Vendor record · abnormalsecurity.com
What Abnormal Security promises about your data.
Where Abnormal Security publishes its promises, how long it gives you when it adds a sub-processor, and what has changed.
- Where it publishes
Abnormal Security lists its sub-processors at abnormalsecurity.com/legal/subprocessors. We last read it on October 15, 2026.
- What has changed
We've recorded no change to its sub-processor list or data processing agreement between August 31, 2026 and September 16, 2026. Subscribers hear about a change the morning we read it; the public record shows it 30 days later.
- Its window
We couldn't quote a notice window: we haven't found a data processing agreement from Abnormal Security anywhere we've looked.
- Window
- —
- Sub-processors
- 14
- Pages
- 5
- Copies
- 48
no window we can quote yet
sub-processors named
pages we watch
dated copies of all its pages, since August 31, 2026
Abnormal Security DPA
We have not found a data processing agreement published by Abnormal Security anywhere we looked. There is no sub-processor notice window we can quote.
How it says it sends notice
“LTD | Singapore | Abnormal AI Netherlands B.V. | Netherlands | Abnormal AI UK Ltd | United Kingdom | Abnormal Security India Private Limited | India | Please reach out to [email address on the vendor's page] for more information on subprocessors applicable to you. ## Enter Your Email to Subscribe Abnormal AI may change Subprocessors at any time.”
abnormalsecurity.com/legal/subprocessors · read 2026-10-03
Abnormal Security sub-processors
Abnormal Security publishes a sub-processor list at abnormalsecurity.com/legal/subprocessors; we last read it on October 15, 2026. It names 14 entries. The entries, as the list prints them: Abnormal AI Australia Pty Ltd; Abnormal AI Canada LTD.; Abnormal AI Netherlands B.V.; Abnormal AI PTE. LTD; Abnormal AI UK Ltd; Abnormal Security India Private Limited; Amazon Web Services, Inc.; Atlassian Corporation; Databricks, Inc.; Gainsight, Inc.; IPQualityScore, Inc.; Microsoft Corporation (Azure OpenAI Service); Salesforce, Inc.; Twilio Inc. (SendGrid). The same list is in the full table below. The public record holds no change to the list read before September 16, 2026. A change we read after September 16, 2026 is published 30 days after we read it.
14 named · full table
Every public change we have recorded · Where vendors publish their lists
How long Abnormal Security keeps your data
We hold no statement about data retention from Abnormal Security's watched pages. The pages we watch: changelog abnormalsecurity.com/whats-new; privacy policy abnormalsecurity.com/privacy; sub-processor list abnormalsecurity.com/legal/subprocessors; terms of service abnormal.ai/legal/terms-of-use; trust and security page abnormalsecurity.com/trust. On training with customer data, Abnormal Security's privacy policy (abnormalsecurity.com/privacy, in the copy read October 4, 2026) says: “Examples of information that we receive from third parties include marketing and sales information (such as name, email address, phone number, postal address, job title, company name, and similar contact information), training information (such as courses taken, certificates, etc.), and purchase, support, and other information about your interactions with our Sites, Corporate Operations, and Serv…”
Retention windows vendors publish · What vendors say about training
What the pages say
Read automatically from the pages below and shown as printed. A missing row is a gap in our reading, not proof it isn’t there.
Sub-processors named · 14 · 1 name an AI provider we list
Abnormal AI Australia Pty Ltd
To provide customer support to deliver the Service to Customers.
Australia
Abnormal AI Canada LTD.
Canada
Abnormal AI Netherlands B.V.
Netherlands
Abnormal AI PTE. LTD
Singapore
Abnormal AI UK Ltd
United Kingdom
Abnormal Security India Private Limited
India
Amazon Web Services, Inc.
Hosting and provision of the Abnormal Service
United States E.U. (Ireland)
Atlassian Corporation
Troubleshoot Ticketing System and Bug Fixes
United States
Databricks, Inc.
Analytics Infrastructure Provider
United States E.U. (Ireland)
Gainsight, Inc.
Customer Success and Product Experience
United States
IPQualityScore, Inc.
Network threat indicators supporting account and platform protection for Infiltration Prevention
United States E.U. (Germany)
Microsoft Corporation (Azure OpenAI Service)AI · OpenAI
Artificial intelligence-enabled functionality
United States E.U. (France, Sweden)
Salesforce, Inc.
Customer Relationship Management Tool and Customer Support
United States
Twilio Inc. (SendGrid)
Transactional communication delivery services
United States
Certifications the trust page names · ISO 27001 · ISO 27701 · ISO 42001 · SOC 2
Laws the trust page names · GDPR
International transfer notice · United States
“In particular, we may transfer your personal information to the United States and other countries where our affiliates, business partners, and service providers are located.”
abnormalsecurity.com/privacy · read 2026-10-04
Retirements announced · every vendor's retirements
2026-10-12
14 checks that CIS withdrew are marked DEPRECATED and will be removed in 30 days
2026-10-12
As Microsoft 365 changes, CIS revises its benchmark: it adds controls, rewrites others and retires ones that no longer apply.
The pages' own stamps: Last Updated 2026-07-31 · Last Updated 2025-07-03 · Last Updated 2025-04-15
The pages we watch
Every page we read, so you can check it. Each is re-read on a schedule, and we keep a dated copy when it changes.
Where we get nothing
What Abnormal Security does not publish where we can read it
Of the 5 public pages we watch for Abnormal Security, these give us nothing right now.
Data processing agreement
we have not found one published anywhere we looked
Before you conclude anything
This only means we couldn’t read it on a public page. Abnormal Security may share it in its agreement, a trust portal, or with any customer who asks.
So treat it as a question to ask them: “Can you send your sub-processor list, and tell us when it changes?”
What this page doesn’t tell you
No score.
Nothing here rates Abnormal Security. A short notice window is a contract term, not a criticism.
Public pages only.
Private notices and negotiated terms are invisible to us. Your agreement may say something different.
Wrong? Tell us.
Corrections are free, always. We reply within 2–3 business days.
How we read a page · The change log
Work at Abnormal Security? With an email at abnormalsecurity.com you can claim this record, suggest pages we should watch, and take a free copy of it. Claiming changes nothing we publish.
Is Abnormal Security in your product? Hear the morning we read a change.
You get the lines that moved, in Abnormal Security’s own words, and the date any window closes. No card. Nothing to cancel.