Contentsquare
Analytics · contentsquare.com · last read 2026-10-12
Identity
| Legal entity | Content Square SAS |
|---|---|
| HQ | FR |
| Parent company | — |
| Ultimate ownership | — |
| EU contracting entity | Content Square Ltd. (and 3 other EU entities by country) |
| LEI | — |
| US CLOUD Act reach | Not determined from the sources read |
| Source | contentsquare.com · 2026-10-08 |
Data location
| Region | EU data location | Minimum plan | Source | Observed |
|---|---|---|---|---|
| EU | Terms not stated | — | contentsquare.com | 2026-10-08 |
Subprocessor chain
34 third parties · 18 of the vendor's own group companies · 35 with a country outside the EEA · all read 2026-10-08
| Subprocessor | Country | If hosted in the EU | Purpose |
|---|---|---|---|
| Ada Support, Inc. | CA | — | Customer support and ticketing services |
| Amazon Web Services (AWS) | IE, US | IE | Hosting of Sense Chat and Customer Data and backups |
| Amazon Web Services Bedrock | IE, GB, FR, DE, SE, IT, ES, US | IE, GB, FR, DE, SE, IT, ES | Provides Large Language Model (LLM) for Sense AI features (Growth, Pro, and Enterprise plans) |
| Amazon Web Services, Inc. | IE, US | IE | Data hosting (User Lifecycle Extension) |
| Amazon Web Services, Inc. | DE, US | DE | Data hosting for Data Connect (Experience Analytics) |
| Amazon Web Services, Inc. | IE, DE, US | IE, DE | Data hosting for Data Connect (Product Analytics Connect) |
| Amazon Web Services, Inc. | IE | — | Experience Analytics data hosting for Free & Growth plans |
| Amazon Web Services, Inc. | IE, US | IE | Experience Analytics data hosting for Pro & Enterprise plans and DXA Extension |
| Amazon Web Services, Inc. | IE, DE, US | IE, DE | Product Analytics data hosting |
| Atlassian Pty Ltd (Jira) | AU | — | Customer support and ticketing services |
| Atoms - Retex | IT | — | Support, Maintenance, and Professional Services (opt-in only) |
| Cardinal Path LLC | US | — | Support, Maintenance, and Professional Services (opt-in only) |
| Converteo SAS | FR | — | Support, Maintenance, and Professional Services (opt-in only) |
| Daily.co | IE, US | — | User Tests feature: hosting of recordings; hosting of name and duration of test |
| Deepgram, Inc. | US | — | Speech-to-text services |
| Dentsu Manchester Limited | GB | — | Support, Maintenance, and Professional Services (opt-in only) |
| Group Onepoint SAS | FR | — | Support, Maintenance, and Professional Services (opt-in only) |
| Level Access, Inc. | US | — | Support, Maintenance, and Professional Services (opt-in only) |
| Microsoft Azure | IE | — | Experience Analytics data hosting for Free & Growth plans |
| Microsoft Azure | IE, US | IE | Experience Analytics data hosting for Pro & Enterprise plans and DXA Extension |
| Microsoft Corporation (Azure) | EU, US | EU | Provides Large Language Model (LLM) for Sense AI features (Growth, Pro, and Enterprise plans) |
| Microsoft Corporation, (Azure OpenAI Service) | FR | — | Provides Large Language Model (LLM) for Hotjar AI for Surveys |
| OpenAI OpCo, LLC | EU, US | EU | Provides Large Language Model (LLM) |
| Postmark | US | — | Email delivery service |
| Salesforce, Inc. | US | — | Tableau Dashboard reporting feature |
| Scaletrix.AI (Alabs AI Privacy Limited) | IN | — | Support, Maintenance, and Professional Services (opt-in only) |
| Snowflake Inc. | US | — | Data warehouse |
| Temesis SAS | FR | — | Support, Maintenance, and Professional Services (opt-in only) |
| Tremendous, LLC | US | — | Participant rewards provider |
| Turbopuffer Inc. | US | — | Vector database search and index service |
| Twilio Inc. | IE | — | User Interviews feature data hosting |
| Up Reply GmbH | DE | — | Support, Maintenance, and Professional Services (opt-in only) |
| Zendesk, Inc. | US | — | Customer support and ticketing services |
| Zilker Trail Consulting | US | — | Support, Maintenance, and Professional Services (opt-in only) |
Contentsquare's own group companies listed as subprocessors (18)
| Company | Country | Purpose |
|---|---|---|
| Content Square Canada | CA | Professional Services |
| Content Square GmbH | DE | Professional Services |
| Content Square Israel Ltd. | IL | Support, Maintenance, Professional Services |
| Content Square Ltd. | GB | Support, Maintenance, Professional Services |
| Content Square SAS | FR | Support, Maintenance, Professional Services |
| Content Square Singapore PTE | SG | Support, Professional Services |
| Content Square Spain, S.L. | ES | Professional Services |
| Content Square, Inc. | US | Support, Maintenance, Professional Services |
| ContentSquare DXA SAAS Solutions LLC | AE | Professional Services |
| ContentSquare Egypt | EG | Support, Professional Services |
| ContentSquare Italy S.r.l. | IT | Support, Professional Services |
| Contentsquare Japan G.K. | JP | Professional Services |
| Hotjar Germany GmbH | DE | Support, Maintenance, Professional Services |
| Hotjar Netherlands BV | NL | Support, Maintenance, Professional Services |
| Hotjar UK Limited | GB | Support, Maintenance, Professional Services |
| Hotjar Web Portugal, Unipessoal LDA | PT | Support, Maintenance, Professional Services |
| Hotjar Web Services Spain S.L. | ES | Support, Maintenance, Professional Services |
| Loris Technologies, Ltd. | IL | Support, Maintenance, Professional Services and conversational intelligence services |
The count outside the EEA is arithmetic over the country column, not a judgement about lawfulness. A transfer outside the EEA can be perfectly lawful; whether this one is depends on your use, not on the vendor.
