Subprocessors
The third-party providers that process Customer Data on our behalf to run Workframe, what they do and where they process it.
Simpson Soft UK Limited (“we”, “us”) uses the providers below to host and run Workframe. Each one processes personal data only to deliver its service to us, under a written contract containing data protection terms at least as protective as our Data Processing Agreement.
Current subprocessors
| Provider | Purpose | Data processed | Location | Transfer safeguard |
|---|---|---|---|---|
| Cloudflare, Inc. | Application hosting (Workers), content delivery, DNS, network security and DDoS protection, database connection pooling, and routing of email sent to our support address | All Customer Data in transit; IP addresses and request metadata; support emails | Global edge network; application compute placed in the United States (Ohio) | UK Extension to the EU–US Data Privacy Framework where the provider is certified; otherwise EU Standard Contractual Clauses with the UK Addendum |
| Neon (a Databricks company) | Managed PostgreSQL database hosting, backups and user authentication (sign-in, sessions, verification codes) | All Customer Data at rest; account details, hashed passwords and session records | United States (AWS us-east-2, Ohio) | UK Extension to the EU–US Data Privacy Framework where the provider is certified; otherwise EU Standard Contractual Clauses with the UK Addendum |
| Amazon Web Services, Inc. | Cloud infrastructure on which Neon runs our database | All Customer Data at rest (encrypted), as infrastructure provider to Neon | United States (us-east-2, Ohio) | UK Extension to the EU–US Data Privacy Framework where the provider is certified; otherwise EU Standard Contractual Clauses with the UK Addendum |
| Resend (Plus Five Five, Inc.) | Delivery of service emails: verification codes, password resets, invitations and leave notifications | Recipient names and email addresses; email content such as leave dates and types | United States (company); emails sent from Japan (Tokyo region) | UK and EU adequacy for Japan; EU Standard Contractual Clauses with the UK Addendum for the United States |
| Stripe Payments UK Ltd and its affiliates | Subscription billing, payment processing, invoices, tax calculation and fraud prevention | Billing contact name, email and address; payment card details (held by Stripe only); subscription and seat counts | United Kingdom, European Union and United States | UK Extension to the EU–US Data Privacy Framework where the provider is certified; otherwise EU Standard Contractual Clauses with the UK Addendum |
| Microsoft Corporation (Microsoft 365) | Our business email, used to receive and answer support requests | Support correspondence and any information you choose to include in it | United Kingdom, European Union and United States | UK Extension to the EU–US Data Privacy Framework where the provider is certified; otherwise EU Standard Contractual Clauses with the UK Addendum |
Services you choose to connect
Some services are used only when you or your organisation choose them. They act under their own terms, not as our subprocessors:
- Google sign-in. If you choose “Continue with Google”, Google LLC confirms your identity and shares your name, email address and profile picture with us. We do not receive access to your Google files, mail or calendar.
- Calendar applications. If an administrator subscribes a calendar app to a Workframe calendar feed, that calendar provider fetches approved leave names and dates from the feed URL.
Changes to this list
We will update this page at least 30 days before a new subprocessor starts processing Customer Data, except where we must act sooner to keep the service secure or available, in which case we will update it as soon as we can. The date at the top of this page shows when it last changed.
To receive notice of changes by email, or to object to a new subprocessor on reasonable data protection grounds, email support@workframe.online with the subject “Subprocessor updates”. The objection process is set out in section 7 of our Data Processing Agreement.