Table of Contents
Last Updated: March 3, 2025
(Supersedes prior version dated February 7, 2025)
Worksome provides services worldwide, including in the United States and the European Union. We primarily host data in the EU, but may rely on subprocessors in other locations to support our global operations. This document lists the third-party subprocessors that process Customer Personal Data on our behalf. They provide infrastructure, analytics, customer support, and other platform management functions.
Note: Changes to this list will be announced in accordance with our Data Processing Agreement (DPA) (e.g., via customer email or in-app notification, as set forth in our DPA). If you have any questions, please contact Worksome Support.
These subprocessors handle data storage, processing, and system infrastructure. While services may be accessed globally, Worksome primarily stores and processes data within EU-based data centers. If transfers outside the EU occur, they are governed by Standard Contractual Clauses (SCCs) or other valid data transfer mechanisms.
| Subprocessor | Purpose of Processing | Location | Data Transfer Mechanism |
|---|---|---|---|
| AWS | Hosting and storage | EU (Ireland) | Data is primarily hosted in the EU. |
| Postmark | Email sending | United States (US) | SCCs in place. |
| Pusher | Push notification service | EU | EU-based data centers. |
| OneSignal | Browser Notifications | EU | EU-based data centers (no regular transfers outside the EU). |
| Google Cloud | File Storage | EU | Data is hosted in the EU. |
| Twilio | 2FA / SMS sending | EU | EU-based services. |
| Algolia | Search provider | EU & US data centers | SCCs in place for any US-based processing; EU region preferred. |
Note: Where a subprocessor has both EU and US data centers, Worksome ensures data is hosted in the EU whenever possible. If data is transferred to the US or elsewhere, we apply additional safeguards as required by GDPR.
These subprocessors help manage and deliver Worksome’s key platform functionalities.
| Subprocessor | Purpose of Processing | Location | Data Transfer Mechanism |
|---|---|---|---|
| Atrium | Providing Employer of Records Services in the United States. | United States (US) | SCCs in place. |
| Sovren | AI service for CV parsing | United States (US) | SCCs in place. |
| NetSuite | Accounting System | EU (Germany) | EU-based. |
Worksome uses the following subprocessors to analyze user behavior and platform features to improve our services. Where personal data is transferred outside the EU/EEA, we rely on SCCs or other recognized adequacy mechanisms.
| Subprocessor | Purpose of Processing | Location | Data Transfer Mechanism |
|---|---|---|---|
| Google Analytics | Analytics tracking | EU (servers in the EU) | EU-based storage; no routine personal data transfers outside EU. |
| Heap | User analytics | United States (US) | SCCs in place. |
| OpenAI (ChatGPT for Enterprise) - Beta Only | |||
| AI-driven analytics and insights (Opt-in Beta) | |||
| United States (US) | |||
| SCCs in place; data is minimized or anonymized where possible. |
Important Note on OpenAI:
• Only customers who opt in to the beta will have any data processed by OpenAI.
• Worksome provides anonymized or aggregated data to OpenAI wherever possible to uphold GDPR’s data minimization principle.
• Personal data is not used for OpenAI model training or shared beyond the scope of Worksome Intelligence.
These subprocessors provide direct support for our customers, ensuring timely and reliable communication when you use Worksome’s services.
| Subprocessor | Purpose of Processing | Location | Data Transfer Mechanism |
|---|---|---|---|
| Intercom | Customer support communications | United States (US) | SCCs in place. |
| Salesforce | CRM & support services | United States (US) | SCCs in place. |
| AskNicely | Net Promoter Score (NPS) surveys | United States (US) | SCCs in place. |