How many subprocessors does Watershed use?

Watershed lists 10 subprocessors on its published list, including Google Cloud Platform, Merge, OneSchema, Cloudflare, and WorkOS and 5 more.

Where does Watershed process customer data?

The subprocessors named by Watershed are located in US, EU, Mexico, and UK, as stated on its list.

How quickly does Watershed report a personal data breach to customers?

According to its DPA, Watershed reports a personal data breach to customers within 72 hours: “Watershed will notify Customer promptly, and in any event within seventy-two (72) hours, of any Security Breach that compromises the availability, security, or integrity of the Personal Data.”

How does Watershed transfer personal data outside the EU?

Watershed's DPA relies on standard contractual clauses: “To the extent legally required, by entering into this DPA, Customer and Watershed are deemed to have signed the EU SCCs, which form part of this DPA”

When was Watershed's subprocessor list last checked?

ClauseTrail last checked Watershed's subprocessor list on November 2, 2026. Lists are re-checked daily.

How do I find out when Watershed adds or removes a subprocessor?

ClauseTrail monitors Watershed's subprocessor list, DPA, privacy policy and terms and emails you the exact change — who was added or removed and what the page said before and after. The first vendors are free.

Watershed Subprocessors List (November 2026): Changes and History

Watershed names 10 subprocessors on its published list. Read from the vendor's own page and re-checked daily.

Last checked November 2, 2026 Official source ↗

Watershed subprocessors (November 2026)

#	Subprocessor	Purpose	Location	Data
1	Google Cloud Platform	Provides infrastructure services.	US, EU	Customer names, Email addresses, IP addresses
2	Merge	API integrations for Watershed customers.	US	Customer IP addresses
3	OneSchema	Provides upload and data validation.	US	Customer IP addresses
4	Cloudflare	Provides traffic filtering, WAF, and application infrastructure.	US, EU	Customer names, Email addresses, IP addresses
5	WorkOS	Provides SSO configuration and authentication.	US	Customer names, Email addresses, IP addresses
6	Salesforce	Provides support ticketing, communication, and tracking.	US	Customer names, Email addresses, IP addresses
7	Honeycomb	Provides performance observability.	US	Customer IP addresses
8	SendGrid	Used to send account management and supplier emails.	US	Customer email addresses
9	Watershed Technology Limited	A subsidiary of Watershed Technology, Inc.	UK	—
10	WS Technology De Mexico	A subsidiary of Watershed Technology, Inc.	Mexico	—

Get an email when Watershed changes its subprocessors

ClauseTrail re-checks this list every day and tells you exactly who was added or removed — including when a vendor starts sending data to an AI provider. The first vendors are free.

Track Watershed free

Key DPA terms at Watershed

What Watershed's data processing agreement commits to, with the sentence each answer comes from. SCCs or the Data Privacy Framework: what's the difference?

Breach notification: Within 72 hours

“Watershed will notify Customer promptly, and in any event within seventy-two (72) hours, of any Security Breach that compromises the availability, security, or integrity of the Personal Data.”
DPA, watershed.com ↗
Transfers outside the EU: Standard contractual clauses

“To the extent legally required, by entering into this DPA, Customer and Watershed are deemed to have signed the EU SCCs, which form part of this DPA”
DPA, watershed.com ↗
Customer data after the contract ends: Deleted or returned when the contract ends

“At Customer's direction at any time, and in any event upon termination or expiration of the Agreement, except to the extent required by Data Privacy Laws, Watershed shall, and shall cause its representatives to, promptly return to Customer or, if so directed by Customer, securely destroy any and all Personal Data.”
DPA, watershed.com ↗
Audit rights: Once a year

“provided that such audit shall occur not more than once every twelve (12) calendar months, upon thirty (30) days' prior written notice and during Watershed's normal business hours”
DPA, watershed.com ↗

Documents we track for Watershed

DPA: checked November 3, 2026 watershed.com ↗
Privacy policy: checked November 3, 2026 changed October 14, 2026 watershed.com ↗
Subprocessor list: checked November 2, 2026 trust.watershed.com ↗
Terms of service: checked November 3, 2026 watershed.com ↗
Trust page: checked November 3, 2026 watershed.com ↗

Change history

October 14, 2026

Privacy policy changed

The Cookie Notice section of the Privacy Policy was updated (dated Oct 13, 2026) to add numerous new cookies, including a new third-party vendor G2 (events_distinct_id, amplitude_session, _g2_session_id) and additional Cloudflare, OpenAI, Microsoft, Google and ZoomInfo cookies, plus changed retention periods for IDE (now 13 months in EEA/UK/Switzerland, 24 months elsewhere) and MUID (now 390 days, domain expanded to include .clarity.ms).

Tracking since October 17, 2026. Every change links to the two versions of the document it came from. All vendors' changes →

Watershed subprocessors FAQ

How many subprocessors does Watershed use?: Watershed lists 10 subprocessors on its published list, including Google Cloud Platform, Merge, OneSchema, Cloudflare, and WorkOS and 5 more.
Where does Watershed process customer data?: The subprocessors named by Watershed are located in US, EU, Mexico, and UK, as stated on its list.
How quickly does Watershed report a personal data breach to customers?: According to its DPA, Watershed reports a personal data breach to customers within 72 hours: “Watershed will notify Customer promptly, and in any event within seventy-two (72) hours, of any Security Breach that compromises the availability, security, or integrity of the Personal Data.”
How does Watershed transfer personal data outside the EU?: Watershed's DPA relies on standard contractual clauses: “To the extent legally required, by entering into this DPA, Customer and Watershed are deemed to have signed the EU SCCs, which form part of this DPA”
When was Watershed's subprocessor list last checked?: ClauseTrail last checked Watershed's subprocessor list on November 2, 2026. Lists are re-checked daily.
How do I find out when Watershed adds or removes a subprocessor?: ClauseTrail monitors Watershed's subprocessor list, DPA, privacy policy and terms and emails you the exact change — who was added or removed and what the page said before and after. The first vendors are free.