Last updated: June 2, 2026
To provide the Qevlar AI cybersecurity software-as-a-service (the “Services”), Qevlar engages certain third-party suppliers, infrastructure providers, and affiliates (each, a “Sub-processor”). On Qevlar’s instructions, these Sub-processors may process customer personal data on behalf of Qevlar’s customers to facilitate delivery of the Services.
Qevlar’s current Sub-processors for the Services are listed below. This document is provided for transparency and does not grant any party additional rights or remedies, and should not be construed as a binding agreement. The terms of engagement between Qevlar and each Sub-processor (including data-protection obligations) are governed by the relevant customer agreement and the Qevlar Data Processing Agreement (DPA).
For Bring Your Own Cloud (BYOC) deployments, the cloud provider designated by Customer (currently Google Cloud Platform) is the cloud-infrastructure provider of Customer and is not a Sub-processor of Qevlar. Internal-only tooling that does not process customer personal data on Qevlar's behalf (such as Qevlar's internal compliance-evidence, internal project-management, internal business-intelligence, and API-development tooling) is not a Sub-processor and is not included in this list.
1. Qevlar Affiliates
The following Qevlar group entities may provide support, professional, or other service functions for the Services:
| Entity Name |
Location |
Role |
| Qevlar AI Inc. |
United States (Delaware) |
Contracting entity for US and rest-of-world customers; product development, sales, support, and finance. |
| Qevlar AI (SAS) |
France (Issy-les-Moulineaux) |
Contracting entity for EEA, UK, and Swiss customers; product development, security operations, customer success, and EU customer support. |
2. Infrastructure Providers
Qevlar engages the following third-party infrastructure providers in connection with the hosted portions of the Services. These providers may process personal data that customers store in the Services:
| Entity Name |
Service Description |
Headquarter / Processing Location |
| Amazon Web Services, Inc. (AWS) |
Cloud hosting and infrastructure services for the Services. |
United States (HQ); processing in EU regions unless requested otherwise. |
| Google LLC (Google Cloud Platform) |
Cloud hosting and infrastructure services for the Services. |
United States (HQ); processing in EU regions unless requested otherwise. |
| Microsoft Corporation (Microsoft Azure) |
Cloud hosting and infrastructure services for the Services. |
United States (HQ); processing in EU regions unless requested otherwise. |
3. Other Third-Party Sub-processors
The following third-party providers support the development, delivery, and operation of the Services and may process personal data on behalf of Qevlar. Engagement of each Sub-processor is subject to a written agreement imposing data-protection obligations no less protective than those set out in the Qevlar DPA. Sub-processors are organised below by service category.
AI / LLM-Inference Providers
| Entity Name |
Service Description |
Headquarter / Processing Location |
| Microsoft Azure OpenAI Service |
Hosted large language model inference on Customer Data on Qevlar's behalf. |
United States (HQ); EU regions for hosted inference. |
Identity & Authentication
| Entity Name |
Service Description |
Headquarter / Processing Location |
| Auth0 (Okta, Inc.) |
Identity, authentication, and single-sign-on for Authorised User access to the Services. |
United States (Bellevue, WA); EU regions for processing. |
Application Monitoring & Observability
| Entity Name |
Service Description |
Headquarter / Processing Location |
| Langfuse GmbH |
LLM observability, tracing, and prompt-quality monitoring for the Services. |
Germany (Berlin) |
| Literal AI (Chainlit SAS) |
LLM observability, evaluation, and prompt-quality monitoring for the Services. |
France (Paris) |
| Sentry (Functional Software, Inc.) |
Application error tracking, performance monitoring, and crash reporting. |
United States (San Francisco, CA); EU regions for processing. |
Customer Communication & Support
| Entity Name |
Service Description |
Headquarter / Processing Location |
| Slack (Salesforce, Inc.) |
Internal and customer-facing collaboration; may receive Customer Data shared in support channels. |
United States (San Francisco, CA); EU regions for processing. |
| Zendesk, Inc. |
Customer support ticketing and knowledge-base platform. |
United States (San Francisco, CA); EU regions for processing. |
CRM, Marketing & Sales
| Entity Name |
Service Description |
Headquarter / Processing Location |
| HubSpot, Inc. |
Customer-relationship management; marketing and sales contact data. |
United States (Cambridge, MA); EU operations in Dublin, Ireland. |
Knowledge Management & Documentation
| Entity Name |
Service Description |
Headquarter / Processing Location |
| Notion Labs, Inc. |
Internal documentation and customer-facing knowledge content; may receive customer-related notes. |
United States (San Francisco, CA); EU regions for processing. |
Electronic Signature
| Entity Name |
Service Description |
Headquarter / Processing Location |
| YouSign SAS |
Electronic-signature platform for execution of customer agreements and related documents. |
France (Caen) |
Product Analytics
| Entity Name |
Service Description |
Headquarter / Processing Location |
| Mixpanel, Inc. |
Product analytics; Service-usage telemetry (de-identified where feasible). |
United States (San Francisco, CA); EU regions for processing. |
| PostHog Inc. |
Product analytics; event capture and user-behaviour telemetry (de-identified where feasible). |
United States (San Francisco, CA); EU regions for processing. |
Get notified of Sub-processor changes
Under the Qevlar DPA, Qevlar will notify customers of any new Sub-processor at least fifteen (15) days before authorising it to process customer personal data. To receive these notifications by email, subscribe at support@qevlar.com with the subject line "Subscribe — Sub-processor updates."
