Draft — pending legal review. This document describes how the product works today; it is not yet a binding legal agreement.
Data Processing Addendum
This page summarizes our role as a processor and lists our sub-processors. The signed addendum is provided on request.
Roles
Your organization is the controller of employee personal data. Workforce OS acts as a processor and processes it only on documented instructions.
Security measures
- Per-workspace data isolation and role-based access control with manager-level scoping.
- Tamper-evident audit log, MFA, session management and brute-force protection.
- Encrypted transport, signed webhooks and verified payment-provider callbacks.
Sub-processors
The current list is shown below. We will update this page before adding or replacing a sub-processor.
- Cloud hosting and managed database (provider to be confirmed per deployment region) — Application hosting, database, file storage and backups
- Stripe — Card payments and subscription billing (international customers)
- Paymob — Payments and billing for customers in Egypt
- Anthropic — AI assistant (only when enabled for a workspace)
- Email delivery provider (SMTP) — Transactional email such as password resets and notifications
Data subject requests, breach notification, audits, international transfers
[Clause to be provided by counsel]