We keep this list short deliberately. Each subprocessor is bound by data-protection terms, engaged only for the purpose listed, and reviewed before addition. Your workspace records are stored by Supabase in ap-southeast-1 (Singapore); the web tier runs on Vercel in iad1 (US East, Northern Virginia).
Last reviewed: 2026-07-28. This list is reviewed on every vendor change and at least quarterly.
| Vendor | Purpose | Data categories | Region | Documentation |
|---|---|---|---|---|
| Supabase | Database, authentication and file storage: the primary store for workspace data | Workspace content; Account data; Uploaded files; Backups | ap-southeast-1 | supabase.com/privacy |
| Vercel | Application hosting, serverless execution, CDN and edge network | Request metadata; Application and diagnostic logs | iad1 | vercel.com/legal |
| Stripe | Payment processing, billing and payouts | Billing contact details; Subscription and payment status; Card data (held by Stripe, never stored by WorkBOS) | unspecified | stripe.com/privacy |
| Resend | Transactional email delivery | Email address; Message content | unspecified | resend.com/legal |
| OpenAI (default) / customer-configured LLM | AI feature processing for operations you invoke | Workspace content sent for a requested AI operation | unspecified | openai.com/policies/privacy-policy |
| Cloudmersive | Antivirus scanning of uploaded files | File contents at scan time | unspecified | cloudmersive.com/privacy-policy |
“unspecified” means exactly that: the vendor operates in multiple regions and we have not pinned it to one, so we will not state a region we have not verified. Ask us and we will send the vendor’s current regional documentation.
How you are notified when this list changes
Material changes are announced in-product and reflected here with a new review date. If you have executed our Data Processing Addendum, we notify you before a new subprocessor starts processing your data and you have the right to object, as set out in that document. To be added to the notification list, email privacy@workbos.com from your workspace owner account and ask for subprocessor change notices.
Bring-your-own AI
If you configure your own model endpoint (BYO-LLM), that provider processes AI requests under YOUR agreement with them and is not our subprocessor.
Questions
privacy@workbos.com