Vendor record · nebius.com
What Nebius promises about your data.
Where Nebius publishes its promises, how long it gives you when it adds a sub-processor, and what has changed.
- Where it publishes
Nebius lists its sub-processors at docs.nebius.com/legal/sub-processors. We last read it on October 15, 2026.
- What has changed
We've recorded no change to its sub-processor list or data processing agreement between September 11, 2026 and September 15, 2026. Subscribers hear about a change the morning we read it; the public record shows it 30 days later.
- Its window
When it adds a sub-processor, its clause at docs.nebius.com/legal/dpa (read October 1, 2026) gives you 15 days' notice.
- Window
- 15
- Sub-processors
- 18
- Pages
- 5
- Copies
- 18
days' notice when it adds a sub-processor
sub-processors named
pages we watch
dated copies of all its pages, since August 31, 2026
Nebius DPA
Nebius's data processing agreement gives 15 days' notice before a new sub-processor is engaged. Here is the clause, from our October 1, 2026 copy:
15
days' notice
“For the purposes of Clause 9 of the SCC (concerning Module Three transfers), the Parties choose the option 2 “General Written Authorisation” in Clause 9 of the SCC shall apply, and specify that the processor shall inform in writing the controller of any intended changes of that list through the addition or replacement of Sub-processors at least fifteen (15) days in advance, thereby giving the controller sufficient time to be able to object to such changes prior to the engagement of the concerned Sub-processor(s).”
Found automatically and not yet checked by a person. The quote is exact, and the link goes to the source. Nothing here says whether the term is good or bad, only that Nebius published it.
docs.nebius.com/legal/dpa · read 2026-10-01 · fingerprint 47a1a00485f4d4f6…
How it says it sends notice
“Customer support | EU | When Slack is used for communications with a Customer and Customer Personal Data is shared or otherwise processed in connection with that interaction | SCC | ### Subscribe to sub-processor updates Sign up using this form to receive notifications about new third-party sub-processo…”
docs.nebius.com/legal/sub-processors · read 2026-09-25
How it says it sends notice
“Customer may also subscribe to receive notifications about Sub-processor updates at: https://docs.nebius.com/legal/sub-processors#summary-of-changes (currently available for Nebius AI Cloud only).”
docs.nebius.com/legal/dpa · read 2026-10-01
Nebius sub-processors
Nebius publishes a sub-processor list at docs.nebius.com/legal/sub-processors; we last read it on October 15, 2026. It names 18 entries. The first 15, as the list prints them: Atlassian Pty Ltd. (Jira); EdTech Plus Tech d.o.o. Beograd Nebius Group; Factiva Limited (Dow Jones); Functional Software, Inc. (Sentry); Hubspot, Inc.; Microsoft Corporation (Sentinel); Nebius AI Spain S.L.U. Nebius Group; Nebius CZ s.r.o. Nebius Group; Nebius DC Oy Nebius Group; Nebius France SAS Nebius Group; Nebius Israel Ltd.; Nebius Israel Ltd. Nebius Group; Nebius Inc. Nebius Group; Nebius UK Ltd.; Nebius UK Ltd. Nebius Group; and 3 more in the full table below. The public record holds no change to the list read before September 15, 2026. A change we read after September 15, 2026 is published 30 days after we read it.
18 named · full table
Every public change we have recorded · Where vendors publish their lists
How long Nebius keeps your data
Nebius's privacy policy (nebius.com/privacy-policy, in the copy read September 28, 2026) says: “When we process partially obscured copies of your ID for KYC purposes, we retain them for a maximum of 18 months in order to maintain the necessary records for our yearly audits.”
