How many subprocessors does BambooHR use?

BambooHR lists 60 subprocessors on its published list, including Last Updated, Entity Name, Anthropic/Claude, Cohere, and LlamaIndex (optional) and 55 more.

Where does BambooHR process customer data?

The subprocessors named by BambooHR are located in US, Canada, Location, and Payroll, as stated on its list.

How quickly does BambooHR report a personal data breach to customers?

According to its DPA, BambooHR reports a personal data breach to customers without undue delay, with no set deadline: “BambooHR shall inform Client without undue delay and provide written notification of the Security Incident.”

How much notice does BambooHR give before adding a subprocessor?

BambooHR's DPA gives 30 days' notice of a new subprocessor, the time customers have to object: “BambooHR provides at least 30 days' prior written notice to Client of the engagement of any new Subcontractor (including details of the processing and location)”

How does BambooHR transfer personal data outside the EU?

BambooHR's DPA relies on standard contractual clauses, the EU–US Data Privacy Framework, and adequacy decisions: “module two of the standard contractual clauses for Processors as approved by the European Commission and available here (as amended or updated from time to time) and found in Annex I”

Does BambooHR have a SOC 2 Type II report?

Yes. BambooHR's trust page lists a SOC 2 Type II report: “SOC 2 Type 2”

Which security certifications does BambooHR list?

BambooHR's trust page lists SOC 2 Type II.

When was BambooHR's subprocessor list last checked?

ClauseTrail last checked BambooHR's subprocessor list on October 3, 2026. Lists are re-checked daily.

How do I find out when BambooHR adds or removes a subprocessor?

ClauseTrail monitors BambooHR's subprocessor list, DPA, privacy policy and terms and emails you the exact change — who was added or removed and what the page said before and after. The first vendors are free.

BambooHR Subprocessors List (October 2026): Changes and History

BambooHR names 60 subprocessors on its published list. Read from the vendor's own page and re-checked daily.

Last checked October 3, 2026 Official source ↗

BambooHR subprocessors (October 2026)

#	Subprocessor	Purpose	Location	Data
1	Last Updated	July 2026	—	—
2	Entity Name	Service Description	Location	Product(s)
3	Anthropic/Claude	Language Learning Model API	US	All
4	Cohere	Language Learning Model API	US	All
5	LlamaIndex (optional)	LlamaParsedocument parsing	US	All
6	Atlas MongoDB	DataStorage	US	All
7	Open AI	Language Learning Model API	US	All
8	Pusher	Messaging platform for live	US	All
9	Ideon	Informationexchangewith carriers	US	BenAdmin
10	Noyo	Informationexchangewith carriers	US	BenAdmin
11	Adobe Analytics	Data analytics	US	All
12	Celonis/Make	Workflowautomation	US	All
13	Cloudflare	Web application firewall	US	All
14	Datadog	Infrastructureand application	US	All
15	Formstack	Workflowautomation	US	All
16	G2	Product reviews	US	All
17	Mailgun	Product communication	US	Al
18	Netskope	Cloud security	US	All
19	Omni	People analytics	US	All
20	Pendo	Productcommunicationanddata	US	All
21	Rollbar	Infrastructureandapplication	US	All
22	Tavio	Integration Platform asa	US	All
23	Twilio	MFA – SMS method	US	All
24	Vonage	MFA - SMS method	US	All
25	Active Reports	Report generation	US	Payroll
26	Alohi	Report faxing	US	Payroll
27	ComplyRight CTP	Print and electronic filing services US	Payroll	—
28	DynamicPDF (ceTe)	PDF generation	US	Payroll
29	Infragistics	UI/UX toolkits	US	Payroll
30	Intuit (Quickbooks)	Bank/financialtransaction	US	Payroll
31	Lexis Nexis	Identityverification; sanctions	US	Payroll
32	MasterTaxbyADP	Taxfilings andpaymentservices	US	Payroll
33	Merge API	Unified API integration	US	Payroll
34	Modern Treasury	Paymentoperationssoftware	US	Payroll
35	NationalPayment	Direct deposit services	US	Payroll
36	Notice Ninja	Taxagencynotices	US	Payroll
37	OSG	Printing and mailing	US	Payroll
38	Plaid	Secure financial connections	US	Payroll
39	SymmetryTaxEngine	Locationandtaxcalculation	US	Payroll
40	WellsFargo	Remittance and wire services	US	Payroll
41	Attention (Benwick)	Voiceassistant	US	All
42	Gearset	CRM backup	US	All
43	Gainsight	CRM services	US	All
44	AmazonWebServices	Cloud service hosting provider	US, Canada	All
45	Auth0	Identity management,	US	All
46	Databricks	Data warehouse and analytics	US	All
47	Google Workspace	Email, collaboration, generativeAI	US	All
48	Jira	Project management	US	All
49	Microsoft	Document creation	US	All
50	Open AI/ChatGPT	GenerativeAI	US	All
51	Slack	Messaging platform	US	All
52	Slite	Knowledgebase	US	All
53	Tableau	Data analytics and visualization	US	All
54	Wrike	Project management	US	All
55	Zoom	Webconferencing	US	All
56	Fourth Parties	For information about fourth party sub-processors or subcontractors you should	—	—
57	Third Party Services	For information about sub-processors or subcontractors for third parties	—	—
58	Party Services or contact BambooHR Support. Third party services may include	LinkedIn, Zip	—	—
59	Marketplace Partners/Resellers	For information about sub-processors/subcontractors for	—	—
60	Notice of updates	In accordance with applicable laws, BambooHR will provide notice of new	—	—

