How many subprocessors does HCSS use?

HCSS lists 34 subprocessors on its published list, including 6Sense Insights, Inc., ADP, Inc., BeyondTrust Corporation (Bomgar), Bill.com, and Amazon Web Services and 29 more.

Where does HCSS process customer data?

The subprocessors named by HCSS are located in U.S. and EU, as stated on its list.

How quickly does HCSS report a personal data breach to customers?

According to its DPA, HCSS reports a personal data breach to customers within 72 hours: “HCSS commits to report any verified Data Security Breach involving Customer Personal Data to Customer without undue delay after discovering a Data Security Breach and in any event no later than seventy-two (72) hours after verification.”

How much notice does HCSS give before adding a subprocessor?

HCSS's DPA gives 30 days' notice of a new subprocessor, the time customers have to object: “If Customer does not object within thirty (30) calendar days, then such added or replaced sub-processors shall be considered incorporated into Annex III as an amendment.”

How does HCSS transfer personal data outside the EU?

HCSS's DPA relies on standard contractual clauses and the EU–US Data Privacy Framework: “pursuant to the Standard Contractual Clauses (European Commission Decision 2021/914 of 4 June 2021), and Module 2 of the Standard Contractual Clauses shall be applicable.”

Does HCSS have a SOC 2 Type II report?

Yes. HCSS's trust page lists a SOC 2 Type II report: “SOC 2 (Type 2)”

Which security certifications does HCSS list?

HCSS's trust page lists SOC 2 Type II.

When was HCSS's subprocessor list last checked?

ClauseTrail last checked HCSS's subprocessor list on September 28, 2026. Lists are re-checked daily.

How do I find out when HCSS adds or removes a subprocessor?

ClauseTrail monitors HCSS's subprocessor list, DPA, privacy policy and terms and emails you the exact change — who was added or removed and what the page said before and after. The first vendors are free.

HCSS Subprocessors List (September 2026): Changes and History

HCSS names 34 subprocessors on its published list. Read from the vendor's own page and re-checked daily.

Last checked September 28, 2026 Official source ↗

HCSS subprocessors (September 2026)

#	Subprocessor	Purpose	Location
1	6Sense Insights, Inc.	Customer engagement and marketing analytics	U.S.
2	ADP, Inc.	Human resources	U.S.
3	BeyondTrust Corporation (Bomgar)	Technical and support services	U.S.
4	Bill.com	Financial operations for accounts payable and accounts receivable	U.S.
5	Amazon Web Services	Cloud hosting and data storage; supplier of Bing Maps	U.S., EU
6	Apple, Inc.	Push notification services	U.S.
7	Asana, Inc.	Project and task management	U.S.
8	Atlassian, Inc.	Jira for tracking software development and task management	U.S.
9	Azure OpenAI	Artificial intelligence features for products	U.S.
10	Cvent Inc.	Event management	U.S.
11	Datadog, Inc.	Support operations	U.S.
12	Docusign, Inc.	E-signature and contract management	U.S.
13	Drata Inc.	Compliance management	U.S.
14	Duende Software, LLC	User authentication	U.S.
15	FileStack, Inc.	Filed uploading in HCSS’s products	U.S.
16	Gainsight, Inc.	Customer relationship, support, and analytics services	U.S.
17	GitHub, Inc.	Computer programing code repository and management	U.S.
18	Google LLC	Google Workspace Google Cloud for corporate email, file storage, and cloud services	U.S., EU
19	Gong.io Inc.	Sales support	U.S.
20	Mailgun Technologies, Inc.	Transactional email deliverability tool	U.S.
21	Mango Technologies, Inc. (ClickUp)	Project management	U.S.
22	Microsoft Corp.	Cloud hosting and data storage; PowerBI reporting	U.S., EU
23	Nylas, Inc.	Document integration	U.S.
24	Oracle	Billing and accounting through NetSuite	U.S.
25	Pendo.io	Product analytics and user experience optimization	U.S.
26	RealtimeBoard, Inc. dba Miro	Collaboration workspace	U.S.
27	Redwit SAS	HCSS affiliate for support and operations	EU
28	Salesforce.com, Inc.	Customer relations management	U.S.
29	Salesloft, Inc.	Online chatbot	U.S.
30	Twilio Inc.	SMS messaging	U.S.
31	Usercentrics A/S	Cookie permissions management	U.S.
32	Versapay	Payment processing	U.S.
33	Workato, Inc.	Business integration and automation	U.S.
34	Zoom Communications, Inc.	Video conferencing and customer support	U.S.

