Document ID: WST-OPS-SUB-v1.0 · Effective Date: 2 May 2026 · Governing Law: Delaware, USA
This page lists the third-party sub-processors engaged by Workestra LLC to provide the Workestra platform at workestra.app (the "Service"). It is incorporated by reference into our Data Processing Agreement.
We distinguish between:
- Core sub-processors — engaged for every workspace as part of operating the Service.
- Conditional sub-processors — engaged only when a workspace activates a specific feature, integration, or AI provider.
We use vetted, contractually-bound sub-processors and impose data-protection obligations that are no less protective than those between Workestra and our customers.
1. Core Sub-processors
| Sub-processor | Purpose | Region |
|---|---|---|
| Vercel Inc. | Application hosting and edge delivery | US (global edge) |
| Supabase Inc. | Postgres database, authentication, storage, realtime | US (EU region available on enterprise plans) |
| Sentry (Functional Software, Inc.) | Error monitoring and performance telemetry | US |
| Resend Inc. | Transactional and operational email delivery | US |
| Stripe Inc. | Payment processing and subscription billing | US |
2. Conditional Sub-processors — Payments
Engaged when a workspace uses the corresponding payment rail.
| Sub-processor | Purpose | Region |
|---|---|---|
| Mollie B.V. | EU payment processing (SEPA, iDEAL, Bancontact) | NL/EU |
3. Conditional Sub-processors — Voice and SMS
Engaged when a workspace uses the Voice module or SMS messaging.
| Sub-processor | Purpose | Region |
|---|---|---|
| Twilio Inc. | Voice calls, SMS, phone number provisioning | US (global PoPs) |
4. Conditional Sub-processors — AI Providers
Engaged when a workspace activates AI features and selects the corresponding AI provider in workspace settings. AI providers process the prompts, selected entity context, and search results that Workestra sends to fulfill an AI request. AI providers are not engaged by default — administrators must explicitly enable AI for the workspace.
| Sub-processor | Purpose | Region |
|---|---|---|
| Anthropic PBC | AI inference (Claude) | US |
| OpenAI, L.L.C. | AI inference (GPT family) | US |
| Moonshot AI | AI inference (Kimi family) | CN / SG |
| xAI Corp. | AI inference (Grok family) | US |
| DeepSeek | AI inference (DeepSeek family) | CN |
Note on AI providers. Where Customer configures its own API key for an AI provider, that provider acts on Customer's instructions under Customer's contract with the provider. Workestra remains responsible only for the data we transmit to the provider on Customer's behalf and not for the provider's downstream processing. See our AI Use & Data Policy for details.
5. Conditional Sub-processors — Banking and Finance
Engaged when a workspace connects a banking or e-invoicing integration in the Finance module.
| Sub-processor | Purpose | Region |
|---|---|---|
| Plaid Inc. | US banking aggregation | US |
| Tink AB | EU banking aggregation (PSD2 AISP) | SE / EU |
| Salt Edge Ltd. | EU/UK banking aggregation | UK / EU |
| Ponto (Isabel Group) | Benelux banking aggregation | BE / EU |
| Peppox | EU PEPPOL e-invoicing access point | EU |
| Peppyrus | EU PEPPOL e-invoicing access point | EU |
| BoldSign (Syncfusion, Inc.) | E-signatures for quotations and contracts | US / IN |
6. Conditional Sub-processors — Productivity Integrations
Engaged when a workspace user authorizes the corresponding integration. Workestra accesses only the data the user grants via OAuth scope.
| Sub-processor | Purpose | Region |
|---|---|---|
| Google LLC | Calendar and Gmail sync (when connected) | US |
| Microsoft Corporation | Outlook calendar, Outlook mail, and Teams (when connected) | US / global |
| Slack Technologies, LLC | Slack channel notifications and inbound commands (when connected) | US |
| GitHub Inc. | Knowledge Base sync and issue/repo integrations (when connected) | US |
7. Notification of Changes
Workestra will provide at least 14 days' prior notice of the addition or replacement of a sub-processor by:
- Updating this page (version, effective date, and changelog), and
- Sending email notice to workspace administrators registered for change notifications.
To subscribe an additional administrator to sub-processor change notifications, email privacy@workestra.app with the workspace name and recipient address.
8. Right to Object
For Customers subject to GDPR, UK GDPR, or FADP, the DPA grants the right to object to a new sub-processor on reasonable data-protection grounds. Where the parties cannot agree on a remediation, Customer may terminate the affected portion of the Service and receive a pro-rated refund of pre-paid fees for the unused period.
9. Removed or Replaced Sub-processors
Replaced or removed sub-processors are recorded below for transparency.
None at the time of initial publication.
Policy Changelog
| Version | Date | Summary |
|---|---|---|
| v1.0 | 2026-05-02 | Initial publication |