Last Updated: August 14, 2025
TABLE OF CONTENTS
This page is intended for public disclosure in accordance with Worksome’s Data Processing Agreement (DPA).
(Supersedes prior version dated March 3, 2025)
Worksome provides services worldwide, including in the United States and the European Union. We primarily host data in the EU, but may rely on subprocessors in other locations to support our global operations. This document lists the third-party subprocessors that process Customer Personal Data on our behalf. They provide infrastructure, analytics, customer support, and other platform management functions.
Transfers of UK Personal Data are subject to the UK International Data Transfer Addendum (”IDTA”) or the UK Addendum to the EU Standard Contractual Clauses, as applicable.
Changes to this list will be announced in accordance with our Data Processing Agreement (DPA) (e.g., via customer email or in-app notification, as set forth in our DPA). Changes to this list are tracked with an effective date for each subprocessor addition or removal. Customers may request a historical record of subprocessors at any time. If you have any questions, please contact Worksome Support.
These subprocessors handle data storage, processing, and system infrastructure. While services may be accessed globally, Worksome primarily stores and processes data within EU-based data centers. If transfers outside the EU occur, they rely on the European Commission’s Standard Contractual Clauses (”SCCs”) based on the most recent version adopted by the European Commission (available here), or other valid data transfer mechanisms recognized under GDPR or UK GDPR, as applicable.
| Subprocessor | Purpose of Processing | Location | Data Transfer Mechanism |
|---|---|---|---|
| AWS | Hosting and storage | EU (Ireland) | Data is primarily hosted in the EU. |
| Postmark | Email sending | United States (US) | SCCs executed; Transfers are subject to Worksome’s Transfer Impact Assessments and supplemented with additional safeguards as required. |
| Pusher | Push notification service | EU | EU-based data centers. |
| OneSignal | Browser Notifications | EU | EU-based data centers (no regular transfers outside the EU). |
| Google Cloud | File Storage | EU | Data is hosted in the EU. |
| Twilio | 2FA / SMS sending | EU | EU-based services. |
| Algolia | Search provider | EU & US data centers | SCCs executed; Transfers are subject to Worksome’s Transfer Impact Assessments and supplemented with additional safeguards as required; EU region preferred. |
Note: Where a subprocessor has both EU and US data centers, Worksome ensures data is hosted in the EU whenever possible. If data is transferred outside the EU/EEA, we rely on SCCs supplemented with additional technical and organizational measures (e.g., encryption in transit and at rest, pseudonymization, and access controls) where required following Transfer Impact Assessments.
These subprocessors help manage and deliver Worksome’s key platform functionalities.
| Subprocessor | Purpose of Processing | Location | Data Transfer Mechanism |
|---|---|---|---|
| Atrium | Providing Employer of Records Services in the United States. | United States (US) | SCCs executed; Transfers are subject to Worksome’s Transfer Impact Assessments and supplemented with additional safeguards as required. |
| Sovren | AI service for CV parsing | United States (US) | SCCs executed; Transfers are subject to Worksome’s Transfer Impact Assessments and supplemented with additional safeguards as required. |
| NetSuite | Accounting System | EU (Germany) | EU-based. |