What this list covers
A subprocessor is a third party engaged by The Working Company, Inc. to process Customer Personal Data on behalf of a Corporate Suite customer. This list supports our Data Processing Addendum. A provider receives only the data reasonably needed for its function and is subject to contractual data-protection and confidentiality obligations.
Customer-enabled integrations may act as subprocessors, independent controllers, or processors engaged directly by Customer depending on the service and configuration. Enabling an optional feature is Customer's instruction to use the relevant provider.
Core subprocessors
| Provider | Purpose | Data | Primary location |
|---|---|---|---|
| Amazon Web Services, Inc. | Cloud hosting, compute, databases, object storage, content delivery, email delivery, security logging, backups, and managed AI infrastructure. | Account, Customer Content, files, technical, security, and transactional data. | United States; primary workload boundary us-east-1. |
| Supabase, Inc. | Authentication and identity services. | Identity, email, authentication metadata, and tokens. | United States or configured project region. |
| Stripe, Inc. | Checkout, subscriptions, payment processing, invoices, fraud prevention, tax-related payment functions, and customer billing portal. | Billing contact, transaction, payment-method, tax, and fraud signals. | Global, including United States. |
Feature-dependent subprocessors
| Provider | Enabled feature | Data | Location |
|---|---|---|---|
| Google LLC / Google Cloud | Corporate Suite AI reasoning and generation when a Google model is selected. | Prompts, authorized context, output, and usage metadata. | United States or provider processing locations. |
| ElevenLabs, Inc. | Agent Phone, speech, transcription, or conversational voice features. | Audio, transcript, prompts, authorized context, output, and usage metadata. | United States or provider processing locations. |
Customer-directed integration providers
Google Workspace and Microsoft 365 may process identity, mail, calendar, contacts, files, and connector metadata when Customer authorizes those integrations. Depending on the connection, those providers may process data under Customer's direct agreement and their own privacy terms rather than solely as TWC subprocessors. Corporate Suite limits access to authorized scopes and uses the connection only to deliver the requested integration.
Changes and objections
We may add or replace a subprocessor to operate or improve the Service. For customers covered by the Data Processing Addendum, we will post the change on this page at least 15 days before the new provider begins processing Customer Personal Data where practicable. Urgent security or continuity needs may require shorter notice.
A customer may object during that notice period on reasonable data-protection grounds by emailing [email protected]. We will work in good faith on a commercially reasonable alternative. If none is available, either party may terminate the affected feature, and where the affected feature is material, Customer may terminate the affected Service under the DPA.
Questions and transfer safeguards
Contact [email protected] for questions about a provider, its role, or applicable international-transfer safeguards. Enterprise agreements may define a narrower provider set, region, or advance-notice mechanism.