Training on customer data
“Nebius Token Factory does not use Customer Content to train, fine-tune or improve models for Nebius or any third party, except as directed by the Customer to perform a Customer-requested fine-tuning or post-training operation.”
docs.nebius.com/legal/dpa · read 2026-10-01
Training on customer data
“Personal Data We Collect Automatically: Service Use and Technical Data. When you use our Services, we automatically collect and generate metadata and technical data needed to provide, secure, administer, troubleshoot, bill for, and improve those Services.”
nebius.com/privacy-policy · read 2026-09-28
Training on customer data
“User is hereby notified and agrees that Nebius may collect and process Service Data on a statistical, aggregated and non-identifiable form, for the purposes of Platform’s testing, development and improvement, controls, and operations.”
docs.nebius.com/legal/terms-of-use/ · read 2026-10-01
Training on customer data
“Customers remain responsible for backing up Customer Content, including uploaded files, model weights and fine-tuning artifacts. ### Testing and evaluation Nebius regularly monitors, tests, assesses and evaluates the effectiveness of the technical and organizational measures implemented to ensure the security of the Processing.”
docs.nebius.com/legal/dpa · read 2026-10-01
Retention windows vendors publish · What vendors say about training
What the pages say
Read automatically from the pages below and shown as printed. A missing row is a gap in our reading, not proof it isn’t there.
Sub-processors named · 18
Atlassian Pty Ltd. (Jira)
Customer support and ticket handling
Australia
EdTech Plus Tech d.o.o. Beograd Nebius Group
Serbia
Factiva Limited (Dow Jones)
external sub-processor.
Functional Software, Inc. (Sentry)
Application Performance; Monitoring & Error / Bug Tracking
United States
Hubspot, Inc.
Delivery of customer communications, such as in-product messages and emails
United States
Microsoft Corporation (Sentinel)
Customer communications; Security Information and Event Management
United States
Nebius AI Spain S.L.U. Nebius Group
Service engineering, operations, maintenance and technical support
Spain
Nebius CZ s.r.o. Nebius Group
Service engineering, operations, maintenance and technical support
Czech Republic
Nebius DC Oy Nebius Group
Finalnd
Finland
Nebius France SAS Nebius Group
Service engineering, operations, maintenance and technical support
France
Nebius Israel Ltd.
internal sub-processor.
Nebius Israel Ltd. Nebius Group
Provision of cloud infrastructure for processing Customer Content in the Customer-selected region
Israel
Nebius Inc. Nebius Group
Provision of cloud infrastructure for processing Customer Content in the Customer-selected region
United States
Nebius UK Ltd.
internal sub-processor.
Nebius UK Ltd. Nebius Group
Service engineering, operations, maintenance and technical support
United Kingdom
Slack Technologies, LLC
Customer communications; Customer support
United States
Tech Hub IL Ltd. Nebius Group
Service engineering, operations, maintenance and technical support
Israel
Updated: Nebius Inc.
description.
Certifications the trust page names · CSA STAR · ISO 27001 · ISO 27018 · ISO 27701 · ISO 42001 · SOC 2 Type II · SOC 3
Laws the trust page names · GDPR · HIPAA
Data location · European Union
“Overseas Personal Data Transfers We store your personal data in our data centres in the European Union and Israel.”
nebius.com/privacy-policy · read 2026-09-28
International transfer notice · European Union
“Module Four (processor to controller) of the SCC shall apply where Nebius, acting as a Processor established in the EEA, transfers Personal Data to the Customer acting as a Controller located outside the EEA.”
docs.nebius.com/legal/dpa · read 2026-10-01
The pages' own stamps: Effective date 2026-09-23 · Effective date 2026-09-15 · Effective date 2026-09-15
The pages we watch
Every page we read, so you can check it. Each is re-read on a schedule, and we keep a dated copy when it changes.
What this page doesn’t tell you
No score.
Nothing here rates Nebius. A short notice window is a contract term, not a criticism.
Public pages only.
Private notices and negotiated terms are invisible to us. Your agreement may say something different.
Wrong? Tell us.
Corrections are free, always. We reply within 2–3 business days.
How we read a page · The change log
Work at Nebius? With an email at nebius.com you can claim this record, suggest pages we should watch, and take a free copy of it. Claiming changes nothing we publish.
Is Nebius in your product? Hear the morning we read a change.
You get the lines that moved, in Nebius’s own words, and the date any window closes. No card. Nothing to cancel.