ServiceNow doesn't sit on a third party cloud, we occupy space within premium 3rd party data centres (dedicated suites or cages), from that point upwards our cloud is built and maintained by our own personnel.

This is the case for all customer instances, there is an exception for events like Knowledge where we need to scale out many thousands of extra demo/lab instances for a short period of time, for K15 I believe we used AWS.

From the corporate website -

SERVICENOW DATA CENTERS MAINTAIN

Industry-standard SSAE16/SOC1 Type II attestation or ISO 27001 certifications, which provide third-party verification of the data center controls, security measures, and operational processes that supply physical security protection and facilities support for the ServiceNow environment.

SERVICENOW ACHIEVED

The highest level of certification for a wide range of industry standards and industry-specific compliance including SSAE16/SOC1 Type II and ISO 27001, Pharmaceutical industry IQOQ, and a government-wide FISMA Moderate Authority to Operate (ATO)

hope that helps

Dave