Get an email when HCSS changes its subprocessors

ClauseTrail re-checks this list every day and tells you exactly who was added or removed — including when a vendor starts sending data to an AI provider. The first vendors are free.

Track HCSS free

Key DPA terms at HCSS

What HCSS's data processing agreement commits to, with the sentence each answer comes from. SCCs or the Data Privacy Framework: what's the difference?

Breach notification: Within 72 hours

“HCSS commits to report any verified Data Security Breach involving Customer Personal Data to Customer without undue delay after discovering a Data Security Breach and in any event no later than seventy-two (72) hours after verification.”
DPA, www.hcss.com ↗
Notice of a new subprocessor: 30 days ahead

“If Customer does not object within thirty (30) calendar days, then such added or replaced sub-processors shall be considered incorporated into Annex III as an amendment.”
DPA, www.hcss.com ↗
Transfers outside the EU: Standard contractual clauses and the EU–US Data Privacy Framework

“pursuant to the Standard Contractual Clauses (European Commission Decision 2021/914 of 4 June 2021), and Module 2 of the Standard Contractual Clauses shall be applicable.”

“HCSS complies with the EU-U.S. Data Privacy Framework ("EU-U.S. DPF"), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework ("Swiss-U.S. DPF") as set forth by the U.S. Department of Commerce.”
DPA, www.hcss.com ↗
Customer data after the contract ends: Deleted within 60 days of the contract ending

“HCSS will securely delete Customer Personal Data within sixty (60) calendar days following the termination or expiration of the Agreement, unless Customer instructs HCSS in writing to keep certain Customer Personal Data longer or return certain Customer Personal Data earlier.”
DPA, www.hcss.com ↗
Audit rights: Through certifications and audit reports only

“Upon Customer's written request, HCSS shall, no more than once per calendar year, provide Customer with a summary copy of HCSS's third-party audit report(s) that demonstrate(s) HCSS's compliance with industry standards for data security.”
DPA, www.hcss.com ↗

Certifications at HCSS

What HCSS's trust page lists, with the text each one comes from. SOC 2 Type I or Type II: what's the difference?

SOC 2 Type II: Active

“SOC 2 (Type 2)”
Trust page, www.hcss.com ↗

Documents we track for HCSS

DPA: checked September 28, 2026 www.hcss.com ↗
Privacy policy: checked September 28, 2026 www.hcss.com ↗
Subprocessor list: checked September 28, 2026 www.hcss.com ↗
Terms of service: checked September 28, 2026 www.hcss.com ↗
Trust page: checked September 28, 2026 www.hcss.com ↗

Change history

Tracking since September 28, 2026. No change has been published since; additions, removals and document changes will appear here as they're published.

HCSS subprocessors FAQ

How many subprocessors does HCSS use?: HCSS lists 34 subprocessors on its published list, including 6Sense Insights, Inc., ADP, Inc., BeyondTrust Corporation (Bomgar), Bill.com, and Amazon Web Services and 29 more.
Where does HCSS process customer data?: The subprocessors named by HCSS are located in U.S. and EU, as stated on its list.
How quickly does HCSS report a personal data breach to customers?: According to its DPA, HCSS reports a personal data breach to customers within 72 hours: “HCSS commits to report any verified Data Security Breach involving Customer Personal Data to Customer without undue delay after discovering a Data Security Breach and in any event no later than seventy-two (72) hours after verification.”
How much notice does HCSS give before adding a subprocessor?: HCSS's DPA gives 30 days' notice of a new subprocessor, the time customers have to object: “If Customer does not object within thirty (30) calendar days, then such added or replaced sub-processors shall be considered incorporated into Annex III as an amendment.”
How does HCSS transfer personal data outside the EU?: HCSS's DPA relies on standard contractual clauses and the EU–US Data Privacy Framework: “pursuant to the Standard Contractual Clauses (European Commission Decision 2021/914 of 4 June 2021), and Module 2 of the Standard Contractual Clauses shall be applicable.”
Does HCSS have a SOC 2 Type II report?: Yes. HCSS's trust page lists a SOC 2 Type II report: “SOC 2 (Type 2)”
Which security certifications does HCSS list?: HCSS's trust page lists SOC 2 Type II.
When was HCSS's subprocessor list last checked?: ClauseTrail last checked HCSS's subprocessor list on September 28, 2026. Lists are re-checked daily.
How do I find out when HCSS adds or removes a subprocessor?: ClauseTrail monitors HCSS's subprocessor list, DPA, privacy policy and terms and emails you the exact change — who was added or removed and what the page said before and after. The first vendors are free.