GitHub sub-processors
GitHub publishes the list below on its own site. We check that page daily and record what moves, so this page shows the current list and what changed before it.
Compiled automatically from GitHub's own published page, linked above. This is a convenience copy, not an official statement by GitHub, and automated reading can lag behind or misinterpret a page. Confirm against the source before relying on it.
Current sub-processors
| Sub-processor | Purpose | Location |
|---|---|---|
| Amazon Web Services Inc (AWS) | Cloud Hosted Infrastructure, Data Hosting, AI Inference and AI Services | United States |
| Anthropic PBC | AI Inference and AI Services | United States |
| Cerebras Systems Inc. | AI Inference and AI Services | United States |
| Cloudflare | Content delivery service | United States |
| DataDome Solutions, Inc. | Security management | United States, France |
| Elasticsearch, Inc. | Cloud Hosted Infrastructure | United States |
| Fastly | Content delivery service | United States |
| Fireworks AI | AI Inference and AI Services | United States, Germany, Iceland |
| FullStory, Inc. | Customer support ticketing analysis | United States |
| Google Cloud Platform (GCP) | Cloud Hosted Infrastructure, AI Inference and AI Services | United States, Belgium, Singapore |
| Hewlett-Packard Limited | Cloud Hosted Infrastructure | United States |
| LambdaTest | Cloud Hosted Infrastructure | United States |
| Microsoft (Azure) | Cloud Hosted Infrastructure, Data Hosting, AI Inference and AI Services | United States, Canada, Chile, Mexico |
| Microsoft (Azure) | Cognitive Services and customer support ticketing analysis | United States |
| Microsoft Technical Services | Customer support ticketing analysis | United States, Australia, Brazil, Canada, France, Japan, Norway, Spain, Sweden, Switzerland, United Kingdom |
| Moveworks | Customer support ticketing analysis | United States |
| NexMo Inc (aka Vonage) | SMS notification provider for 2 Factor Authentication | United States |
| Obsidian Security | Security management | United States |
| OpenAI | AI Inference and AI Services | United States |
| Oracle America, Inc. | Cloud Hosted Infrastructure | United States |
| Pusher | Building and managing real-time infrastructure for web and mobile applications | United States |
| Tines Automation Inc. | Security management | United States |
| Twilio (SendGrid) | SMS notification provider for 2 Factor Authentication | United States |
| xAI | AI Inference and AI Services | United States |
| Zendesk | Customer support ticketing system | United States |
| GitHub Australia Pty Ltd | GitHub Subsidiary | Australia |
| GitHub BV | GitHub Subsidiary | Netherlands |
| GitHub Canada ULC | GitHub Subsidiary | Canada |
| GitHub Germany GmbH | GitHub Subsidiary | Germany |
| GitHub India Pty Ltd | GitHub Subsidiary | India |
| npm Inc | GitHub Subsidiary | United States |
| Semmle Inc | GitHub Subsidiary | United States |
Change history
Added: Amazon Web Services Inc (AWS), Anthropic PBC, Cerebras Systems Inc., Cloudflare, DataDome Solutions, Inc., Elasticsearch, Inc., Fastly, Fireworks AI, FullStory, Inc., GitHub Australia Pty Ltd, GitHub BV, GitHub Canada ULC, GitHub Germany GmbH, GitHub India Pty Ltd, Google Cloud Platform (GCP), Hewlett-Packard Limited, LambdaTest, Microsoft (Azure), Microsoft Technical Services, Moveworks, NexMo Inc (aka Vonage), Obsidian Security, OpenAI, Oracle America, Inc., Pusher, Semmle Inc, Tines Automation Inc., Twilio (SendGrid), Zendesk, npm Inc, xAI
Changed navigation link text from "Skip to main content" to "Skip to content".
Why this matters if you use GitHub
Under GDPR Article 28(2), your own customers are usually entitled to notice before you add or replace a sub-processor — and GitHub's sub-processors are part of that chain. The notice period in a typical DPA is 10 to 30 days, and it starts when the vendor updates their page, not when you notice.
Monitor GitHub on your own trust page — free3 vendors free, permanently. No card.