Get an email when BambooHR changes its subprocessors

ClauseTrail re-checks this list every day and tells you exactly who was added or removed — including when a vendor starts sending data to an AI provider. The first vendors are free.

Track BambooHR free

Key DPA terms at BambooHR

What BambooHR's data processing agreement commits to, with the sentence each answer comes from. SCCs or the Data Privacy Framework: what's the difference?

Breach notification: Without undue delay, with no set deadline

“BambooHR shall inform Client without undue delay and provide written notification of the Security Incident.”
DPA, www.bamboohr.com ↗
Notice of a new subprocessor: 30 days ahead

“BambooHR provides at least 30 days' prior written notice to Client of the engagement of any new Subcontractor (including details of the processing and location)”
DPA, www.bamboohr.com ↗
Transfers outside the EU: Standard contractual clauses, the EU–US Data Privacy Framework, and adequacy decisions

“module two of the standard contractual clauses for Processors as approved by the European Commission and available here (as amended or updated from time to time) and found in Annex I”

“for so long as BambooHR has in place a valid Data Privacy Framework certification or such other subsequent or additional certification or adequacy finding issued by the appropriate authorities permitting the transfer of personal data to the United States”

“the onward transfer is to a country benefiting from an adequacy decision pursuant to Article 45 of Regulation (EU) 2016/679 that covers the onward transfer”
DPA, www.bamboohr.com ↗
Customer data after the contract ends: Deleted or returned when the contract ends

“BambooHR shall, at Client's election, destroy, and certify such deletion, or return to Client all Personal Data (including copies) in its possession or control”
DPA, www.bamboohr.com ↗
Audit rights: Once a year

“Client shall not make any such request more than once in any 12-month period.”
DPA, www.bamboohr.com ↗

Certifications at BambooHR

What BambooHR's trust page lists, with the text each one comes from. SOC 2 Type I or Type II: what's the difference?

SOC 2 Type II: Active

“SOC 2 Type 2”
Trust page, www.bamboohr.com ↗

Documents we track for BambooHR

AI terms: checked October 2, 2026 www.bamboohr.com ↗
DPA: checked October 2, 2026 www.bamboohr.com ↗
Privacy policy: checked October 2, 2026 www.bamboohr.com ↗
Subprocessor list: checked October 3, 2026 www.bamboohr.com ↗
Terms of service: checked October 2, 2026 www.bamboohr.com ↗
Trust page: checked October 3, 2026 www.bamboohr.com ↗

Change history

Tracking since October 3, 2026. No change has been published since; additions, removals and document changes will appear here as they're published.

BambooHR subprocessors FAQ

How many subprocessors does BambooHR use?: BambooHR lists 60 subprocessors on its published list, including Last Updated, Entity Name, Anthropic/Claude, Cohere, and LlamaIndex (optional) and 55 more.
Where does BambooHR process customer data?: The subprocessors named by BambooHR are located in US, Canada, Location, and Payroll, as stated on its list.
How quickly does BambooHR report a personal data breach to customers?: According to its DPA, BambooHR reports a personal data breach to customers without undue delay, with no set deadline: “BambooHR shall inform Client without undue delay and provide written notification of the Security Incident.”
How much notice does BambooHR give before adding a subprocessor?: BambooHR's DPA gives 30 days' notice of a new subprocessor, the time customers have to object: “BambooHR provides at least 30 days' prior written notice to Client of the engagement of any new Subcontractor (including details of the processing and location)”
How does BambooHR transfer personal data outside the EU?: BambooHR's DPA relies on standard contractual clauses, the EU–US Data Privacy Framework, and adequacy decisions: “module two of the standard contractual clauses for Processors as approved by the European Commission and available here (as amended or updated from time to time) and found in Annex I”
Does BambooHR have a SOC 2 Type II report?: Yes. BambooHR's trust page lists a SOC 2 Type II report: “SOC 2 Type 2”
Which security certifications does BambooHR list?: BambooHR's trust page lists SOC 2 Type II.
When was BambooHR's subprocessor list last checked?: ClauseTrail last checked BambooHR's subprocessor list on October 3, 2026. Lists are re-checked daily.
How do I find out when BambooHR adds or removes a subprocessor?: ClauseTrail monitors BambooHR's subprocessor list, DPA, privacy policy and terms and emails you the exact change — who was added or removed and what the page said before and after. The first vendors are free.