Sub-processors
Version draft · Effective 2026-11-04
The companies that process personal information for Workstamp. This list is Annex 3 of our Data Processing Addendum. Each company’s records are stored in the region it chose when it was created; the last column shows where each sub-processor handles them.
Who processes it for us
| Sub-processor | What it does | Where |
|---|---|---|
| MongoDB Atlas | Database and its backups | Your company's region: Sydney, Auckland or London. Sign-in directory: Sydney |
| Fly.io | Servers (Australia, United Kingdom, sign-in directory) | Sydney or London |
| Amazon Web Services | Servers (New Zealand) | Auckland |
| Cloudflare | File storage, delivery of files and this website | Files: we ask for Oceania (Australia, New Zealand) or western Europe (United Kingdom), which Cloudflare does not guarantee; delivered through Cloudflare's global network |
| Postmark | United States | |
| Twilio | Text messages | United States |
| Stripe | Billing | United States |
| Sentry | Error reports | United States |
| Grafana Cloud | Service metrics | United States |
| Push notifications, Google sign-in | United States | |
| Apple | Sign in with Apple | United States |
| HubSpot | Sales contacts: the founder's name and email and the company's name, region, plan and how it found us only | European Union |
Sent outside your region
The account details needed to sign in (name, email, password hash, or the Google or Apple account id) and billing are held in a small directory in Sydney for every region, so we can route you to your company’s region. It holds no sheets, photos or signatures.
Email, text messages, billing, error reports, service metrics, push notifications and sign-in with Google or Apple are handled where the table shows, which may be outside your region. Transfers out of the United Kingdom are protected as the Data Processing Addendum sets out: UK adequacy regulations, or the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.
Changes
We give at least 30 days’ notice before we add or replace a sub-processor, by email to account holders and by updating this page with the date the change takes effect.
A company can object before that date by emailing privacy@workstamp.app with its reasons. If we cannot resolve the objection, the company can close its account before the change takes effect. The Data Processing Addendum has the full terms.