Method v1.6As At 2026-08-1428 Surfaces Read1 Offering Assessed
Your own published record, as at 2026-08-14.
Your Details
The Macro Picture17
▲Red · Adverse
5
of 17 banded observations across 1 offering band Adverse. 1 was never measured.
1 conditional row (Hosting Locality = Australia — protected platform offering) sit outside these counts. A Variant is a stated deployment mode, not a published offering, and the Grid Standard holds it to its own band.
What Is Published8
Your Own Words3
ServiceNow stores and processes any personal data collected in connection with Data Subjects in: (i) any country where we have facilities; (ii) any country in which we engage service providers; or (iii) any country where Events are held. A list of ServiceNow's global offices is available here. For international transfers of personal data from the European Economic Area ("EEA"), the UK or Switzerland, we implement such measures as are necessary to ensure we provide appropriate safeguards for the transferred data, including through the use of Standard Contractual Clauses or another lawful transfer data transfer mechanism.
Privacy Statement, section headed International Transfer of Data. This is the complete international-transfer disclosure; nothing else in the document names a country or an instrument. The typographical error 'transfer data transfer mechanism' is in the published text. Read through a rendering browser because static fetch returns HTTP 403. · Source
India: Logik.io India Private Limited; Moveworks Private Limited; ServiceNow Data Services Private Limited; ServiceNow Software Development India Private Limited. ... Egypt: ServiceNow EGY for Software and Platform Development LLC. ... Hong Kong: ServiceNow Hong Kong Limited. ... Saudi Arabia: ServiceNow Arabia Limited; ServiceNow Regional Headquarter Company. ... Singapore: ServiceNow Pte. Ltd. ... South Africa: ServiceNow South Africa Pty Ltd. ... Thailand: ServiceNow (Thailand) Limited. ... UAE: ServiceNow Middle East FZ-LLC.
Form 10-K for the year ended 31 December 2025, accession 0001373715-26-000007, filed 29 January 2026, Exhibit 21.1 Subsidiaries of the Registrant. The Privacy Statement puts data in 'any country where we have facilities'; this filing names facilities-holding subsidiaries in Egypt, Saudi Arabia, the United Arab Emirates, Hong Kong, Singapore, South Africa, Thailand, Costa Rica, Mexico and Brazil, plus a second Indian entity, none of which appears in any ServiceNow transfer disclosure. Read through a rendering browser after static fetch returned HTTP 403. · Source
Section 3, infrastructure rows. Singapore, the United Arab Emirates, India, Indonesia, Saudi Arabia and Qatar are named as service regions, each without any statement that they are or are not a processing location, and each without a country attached to the sub-processor that operates them. · Source
Produced under Method v1.6 from the entity's fact record. 8 of 8 observations were measured under that generation; the rest read Not Measured, which is a fact about this register's coverage and not a finding about the entity.
Read from 28 first-party surface(s) across 1 assessed offering(s), found by the entity's own link graph and sitemap rather than by guessed paths.
Fact Record
Version 1.0, dated 2026-08-14
Standards Commit
3487bce7d591
Register Control Quality
Both Views
Verification And Challenge
Every finding on this record is a statement about what could be read on your own published surfaces as at 2026-08-14. Correspondence route as recorded on this card input: ror@blacksnowintel.com.
What A Machine Could Not Establish5
5 questions are open and 3 are established, read as at 2026-08-14 under method v1.6.
The One Thing To Publish First
Publish it: say whether decisions about people are made automatically.
▲Red · AdverseAutomated Decision-Making
A finding on the public record.
Where To Put It
This was read on your own page at https://www.servicenow.com/service-privacy.html. That is the page a reader already reaches for and does not find it on, so it is the page to correct first.
Where Others Stand
4 organisations in the register say whether decisions about people are made automatically. You do not.
What A Published Answer Looks Like
Under certain laws, residents may also be permitted to opt out of certain profiling relating to automated processing analyzing certain categories of an individual's information that would produce a legal or similarly significant effect. [the vendor] does not engage in this type of profiling of individuals.
A question answered plainly in public, by an organisation read as Strong on it. It is not an endorsement of the position the sentence states — Black Snow reads what is published and never recommends what to practise. Read on a published trust or security page. Claim tier Quoted. The organisation that published it is not named. A name in the original is replaced; nothing else in the sentence is changed.
One is named here, and one is deliberate. The rest of the open questions are listed below without a prescription; what to publish for each, in what order, and drafted machine-readable evidence for all of them, is the Deep Dive.
Still Open
Deep Dive
The full assessment, plus consulting on what to fix.