Processing terms
From the vendor's data processing agreement · read 2026-10-09 · contentsquare.com
| Term | What the agreement says |
|---|---|
| Transfer mechanism | EU-U.S. DPF |
| Transfer mechanism | SCC module 2 |
| Transfer mechanism | SCC module 3 |
| Transfer mechanism | UK Addendum |
| Transfer mechanism | other |
| Notice of new subprocessors | Advance notice before new sub-processor accesses Visitor Data, for customers who subscribe via the form at the Sub-Processor List link in Schedule 1; period not stated |
| If you object to one | If not remediated within 30 calendar days, customer's sole remedy is to terminate the affected services, with a pro rata refund of prepaid fees |
| If you object to one | Object on reasonable privacy or security grounds by email to [email protected] within 30 calendar days of notice; silence is deemed acceptance; Contentsquare may cure by ceasing use or by corrective steps |
| Breach notification | without undue delay |
| Audit | Customer may conduct a Data Protection Control Audit in accordance with the applicable Section of the Agreement |
Terms as the agreement states them. Where it is silent on a term, there is no row; that is not a statement that the vendor does not offer it.
Assurance
| Scheme | Status | Scope | Source | Observed |
|---|---|---|---|---|
| HIPAA | Claimed | — | contentsquare.com | 2026-10-08 |
| ISO 27001 · ISO27001 | Claimed | Contentsquare security governance and ISMS closely follows ISO 27001 standard | contentsquare.com | 2026-10-08 |
| ISO 27001 · ISO27001 | Claimed | SDLC process with peer-review, static code analysis and dynamic analysis of every change ... is in the scope of our ISO 27001 certification | contentsquare.com | 2026-10-08 |
| ISO 27017 · ISO27017 | Claimed | — | contentsquare.com | 2026-10-08 |
| ISO 27018 · ISO27018 | Claimed | — | contentsquare.com | 2026-10-08 |
| ISO 27701 · ISO27701 | Claimed | — | contentsquare.com | 2026-10-08 |
| STAR | Claimed | — | contentsquare.com | 2026-10-08 |
| AICPA SOC 2 · SOC2 | Claimed | — | contentsquare.com | 2026-10-08 |
| SOC 2 Type 2 · SOC2T2 | Claimed | — | contentsquare.com | 2026-10-08 |
Claimed means the vendor asserts the scheme on its own page and offers nothing further. Available on request means the report or certificate exists but sits behind a request, a login or an NDA. Neither is a certificate we have seen. That is a distinction an auditor makes, so we make it too.
Official registers
| Register | Offering, as the register names it | Status | Level | Valid until | Observed |
|---|---|---|---|---|---|
| ACN qualified cloud (Italy) | Contentsquare Experience Analytics and Experience Monitoring · Contentsquare Italy Srl | qualified | QC1 (SaaS) | 2028-04-09 | 2026-10-09 |
| Data Privacy Framework List (US) | EU-U.S. Data Privacy Framework · Contentsquare | Active | non-HR data | 2027-09-15 | 2026-10-09 |
| Data Privacy Framework List (US) | Swiss-U.S. Data Privacy Framework · Contentsquare | Active | non-HR data | 2027-09-15 | 2026-10-09 |
| Data Privacy Framework List (US) | UK Extension to the EU-U.S. DPF · Contentsquare | Active | non-HR data | 2027-09-15 | 2026-10-09 |
| Global LEI Index (GLEIF) | CONTENT SQUARE LTD · CONTENT SQUARE LTD | ISSUED | GB | 2027-03-12 | 2026-10-09 |
- ACN qualified cloud (Italy): checked 2026-10-12, 1 entry under Content Square Ltd.; Content Square SAS; Contentsquare
- DORA critical ICT third-party providers (ESAs): checked 2026-10-12, no entry under Content Square Ltd.; Content Square SAS; Contentsquare
- Data Privacy Framework List (US): checked 2026-10-12, 3 entries under Content Square Ltd.; Content Square SAS; Contentsquare
- EU Cloud Code of Conduct (GDPR Art. 40): checked 2026-10-12, no entry under Content Square Ltd.; Content Square SAS; Contentsquare
- FedRAMP Marketplace (US): checked 2026-10-12, no entry under Content Square Ltd.; Content Square SAS; Contentsquare
- SecNumCloud qualified services (ANSSI, France): checked 2026-10-12, no entry under Content Square Ltd.; Content Square SAS; Contentsquare
What the authority publishes, not what the vendor claims. An entry covers the offering it names and nothing else: a FedRAMP authorisation for a government edition says nothing about the commercial service. No entry is not a finding about security - most vendors never apply - and an entry filed under a name not listed above would not have been found.
Support window
| Product | Support period | State | SBOM | Source | Observed |
|---|---|---|---|---|---|
| Contentsquare (service) | — | Service only | unknown | contentsquare.com | 2026-10-11 |
Vulnerability reporting: [email protected] (security.txt, expires 2028-01-31; read 2026-10-11)
Documents
| Document | Disclosure | Transcription | HTTP | Observed |
|---|---|---|---|---|
| certifications | Public | full | 200 | 2026-10-08 |
| dpa | Public | full | 200 | 2026-10-09 |
| residency | Public | full | 200 | 2026-10-08 |
| subprocessors | Public | full | 200 | 2026-10-08 |
History
Nothing has moved since we started watching this vendor on 2026-10-08. Changes appear here only after a human has reviewed them.