How many subprocessors does WorkOS use?

WorkOS lists 25 subprocessors on its published list, including Amazon Web Services, Cloudflare, Datadog, Postmark, and Sendgrid and 20 more.

Where does WorkOS process customer data?

The subprocessors named by WorkOS are located in United States, as stated on its list.

How quickly does WorkOS report a personal data breach to customers?

According to its DPA, WorkOS reports a personal data breach to customers without undue delay, with no set deadline: “WorkOS agrees to provide written notice without undue delay and within the time frame required under Data Protection Laws to Subscriber.”

How much notice does WorkOS give before adding a subprocessor?

WorkOS's DPA gives 14 days' notice of a new subprocessor, the time customers have to object: “WorkOS will allow Subscriber fourteen (14) calendar days to object to the new Subprocessor after notice is given.”

How does WorkOS transfer personal data outside the EU?

WorkOS's DPA relies on standard contractual clauses: “the transfer shall be governed by the Standard Contractual Clauses attached hereto as Exhibit C”

Does WorkOS have a SOC 2 Type II report?

Yes. WorkOS's trust page lists a SOC 2 Type II report: “SOC 2 Type 2 certified”

Which security certifications does WorkOS list?

WorkOS's trust page lists SOC 2 Type II.

When was WorkOS's subprocessor list last checked?

ClauseTrail last checked WorkOS's subprocessor list on October 6, 2026. Lists are re-checked daily.

How do I find out when WorkOS adds or removes a subprocessor?

ClauseTrail monitors WorkOS's subprocessor list, DPA, privacy policy and terms and emails you the exact change — who was added or removed and what the page said before and after. The first vendors are free.

WorkOS Subprocessors List (October 2026): Changes and History

WorkOS names 25 subprocessors on its published list. Read from the vendor's own page and re-checked daily.

Last checked October 6, 2026 Official source ↗

WorkOS subprocessors (October 2026)

#	Subprocessor	Purpose	Location
1	Amazon Web Services	Cloud Infrastructure	United States
2	Cloudflare	Edge Security & Traffic Routing	United States
3	Datadog	Logging & Monitoring	United States
4	Postmark	Email Delivery	United States
5	Sendgrid	Email Delivery	United States
6	Twilio	SMS communications	United States
7	Stripe	Billing	United States
8	Sentry	Error Handling, User Support	United States
9	Vercel	Application Hosting	United States
10	Fivetran	Logging & Monitoring	United States
11	Snowflake	Data Warehouse	United States
12	dbtCloud	Data Transformation	United States
13	Segment	Data Pipeline Orchestration	United States
14	Mode	Application Analytics	United States
15	ClickHouse	Application Analytics	United States
16	Google Analytics	Marketing Analytics	United States
17	Salesforce	Subscription Management	United States
18	Zendesk	Customer Support Tool	United States
19	Hubspot	Sales and Marketing	United States
20	Close	Sales and Marketing	United States
21	SendSafely	Customer Support Tool	United States
22	Channeled	Customer Support Tool	United States
23	Zapier	Workflow Automation	United States
24	Prelude	SMS Communications	United States
25	IPLocate	IP Lookup	United States

Get an email when WorkOS changes its subprocessors

ClauseTrail re-checks this list every day and tells you exactly who was added or removed — including when a vendor starts sending data to an AI provider. The first vendors are free.

Track WorkOS free

Key DPA terms at WorkOS

What WorkOS's data processing agreement commits to, with the sentence each answer comes from. SCCs or the Data Privacy Framework: what's the difference?

Breach notification: Without undue delay, with no set deadline

“WorkOS agrees to provide written notice without undue delay and within the time frame required under Data Protection Laws to Subscriber.”
DPA, workos.com ↗
Notice of a new subprocessor: 14 days ahead

“WorkOS will allow Subscriber fourteen (14) calendar days to object to the new Subprocessor after notice is given.”
DPA, workos.com ↗
Transfers outside the EU: Standard contractual clauses

“the transfer shall be governed by the Standard Contractual Clauses attached hereto as Exhibit C”
DPA, workos.com ↗
Customer data after the contract ends: Deleted or returned when the contract ends

“At the expiry or termination of the Agreement, WorkOS will delete all Subscriber Personal Data (excluding any back-up or archival copies which shall be deleted in accordance with WorkOS' data retention schedule), except where WorkOS is required to retain copies under applicable laws, in which case WorkOS will isolate and protect that Subscriber Personal Data from any further Processing except to the extent required by applicable laws.”
DPA, workos.com ↗
Audit rights: Once a year

“Any audit shall be: (i) be limited to once per year; and (ii) subject to reasonable confidentiality procedures.”
DPA, workos.com ↗

Certifications at WorkOS

What WorkOS's trust page lists, with the text each one comes from. SOC 2 Type I or Type II: what's the difference?

SOC 2 Type II: Active

“SOC 2 Type 2 certified”
Trust page, workos.com ↗

Documents we track for WorkOS

DPA: checked October 6, 2026 workos.com ↗
Privacy policy: checked October 6, 2026 workos.com ↗
Subprocessor list: checked October 6, 2026 trust.workos.com ↗
Terms of service: checked October 6, 2026 workos.com ↗
Trust page: checked October 6, 2026 workos.com ↗

Change history

Tracking since October 6, 2026. No change has been published since; additions, removals and document changes will appear here as they're published.

WorkOS subprocessors FAQ

How many subprocessors does WorkOS use?: WorkOS lists 25 subprocessors on its published list, including Amazon Web Services, Cloudflare, Datadog, Postmark, and Sendgrid and 20 more.
Where does WorkOS process customer data?: The subprocessors named by WorkOS are located in United States, as stated on its list.
How quickly does WorkOS report a personal data breach to customers?: According to its DPA, WorkOS reports a personal data breach to customers without undue delay, with no set deadline: “WorkOS agrees to provide written notice without undue delay and within the time frame required under Data Protection Laws to Subscriber.”
How much notice does WorkOS give before adding a subprocessor?: WorkOS's DPA gives 14 days' notice of a new subprocessor, the time customers have to object: “WorkOS will allow Subscriber fourteen (14) calendar days to object to the new Subprocessor after notice is given.”
How does WorkOS transfer personal data outside the EU?: WorkOS's DPA relies on standard contractual clauses: “the transfer shall be governed by the Standard Contractual Clauses attached hereto as Exhibit C”
Does WorkOS have a SOC 2 Type II report?: Yes. WorkOS's trust page lists a SOC 2 Type II report: “SOC 2 Type 2 certified”
Which security certifications does WorkOS list?: WorkOS's trust page lists SOC 2 Type II.
When was WorkOS's subprocessor list last checked?: ClauseTrail last checked WorkOS's subprocessor list on October 6, 2026. Lists are re-checked daily.
How do I find out when WorkOS adds or removes a subprocessor?: ClauseTrail monitors WorkOS's subprocessor list, DPA, privacy policy and terms and emails you the exact change — who was added or removed and what the page said before and after. The first vendors are free.