AVEVA Sub-processors for the CONNECT Cloud Platform
Version: April 2026
The following list provides information related to the third-party sub-processors, AVEVA Group Limited’s (AVEVA) and its subsidiaries (or Affiliates) that may have access to the Customer Personal Data (as defined in AVEVA’s Data Processing Addendum available at: https://www.aveva.com/en/legal/) via the CONNECT platform and assist AVEVA with respect to the provision of the Cloud Services, Support Services and Professional Services under the AVEVA General Terms and Conditions published at: https://www.aveva.com/en/legal/ or any other relevant agreement between AVEVA and the Customer.
1. Platform Sub-processors
Core infrastructure and platform service providers that host, enable, and support the CONNECT cloud platform.
Sub-processor Name
Services Performed
Categories of Personal Data Processed
Processing Location (s)
Transfer Mechanism
Sub-processor Name
Microsoft Azure (Microsoft Corporation)
Services Performed
Cloud infrastructure hosting and enablement for CONNECT platform.
Includes the following Azure-native security services:
- Microsoft Defender SmartScreen – Security monitoring, phishing and malware detection
- Azure Defender for Cloud – Cloud security posture management and advanced threat protection
- Azure Front Door – CDN, global load balancing and security (WAF, DDoS protection)
Categories of Personal Data Processed
- User identifiers and login credentials
- IP addresses
- Session and usage telemetry
Processing Location (s)
US, UK, EU (regions as deployed per customer instance)
Transfer Mechanism
EU SCCs
UK IDTA/Addendum
Sub-processor Name
Amazon Web Services
(Amazon Web Services, Inc.)
Services Performed
Cloud infrastructure hosting and enablement for CONNECT platform.
Includes the following AWS-native security services:
- AWS GuardDuty – Threat detection and continuous monitoring
- AWS WAF – Web Application Firewall
Categories of Personal Data Processed
- User identifiers and login credentials
- IP addresses
- Session and usage telemetry
Processing Location (s)
US, UK, EU
(regions as deployed per customer instance)
Transfer Mechanism
EU SCCs
UK IDTA/Addendum
Sub-processor Name
Okta, Inc. (Auth0)
Services Performed
Identity and access management, user authentication, and single sign-on (SSO) services for CONNECT platform users.
Categories of Personal Data Processed
- User identifiers
- Login credentials
- Authentication tokens
- Email addresses
- IP addresses
Processing Location (s)
US, Canada, India, EU, Australia, Japan
Transfer Mechanism
EU SCCs
UK IDTA/Addendum
Sub-processor Name
TwinThread, Inc.
Services Performed
Advanced industrial analytics software powering AVEVA Advanced Analytics. Processes industrial data to deliver AI-powered predictive analytics and digital twin capabilities.
Categories of Personal Data Processed
- User identifiers (to the extent linked to operational data)
- Operator/end user interaction data
- Industrial telemetry data (to the extent it contains personal data)
Processing Location (s)
US
Transfer Mechanism
EU SCCs
UK IDTA/Addendum
Sub-processor Name
Zuora, Inc.
Services Performed
Subscription management, billing, and entitlement services for CONNECT platform subscriptions (including AVEVA Flex).
Categories of Personal Data Processed
- User identifiers
- Subscription and billing data relating to end-users
- Usage entitlement data
Processing Location (s)
US, EU
Transfer Mechanism
EU SCCs
UK IDTA/Addendum
2. Independent Security Sub-processors
Third-party security vendors independent from the primary cloud infrastructure providers.
Sub-processor Name (Legal Entity)
Services Performed
Categories of Personal Data Processed
Processing Location (s)
Transfer Mechanism
Sub-processor Name (Legal Entity)
Trend Micro, Inc.
Services Performed
Antivirus, endpoint security scanning, and threat protection for CONNECT platform infrastructure.
