cloud data stores to analytics database
- [CoderPad](https://thirdpartyindex.com/vendors/coderpad.md): Data pipeline
- [Cognella](https://thirdpartyindex.com/vendors/cognella.md): Data analytics and business intelligence tools.
- [Deepnote](https://thirdpartyindex.com/vendors/deepnote.md): Data pipelines (ETL); Transfers and transforms customer data between services.
- [Drivetrain](https://thirdpartyindex.com/vendors/drivetrain.md)
- [Ethena](https://thirdpartyindex.com/vendors/ethena.md): Facilitate data warehousing
- [Goldcast](https://thirdpartyindex.com/vendors/goldcast.md): Extract, transform, load (ETL) data tool
- [InvestorFlow](https://thirdpartyindex.com/vendors/investorflow.md): Talend ETL
- [JWX](https://thirdpartyindex.com/vendors/jwx.md): Snowflake ETL tool
- [Medallion](https://thirdpartyindex.com/vendors/medallion.md)
- [Pluralsight](https://thirdpartyindex.com/vendors/pluralsight.md): Data Management Tool
- [PowerSchool](https://thirdpartyindex.com/vendors/powerschool.md): Tool to support data migration to data storage
- [Range](https://thirdpartyindex.com/vendors/range.md): Cloud-based ETL
- [SysAid](https://thirdpartyindex.com/vendors/sysaid.md): Analytics platform; Analytics platform powering SysAid's advanced reporting and dashboards, processing service desk data for customers who have licensed Analyst…
- [Vanta](https://thirdpartyindex.com/vendors/vanta.md): Analytics support; Data and analytics

## Security record

CISA's Known Exploited Vulnerabilities catalog lists 3 vulnerabilities in its software:

- CVE-2023-48365 (Sense), listed 2025-01-13: Qlik Sense HTTP Tunneling Vulnerability (known ransomware use)
- CVE-2023-41265 (Sense), listed 2023-12-07: Qlik Sense HTTP Tunneling Vulnerability (known ransomware use)
- CVE-2023-41266 (Sense), listed 2023-12-07: Qlik Sense Path Traversal Vulnerability (known ransomware use)

## Incidents reported by Qlik's subprocessors

Incidents reported in the last 30 days on their own status pages by 1 vendor Qlik lists as a subprocessor. A subprocessor list names a company, not the service an incident touched.

- 2026-10-20: [MongoDB](https://thirdpartyindex.com/vendors/mongodb#status), which Qlik lists as a subprocessor, reported GCP Availability Zone europe-west2-b connectivity issues (minor)

The subprocessor list as we read it on any date: https://thirdpartyindex.com/labs/time-machine/qlik

---

Third Party Index (https://thirdpartyindex.com) monitors vendors' public security and privacy documents and keeps each version as evidence. Data CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/); vendors' own documents are theirs. API: https://thirdpartyindex.com/api