# Qualys [7 tracked vendors](https://thirdpartyindex.com/vendors/qualys#used-by) name Qualys as a subprocessor, including [Rackspace](https://thirdpartyindex.com/vendors/rackspace), [Digicert](https://thirdpartyindex.com/vendors/digicert) and [AutoRABIT](https://thirdpartyindex.com/vendors/autorabit). We have not found a subprocessor list published by Qualys. We monitor 5 of its documents, which we last checked on 2026-11-11. Qualys (qualys.com): subprocessors, data processing agreement, security documents and changes, as monitored by Third Party Index. - Page: https://thirdpartyindex.com/vendors/qualys - Documents last verified: 2026-11-11 - Transparency rating: 38/100 (how much it publishes, not how secure it is): Subprocessor list 0/30 (not found); Processing locations 0/8 (no list); Purposes 0/7 (no list); Data processing addendum 0/12 (not found); Trust center 8/8; Privacy policy 6/6; security.txt 6/6; Security page 0/5 (not found); Status page 5/5; Vulnerability disclosure 5/5; Pages still reachable 8/8 - Supply chain: relies on 0 tracked vendors directly, 0 within two hops, 0 within three; 7 tracked vendors rely on it directly, 33 within two hops, 170 within three - Cite as: Qualys, Third Party Index, https://thirdpartyindex.com/vendors/qualys (data CC BY 4.0) ## Documents | Document | URL | Last verified | Last changed | |---|---|---|---| | Trust center | https://success.qualys.com/support/s/standards | 2026-11-11 | 2026-09-27 | | Privacy policy | https://www.qualys.com/company/privacy | 2026-11-11 | 2026-10-25 | | security.txt | https://www.qualys.com/.well-known/security.txt | 2026-11-11 | 2026-09-27 | | Status page | https://status.qualys.com/ | 2026-11-11 | 2026-11-11 | | Security advisories | https://www.qualys.com/research/security-advisories | 2026-11-11 | 2026-09-27 | ## Subprocessors (0) No subprocessor list has been found or read for this vendor. ## Compliance As its trust center lists them. - FedRAMP Marketplace: Moderate · 17 agency authorizations · since Nov 2, 2016 - FedRAMP Marketplace: High · 2 agency authorizations · since Aug 14, 2025 ## Security program What QUALYS, INC.'s Form 10-K for fiscal 2025, filed Feb 20, 2026 (Item 1C) says, in its words (https://www.sec.gov/Archives/edgar/data/1107843/000110784326000008/0001107843-26-000008-index.htm). - Led by: Chief Information Security Officer, reporting to the Chief Executive Officer - Board oversight: Audit and Risk Committee, Risk Committee - Frameworks named: NIST, ISO 27001, FedRAMP - Practices named: Incident response plan, Tabletop exercises - Engages outside assessors or consultants - Reviews its suppliers' security ## Web Technologies Qualys's homepage made 205 requests to 11 domains, and 8 services controlled by another company. Loaded on 2026-11-10 by a browser that accepted nothing; other visits may load more or less. What a page loads is not a list of who receives customer data. 8 third parties by category: Analytics 3 (Wingify, Google Cloud, Cloudflare); Live chat 1 (Qualified.com, Inc.); Cookie compliance 1 (Cookiebot); CMS 1 (Builder.io); Digital asset management 1 (reviewed: ImageKit); Issue trackers 1 (usually detected as Issue trackers: Sentry). Each company that appears controlled by another organization is counted once, under the main category of the technologies detected from it on this homepage or, when none was, the category recorded from the company's own page (marked reviewed) or else the one it is usually detected as on other published homepages (marked as such); unclassified: none of these. ### Third parties (8) - Builder.io: 53 requests to builder.io; Builder.io - Qualified.com, Inc.: 27 requests to qualified.com; Qualified - ImageKit: 25 requests to imagekit.io - Wingify: 6 requests to visualwebsiteoptimizer.com; VWO - Cookiebot: 4 requests to cookiebot.com; Cookiebot 1 - Google Cloud: 4 requests to googletagmanager.com, google-analytics.com, googlesyndication.com; Google Analytics, Google Tag Manager - Cloudflare: 1 request to cloudflareinsights.com; Cloudflare Browser Insights - Sentry: 1 request to sentry.io ### First party (1) - Qualys: 84 