Categories of Personal Data Processed
- IP addresses
- File metadata
- Network traffic data
- Endpoint identifiers
Processing Location (s)
US, Japan
Transfer Mechanism
EU SCCs
UK IDTA/Addendum
Sub-processor Name (Legal Entity)
Check Point Software Technologies Ltd (Check Point Infinity)
Services Performed
Malware and ransomware protection; real-time threat intelligence and network security for CONNECT infrastructure.
Categories of Personal Data Processed
- IP addresses
- Network traffic data
- Threat intelligence data
- Endpoint identifiers
Processing Location (s)
US, Israel
Transfer Mechanism
EU SCCs
UK IDTA/Addendum
3. Sub-processors Used for Providing Support Services
Third-party service providers used to deliver customer support, success, and product experience services in connection with the CONNECT platform.
Sub-processor Name (Legal Entity)
Services Performed
Categories of Personal Data Processed
Processing Location (s)
Transfer Mechanism
Sub-processor Name (Legal Entity)
Gainsight, Inc.
Services Performed
Customer success and product experience software. Used to manage customer health, engagement, and adoption insights for CONNECT.
Categories of Personal Data Processed
- Usernames and email addresses
- Job titles
- Product usage and adoption data
Processing Location (s)
US
Transfer Mechanism
EU SCCs
UK IDTA/Addendum
Sub-processor Name (Legal Entity)
Pendo.io, Inc.
Services Performed
Product experience and digital adoption solutions. Provides in-app guidance, user analytics, and product usage insights for CONNECT.
Categories of Personal Data Processed
- User identifiers
- Email addresses
- Product interaction and usage data
- Feature adoption data
- IP addresses
Processing Location (s)
US
Transfer Mechanism
EU SCCs
UK IDTA/Addendum
Sub-processor Name (Legal Entity)
Twilio Inc.
(Twilio SendGrid)
Services Performed
Email delivery service for CONNECT platform communications including product notifications, alerts, and system communications.
Categories of Personal Data Processed
- Email addresses
- Email content (notifications/alerts)
- Delivery metadata
Processing Location (s)
US
Transfer Mechanism
EU SCCs
UK IDTA/Addendum
Sub-processor Name (Legal Entity)
Salesforce, Inc.
Services Performed
Customer relationship management (CRM) and customer service case management for CONNECT support operations.
Categories of Personal Data Processed
- Customer contact names
- Email addresses and phone numbers
- Job titles
Processing Location (s)
US
Transfer Mechanism
EU SCCs
UK IDTA/Addendum
Sub-processor Name (Legal Entity)
ServiceNow, Inc.
Services Performed
IT service management and ticketing system for CONNECT customer service support requests.
Categories of Personal Data Processed
- Customer contact names
- Email addresses
- Support ticket details
- Issue descriptions
Processing Location (s)
US
Transfer Mechanism
EU SCCs
UK IDTA/Addendum
4. Connected Worker Sub-processor
Service partner providing connected worker capabilities as part of the CONNECT platform offering.
Sub-processor Name (Legal Entity)
Services Performed
Categories of Personal Data Processed
Processing Location (s)
Transfer Mechanism
Sub-processor Name (Legal Entity)
Poka Inc.
Services Performed
Service partner providing AVEVA Teamwork – connected worker platform for industrial workforce digital transformation, knowledge sharing, and operational procedures.
Categories of Personal Data Processed
- Worker/user names and identifiers
- Email addresses
- Job roles and skills data
- Training and certification records
- Content contributions and interactions
Processing Location (s)
Canada
Transfer Mechanism
EU SCCs
UK IDTA/Addendum
5. AVEVA Affiliates by Country
Depending on the geographic location of the Customer or its Users, and the nature of the Services provided, AVEVA may also engage one or more of its Affiliates as sub-processors to deliver specific and limited services to the Customer. An up-to-date list of AVEVA Affiliates can be found at: https://www.aveva.com/en/about/about-aveva/locations/