How many subprocessors does Thoropass use?

Thoropass lists 6 subprocessors on its published list, including Airtable, Atlassian, AWS, Datadog, and dbt Labs and 1 more.

Where does Thoropass process customer data?

The subprocessors named by Thoropass are located in USA, as stated on its list.

How quickly does Thoropass report a personal data breach to customers?

According to its DPA, Thoropass reports a personal data breach to customers within 72 hours: “notify Customer of such Data Breach no later than seventy-two (72) hours after discovery of such Data Breach”

How much notice does Thoropass give before adding a subprocessor?

Thoropass's DPA gives 30 days' notice of a new subprocessor, the time customers have to object: “Customer authorizes Service Provider to use any such Sub-processor to process Customer Personal Data unless Customer objects within 30 days of such list, or any updates to the list, being made available to Customer.”

How does Thoropass transfer personal data outside the EU?

Thoropass's DPA relies on standard contractual clauses, the EU–US Data Privacy Framework, binding corporate rules, and adequacy decisions: “Processing in a country, a territory, or one or more specified sectors that are considered under applicable Data Protection Laws as providing an adequate level of data protection;”

When was Thoropass's subprocessor list last checked?

ClauseTrail last checked Thoropass's subprocessor list on November 3, 2026. Lists are re-checked daily.

How do I find out when Thoropass adds or removes a subprocessor?

ClauseTrail monitors Thoropass's subprocessor list, DPA, privacy policy and terms and emails you the exact change — who was added or removed and what the page said before and after. The first vendors are free.

Thoropass Subprocessors List (November 2026): Changes and History

Thoropass names 6 subprocessors on its published list. Read from the vendor's own page and re-checked daily.

Last checked November 3, 2026 Official source ↗

Thoropass subprocessors (November 2026)

#	Subprocessor	Purpose	Location	Data
1	Airtable	Other Subprocessor - Data Analytics; Airtable is a cloud collaboration service headquartered in San Francisco.	USA	SaaS, Collaboration, Task Management, Product Management, Database
2	Atlassian	Other Subprocessor – Ticketing System; (Jira) Atlassian Corporation Plc is an enterprise software company that develops products for software developers, project managers, and content management.	USA	Collaboration, Enterprise Software, SaaS, Software, Developer Tools
3	AWS	Core Infrastructure - SaaS Platform; AWS focuses on e-commerce, cloud computing, digital streaming, and artificial intelligence.	USA	Information Services, Software, Web Development, Information Technology
4	Datadog	Core Infrastructure – Monitoring and Logging; service for cloud-scale applications, providing monitoring of servers, databases, tools, and services, through a SaaS-based data analytics platform.	USA	Software, SaaS, Analytics, Information Technology
5	dbt Labs	Core Infrastructure – Transformation Workflow; dbt lets you transform data where it lives, using just SQL SELECT statements to infer dependency graphs and run transformation models in order.	USA	technology, datawarehouse
6	Finch	Core infrastructure – HRIS Integration; API to access HRIS systems	USA	api

Get an email when Thoropass changes its subprocessors

ClauseTrail re-checks this list every day and tells you exactly who was added or removed — including when a vendor starts sending data to an AI provider. The first vendors are free.

Track Thoropass free

Key DPA terms at Thoropass

What Thoropass's data processing agreement commits to, with the sentence each answer comes from. SCCs or the Data Privacy Framework: what's the difference?

