This page provides information about the sub-processors engaged by Woba in accordance with Woba's Data Processing Agreement to support the delivery of Woba's services and the processing of customers' personal data on behalf of customers.
​
At the commencement of the Data Processing Agreement, the data controller has approved Woba's use of the sub-processors listed on this page.
​
Woba will update this page at least 30 days before engaging a new sub-processor or making material changes to the use of an existing sub-processor. Customers who subscribe to updates will be notified by email of changes to this page.

Woba primarily uses sub-processors located in the European Union or European Economic Area. Where Woba uses sub-processors outside the EU/EEA, Woba ensures that an appropriate transfer mechanism is in place, such as an adequacy decision, the EU-U.S. Data Privacy Framework, Standard Contractual Clauses, or another valid transfer mechanism under applicable data protection law.
​
Information about the EU-U.S. Data Privacy Framework is available at dataprivacyframework.gov.

The following sub-processors are used as part of Woba’s core service delivery.

Effective from: 01.03.2018
​Address: Antinkatu 1, 6th floor, 00100 Helsinki, Finland
​Transfer mechanism: EU/EØS

Aiven is used for hosting and operation of Woba’s production database, including managed database infrastructure, backup and restore functionality where applicable.

Aiven Oy is a Finnish Database-as-a-Service provider. Woba’s database hosted by Aiven runs on infrastructure provided by UpCloud, also a Finnish company, with the relevant hosting location in Frankfurt, Germany.

Aiven’s services are ISO 27000-series, GDPR, CCPA, HIPAA and PCI-DSS compliant. Aiven also provides ISAE 3000 / SOC 2 Type II reports.

Technical and security features include:

More information: Aiven Security

Effective from: 01.11.2024
​Address: 13 rue Jacques Peirotes, 67000 Strasbourg, France
​Company registration: SIRET 80866548300018
​Transfer mechanism: EU/EØS

Scalingo is a French cloud Platform-as-a-Service (PaaS) provider headquartered in France, engaged as a sub-processor for the hosting and operation of Woba's application servers. The processing carried out by Scalingo consists solely of infrastructure hosting; Scalingo does not have independent access to, or control over, the personal data processed through the Woba platform.

All data is hosted exclusively in France through Scalingo's infrastructure partner 3DS OUTSCALE, a cloud subsidiary of Dassault Systèmes SE.

Scalingo’s compliance and security framework includes:

More information: Scalingo Security

Effective from: 01.06.2018, and will be closed down Q4 2026
​Address: Heroku, Inc., 415 Mission Street, 3rd Floor, c/o Salesforce, San Francisco, CA 94105, USA
​Transfer mechanism: EU-U.S. DPF and EU SCC

Heroku is used for hosting of the platform, not customer data.

Heroku is a US company. Woba uses Heroku’s “Region: EU”, located in Frankfurt, Germany. Amazon Web Services hosts Heroku in the eu-central-1 region.

Heroku’s compliance framework includes:

More information: Heroku Security

Effective from: 01.06.2018
​Address: 1 N Dearborn St, FL 5, Chicago, Illinois 60602-4349, USA
​Location: USA
​Transfer mechanism: EU, EU-U.S. DPF + SCC

ActiveCampaign LLC is an email communication service. ActiveCampaign owns and operates Postmark, a transactional email delivery service, which forms part of the same legal entity. The service is an email provider for sending transactional emails related to Woba’s platform.

This includes:

ActiveCampaign / Postmark supports GDPR, SOC 2 and HIPAA compliance.

More information:

ActiveCampaign Trust Center
​https://www.dataprivacyframework.gov/list

The customer may use certain sub-processors as part of the Woba Services.

OpenAI in Woba is activated unless the customer requests to have it deactivated.

Effective from: 01.02.2024
​Address: 1st Floor, The Liffey Trust Centre, 117–126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland
​Location: Ireland.
​Transfer mechanism: EU/EØS

Provides the underlying language model for Woba's AI functionality, Smart Insights, through a closed API integration in which Woba designs and controls the prompts and the output structure.

Scope of processing:

Smart Insights operates exclusively on aggregated data. Output is generated for an organisational unit only where the number of responses in that unit meets a defined minimum threshold.

No personal data is disclosed to OpenAI, including no directly identifying data and no special categories of personal data under Article 9 of the General Data Protection Regulation.

Output is always presented as group-level themes and never as statements about an identified employee. This applies whether a survey is configured as anonymous or non-anonymous.

Data submitted through the API is not used to train OpenAI's models, in accordance with the applicable provider terms.

OpenAI is listed here as an approved sub-processor and is subject to the same controls and notification terms as Woba's other sub-processors, including risk assessment, a data processing agreement and 30 days' notice of changes.

Woba calls OpenAI's European endpoint, so processing and storage take place within the EEA

OpenAI products are covered in there SOC 2 Type 2 report and have been evaluated by an independent third-party auditor to confirm that our controls align with industry standards for security, confidentiality, privacy and availability. OpenAI products are also ISO 27001, 27017, 27018, and 27701 certified.

More information: Trust Center

LOG:

Date: 06.11.2026

Heroku, Inc. (Salesforce), USA. Used solely for customer environments established before 6 November 2026. Final phase-out on 30 December 2026. Customer environments established on or after 6 November 2026 do not use Heroku.