This page provides information about the sub-processors engaged by Woba in accordance with Woba's Data Processing Agreement to support the delivery of Woba's services and the processing of customers' personal data on behalf of customers.
At the commencement of the Data Processing Agreement, the data controller has approved Woba's use of the sub-processors listed on this page.
Woba will update this page at least 30 days before engaging a new sub-processor or making material changes to the use of an existing sub-processor. Customers who subscribe to updates will be notified by email of changes to this page.
Woba primarily uses sub-processors located in the European Union or European Economic Area. Where Woba uses sub-processors outside the EU/EEA, Woba ensures that an appropriate transfer mechanism is in place, such as an adequacy decision, the EU-U.S. Data Privacy Framework, Standard Contractual Clauses, or another valid transfer mechanism under applicable data protection law.
Information about the EU-U.S. Data Privacy Framework is available at dataprivacyframework.gov.
Minimum sub-processors
The following sub-processors are used as part of Woba’s core service delivery.
AIVEN OY
Effective from: 01.03.2018
Address: Antinkatu 1, 6th floor, 00100 Helsinki, Finland
Transfer mechanism: EU SCC
Purpose
Aiven is used for hosting and operation of Woba’s production database, including managed database infrastructure, backup and restore functionality where applicable.
Location and hosting
Aiven Oy is a Finnish Database-as-a-Service provider. Woba’s database hosted by Aiven runs on infrastructure provided by UpCloud, also a Finnish company, with the relevant hosting location in Frankfurt, Germany.
Compliance and security
Aiven’s services are ISO 27000-series, GDPR, CCPA, HIPAA and PCI-DSS compliant. Aiven also provides ISAE 3000 / SOC 2 Type II reports.
Technical and security features include:
ISAE 3000
ISO 27K
GDPR
CCPA
HIPAA
PCI DSS
Automated security updates
Annual security testing
More information: Aiven Security
Scalingo SAS
Effective from: 01.11.2024
Address: 13 rue Jacques Peirotes, 67000 Strasbourg, France
Company registration: SIRET 80866548300018
Transfer mechanism: EU SCC
Purpose
Scalingo is a French cloud Platform-as-a-Service (PaaS) provider headquartered in France, engaged as a sub-processor for the hosting and operation of Woba's application servers. The processing carried out by Scalingo consists solely of infrastructure hosting; Scalingo does not have independent access to, or control over, the personal data processed through the Woba platform.
Location and hosting
All data is hosted exclusively in France through Scalingo's infrastructure partner 3DS OUTSCALE, a cloud subsidiary of Dassault Systèmes SE.
Compliance and security
Scalingo’s compliance and security framework includes:
ISO 27001
HDS Certification
More information: Scalingo Security
ActiveCampaign LLC
Effective from: 01.06.2018
Address: 1 N Dearborn St, FL 5, Chicago, Illinois 60602-4349, USA
Location: USA
Transfer mechanism: EU-U.S. DPF and EU SCC
Purpose
ActiveCampaign LLC is an email communication service. ActiveCampaign owns and operates Postmark, a transactional email delivery service, which forms part of the same legal entity. The service is an email provider for sending transactional emails related to Woba’s platform.
This includes:
Invitations
Sign-up emails
Login-related emails
Other system-generated notifications
Compliance and security
ActiveCampaign / Postmark supports GDPR, SOC 2 and HIPAA compliance.
More information:
ActiveCampaign Trust Center
https://www.dataprivacyframework.gov/list
Modular sub-processors
The customer may use certain sub-processors as part of the Woba Services.
OpenAI in Woba is activated unless the customer requests to have it deactivated.
Open AI Ireland Ltd
Effective from: 01.02.2024
Address: 1st Floor, The Liffey Trust Centre, 117–126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland
Location: Ireland
Transfer mechanism: EU SCC
Purpose
OpenAI is used as an AI service provider through an approved API integration.
Woba anonymises survey questions and answers before data is submitted to OpenAI.
Where the data submitted to OpenAI is fully anonymised and cannot reasonably be linked to an identifiable person, the data does not constitute personal data under GDPR. In such cases, OpenAI does not act as a sub-processor for that specific processing activity.
Location and hosting
Ireland
Compliance and security
OpenAI products are covered in there SOC 2 Type 2 report and have been evaluated by an independent third-party auditor to confirm that our controls align with industry standards for security, confidentiality, privacy and availability. OpenAI products are also ISO 27001, 27017, 27018, and 27701 certified.
More information: Trust Center
LOG:
Date: 06.11.2026
Heroku, Inc. (Salesforce), USA. Used solely for customer environments established before 6 November 2026. Final phase-out on 30 December 2026. Customer environments established on or after 6 November 2026 do not use Heroku.