requests to qualys.com; Cloudflare, Cybot, Emotion, GSAP, HSTS, Next.js 16.4.5, Next.js App Router, Open Graph, Priority Hints, React, Sentry, Swiper, Turbopack, Webpack, anime.js 7 tracked companies loaded by the homepage are not in Qualys's subprocessor list. A website can use a service without it processing customer data. ## Subprocessor of (7) Tracked vendors whose own subprocessor lists name it, and what they say they use it for. - [AutoRABIT](https://thirdpartyindex.com/vendors/autorabit.md) - [Digicert](https://thirdpartyindex.com/vendors/digicert.md): Provide vulnerability management and security assessment services resold to customers - [Ivanti](https://thirdpartyindex.com/vendors/ivanti.md): Vulnerability Management - [NCC Group](https://thirdpartyindex.com/vendors/ncc-group.md): Internal & External Attack SurfaceExposure Management Services (VMA, ASM or CTEM) - [Rackspace](https://thirdpartyindex.com/vendors/rackspace.md): Products & Services – Security - [Talent Plus](https://thirdpartyindex.com/vendors/talent-plus.md): Vulnerability and Web Application Scanning - [UltraDNS](https://thirdpartyindex.com/vendors/ultradns.md): Provide vulnerability management and security assessment services resold to customers ## Service status Incidents it reported on its own status page. - Last 90 days: 48 reported incidents (4 major or critical, 43 minor, 1 with no impact stated) - Typical time to resolve: 32 h 55 min - Status page last read: 2026-11-12 - Its status page says now: Partially Degraded Service (affected: US Platform 1: degraded performance, US Platform 3: degraded performance, KSA Platform 1: under maintenance) - Under way: US Platform 3: Performance Degradation for UAI/CSAM/GAV/ETM (IM-12980) (minor), since 2026-11-12 06:37 UTC - Under way: US Platform 1: Delay in Data Reflection in UI (IM-12979) (minor), since 2026-11-11 21:08 UTC - Under way: US Platform 3: Delay in Data Reflection in UI (IM-12976) (minor), since 2026-11-10 20:57 UTC - 2026-12-15: US Platform 2: Purge Rules Not Executing Daily (IM-12426) (minor) - 2026-11-12: US Platform 3: Performance Degradation for UAI/CSAM/GAV/ETM (IM-12980) (minor) - 2026-11-11: US Platform 1: Delay in Data Reflection in UI (IM-12979) (minor) - 2026-11-10: US Platform 3: Delay in Data Reflection in UI (IM-12976) (minor) - 2026-11-09: Multiple Shared Platforms \[US02, CA01, UK01, KSA01, EU01, EU03, and AU01\]: Dashboard Recycle Bin Email Notification Issue (IM-12973) (minor) - 2026-11-07: US Platform 1, US Platform 4 : Delay in Data Reflection in UI (IM-12970) (minor) - 2026-11-04: US Platform 1: Delay in Data Reflection in UI \[IM-12961\] (minor) - 2026-11-03: US Platform 1: VM Scan Processing Delays (IM-12959) (minor) ## Recent changes Changes to its documents and subprocessor list since monitoring began. - 2026-10-22: Changed registry listing: fedramp:F1508207205 ([evidence](https://thirdpartyindex.com/evidence/141337)) - 2026-10-15: Changed registry listing: fedramp:F1508207205 ([evidence](https://thirdpartyindex.com/evidence/105415)) - 2026-10-07: Changed registry listing: fedramp:F1508207205 ([evidence](https://thirdpartyindex.com/evidence/61906)) - 2026-10-03: Changed registry listing: fedramp:F1508207205 ([evidence](https://thirdpartyindex.com/evidence/40338)) - 2026-09-30: Changed registry listing: fedramp:F1508207205 ([evidence](https://thirdpartyindex.com/evidence/25653)) Feed: https://thirdpartyindex.com/vendors/qualys/changes.atom ## Security contact From its security.txt (https://www.qualys.com/.well-known/security.txt) ([evidence](https://thirdpartyindex.com/evidence/10625)): - Contact: mailto:security@qualys.com - Contact: https://www.qualys.com/company/contacts/ - Disclosure policy: https://www.qualys.com/docs/responsible-disclosure-policy.pdf - Security jobs: https://www.qualys.com/careers/ - No expiry date --- Third Party Index (https://thirdpartyindex.com) monitors vendors' public security and privacy documents and keeps each version as evidence. Data CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/); vendors' own documents are theirs. API: https://thirdpartyindex.com/api