Sub-Processors

Picus engages certain sub-processors to deliver its products and services. Sub-processors are third parties authorized by Picus to process personal data on behalf of Picus’s customers, in accordance with the data processing terms agreed between Picus and its customers. Picus imposes data protection obligations on each sub-processor through written agreements that provide at least the same level of protection. Picus conducts an annual compliance review of its sub-processors as part of its Third Party Risk Management program.

The current list of Sub-Processors authorized to process personal data in connection with the provision of our products and services is provided below. Please note that not all sub-processors are used in the provision of every service, and some may only be involved in assisting with the provision of specific services or features.

Last Updated: October 2026

Sub-processor	Purpose of processing	Location(s)	More information
Amazon Web Services	Cloud hosting and infrastructure (IaaS) & AI model inference for AI-powered product features, where enabled	USA, EU, India, Singapore	AWS Privacy Notice & Amazon Bedrock Data Protection
Google, Inc.	Email, document storage, calendar, communication	USA	Google Cloud Trust Center
Salesforce (including Slack, a Salesforce company)	CRM and customer management and internal communication	USA	Salesforce Trust
Zendesk	Customer support and ticketing services	USA	Zendesk Trust Center
Zoom	Video conferencing and communication	USA	Zoom Trust Center
Hubspot	Customer relationship management, marketing, Webpages	USA	Hubspot Trust Center
Adobe Acrobat Sign	Contract administration and e-signature tool	USA	Adobe Privacy Policy
Splunk	Log management and security monitoring	USA	Splunk Data Security and Privacy
Outreach	Sales engagement and communication tracking	USA	Outreach Trust
Atlassian	Project management and collaboration tools	USA, Australia	Atlassian Trust Center
Zapier	Workflow automation and system integrations	USA	Zapier Security and Compliance
LearnWorlds	Training platform for both internal and external users (Picus Purple Academy)	USA	LearnWorlds Privacy Policy
Hotjar	Website and application analytics	EU (Ireland)	Hotjar Privacy Link
New Relic	Performance monitoring and analytics	USA	New Relic Security and Privacy
Heap	Product usage and user behavior analytics	USA	Heap Trust Portal
Avoma	Communication analytics	USA	Avoma Trust Center
Allbound	Partner relationship and communication platform	USA	Allbound Privacy Policy

Sub-processors are engaged based on business need and may process limited subsets of data depending on the specific service configuration and use case. Picus ensures that all sub-processors are subject to appropriate contractual, security, and data protection obligations in line with applicable regulations.

Updates to this Sub-Processor list

We will update our sub-processor list on this website to reflect any changes to our sub-processors, so we recommend you periodically check this page for updates.

More information about a Sub-Processor

For any additional information concerning our data processing practices or any specific sub-processors, please send an email to security@picussecurity.com.