Breach notification: Within 72 hours

“notify Customer of such Data Breach no later than seventy-two (72) hours after discovery of such Data Breach”
DPA, www.thoropass.com ↗
Notice of a new subprocessor: 30 days ahead

“Customer authorizes Service Provider to use any such Sub-processor to process Customer Personal Data unless Customer objects within 30 days of such list, or any updates to the list, being made available to Customer.”
DPA, www.thoropass.com ↗
Transfers outside the EU: Standard contractual clauses, the EU–US Data Privacy Framework, binding corporate rules, and adequacy decisions

“Processing in a country, a territory, or one or more specified sectors that are considered under applicable Data Protection Laws as providing an adequate level of data protection;”

“The parties' agreement to enter into and comply with the Standard Contractual Clauses in Exhibit 4 and any successors or amendments to such clauses or such other applicable contractual terms adopted and approved under Data Protection Laws;”

“Processing in compliance with Binding Corporate Rules in accordance with Data Protection Laws; or”

“including, as applicable, the EU-US Data Privacy Framework (EU-US DPF), the UK Extension to the EU-US Data Privacy Framework, and the Swiss-US Data Privacy Framework (Swiss-US DPF).”
DPA, www.thoropass.com ↗
Customer data after the contract ends: Deleted or returned when the contract ends

“Upon Customer's written request, or upon termination or expiration of the Agreement, Service Provider will delete all Customer Personal Data under Service Provider's possession or control”
DPA, www.thoropass.com ↗
Liability cap: US$2,000,000 aggregate liability cap

“in no event will either party's maximum aggregate liability for damages arising from this DPA exceed US$2,000,000.”
DPA, www.thoropass.com ↗
Audit rights: Once a year

“Audits or assessments to be requested no more than annually in the form of information reasonably necessary to demonstrate compliance with the requirements of this DPA”
DPA, www.thoropass.com ↗

Documents we track for Thoropass

DPA: checked November 3, 2026 changed October 28, 2026 www.thoropass.com ↗
Privacy policy: checked November 3, 2026 changed October 28, 2026 www.thoropass.com ↗
Subprocessor list: checked November 3, 2026 trust.thoropass.com ↗
Trust page: checked November 3, 2026 www.thoropass.com ↗

Change history

October 28, 2026

Privacy policy changed

The AI Use section now states Thoropass does not use customer data, including uploaded documents, to train, retrain or fine-tune AI models, and narrows AI processing to Google Vertex AI (Gemini) only, dropping Azure OpenAI as a processor. The policy was also dramatically shortened, with the visible diff showing the retention section, the EU-U.S./UK/Swiss Data Privacy Framework certification language, the Data Security section, and the subprocessor list link no longer present.

Tracking since October 18, 2026. Every change links to the two versions of the document it came from. All vendors' changes →

Thoropass subprocessors FAQ

How many subprocessors does Thoropass use?: Thoropass lists 6 subprocessors on its published list, including Airtable, Atlassian, AWS, Datadog, and dbt Labs and 1 more.
Where does Thoropass process customer data?: The subprocessors named by Thoropass are located in USA, as stated on its list.
How quickly does Thoropass report a personal data breach to customers?: According to its DPA, Thoropass reports a personal data breach to customers within 72 hours: “notify Customer of such Data Breach no later than seventy-two (72) hours after discovery of such Data Breach”
How much notice does Thoropass give before adding a subprocessor?: Thoropass's DPA gives 30 days' notice of a new subprocessor, the time customers have to object: “Customer authorizes Service Provider to use any such Sub-processor to process Customer Personal Data unless Customer objects within 30 days of such list, or any updates to the list, being made available to Customer.”
How does Thoropass transfer personal data outside the EU?: Thoropass's DPA relies on standard contractual clauses, the EU–US Data Privacy Framework, binding corporate rules, and adequacy decisions: “Processing in a country, a territory, or one or more specified sectors that are considered under applicable Data Protection Laws as providing an adequate level of data protection;”
When was Thoropass's subprocessor list last checked?: ClauseTrail last checked Thoropass's subprocessor list on November 3, 2026. Lists are re-checked daily.
How do I find out when Thoropass adds or removes a subprocessor?: ClauseTrail monitors Thoropass's subprocessor list, DPA, privacy policy and terms and emails you the exact change — who was added or removed and what the page said before and after. The first vendors are free.