── Legal · Sub Processors

AugWork Sub-Processors.

Every third-party vendor that processes customer data on AugWork's behalf, what they process, where they're located, and which certifications they hold. Updated whenever a sub-processor is added, removed, or materially changed.

Effective date: May 20, 2026 · Last updated: May 25, 2026

This page is referenced by our Privacy Policy and is updated whenever a sub-processor is added, removed, or materially changed.

What is a sub-processor

A sub-processor is a third-party vendor that processes customer data on AugWork's behalf to help us deliver the service. Sub-processors are bound by contract to handle data with the same level of care that AugWork commits to in our Privacy Policy.

How we choose sub-processors

Every sub-processor on this list is reviewed for security posture (SOC 2 Type II, ISO 27001, or equivalent), data handling practices, and contractual ability to support GDPR-style data protection terms. We prefer vendors with US data residency and independent third-party audits.

Notification of changes

When we plan to add a new sub-processor that will have access to customer content, we will notify every customer by email at least 30 days before the change takes effect. Notifications go to the customer's designated compliance contact, with a fallback to the primary account owner if no compliance contact is set. If a customer objects to the new sub-processor, they can cancel before the effective date.

Customers can add additional email addresses to receive sub-processor change notifications in the admin console under Settings → Notifications → Sub-processor Updates.

Current sub-processors

Core infrastructure

Sub-processor	Service	Customer data handled	Region	Certifications
Vultr (Vultr USA Inc.)	Cloud hosting for each customer's dedicated AugWork environment	All customer content, encrypted at rest with AES-256-GCM under per-row keys	United States	SOC 2 Type II
Cloudflare (Cloudflare Inc.)	DNS, web application firewall, DDoS protection, CDN	All inbound HTTPS traffic and metadata; no persistent content storage	Global edge network	SOC 2 Type II, ISO 27001

AI model providers

By default, AugWork leverages open source models hosted on Together.AI. Customers can opt in to additional proprietary providers on a per-AI-Employee or per-task basis. Data leaves the customer's environment only when an opt-in setting is active.

Sub-processor	Service	Customer data handled	Region	Certifications
Together.AI	Hosting for the open source models AugWork uses by default	Inputs and outputs of AI Employee tasks using the default models	United States	SOC 2 Type II
Anthropic (Anthropic, PBC)	LLM provider, opt-in per AI Employee or per task	Inputs and outputs of the opted-in task	United States	SOC 2 Type II
OpenAI (OpenAI, L.L.C.)	LLM provider, opt-in per AI Employee or per task	Inputs and outputs of the opted-in task	United States	SOC 2 Type II
Google (Gemini, Google LLC)	LLM provider, opt-in per AI Employee or per task	Inputs and outputs of the opted-in task	United States	SOC 2 Type II, ISO 27001
xAI (X.AI Corp.)	LLM provider, opt-in per AI Employee or per task	Inputs and outputs of the opted-in task	United States	SOC 2 Type II

Communications

Sub-processor	Service	Customer data handled	Region	Certifications
Postmark (ActiveCampaign)	Transactional email delivery	Email contents and recipient addresses for product notifications	United States	SOC 2 Type II
Twilio (Twilio Inc.)	SMS and voice for AI Employees	Phone numbers and message contents for AI Employee communications	United States	SOC 2 Type II, ISO 27001
ElevenLabs (ElevenLabs Inc.)	Voice synthesis for AI Employees	Text inputs converted to voice output	United States	SOC 2 Type II
Apple Push Notification service (Apple Inc.)	iOS push notifications	Notification payloads (title and body only)	United States	Platform service
Google Firebase Cloud Messaging (Google LLC)	Android push notifications	Notification payloads (title and body only)	United States	Platform service

Automation and tooling

Sub-processor	Service	Customer data handled	Region	Certifications
Browserbase (Browserbase Inc.)	Managed browser automation for AI Employees	Browser session content when an AI Employee runs a browser-based task	United States	SOC 2 Type II, GDPR-compliant

Monitoring and operations

Sub-processor	Service	Customer data handled	Region	Certifications
Sentry (Functional Software Inc.)	Error and performance monitoring	Error stack traces, request metadata, occasional content fragments when errors occur	United States	SOC 2 Type II
BetterStack (BetterStack Ltd.)	Uptime monitoring	Endpoint health checks only; no customer content	European Union	SOC 2 Type II

Payments

Sub-processor	Service	Customer data handled	Region	Certifications
Stripe (Stripe Inc.)	Payment processing	Billing contact information, subscription details, payment card data (handled directly by Stripe; AugWork does not store full card numbers)	United States	SOC 2 Type II, PCI DSS Level 1

Change history

Date	Change
May 25, 2026	Initial publication.

Contact

Questions about a specific sub-processor, or requests for additional documentation (security questionnaires, vendor agreements, sub-processor DPAs) can be sent to privacy@augwork.ai.

── How to make AI business-outcome driven

Let's schedule an AugWork Value Assessment.

A 30 to 60 minute working session on turning AI into real, measurable business outcomes for your company. Bring 1 to 2 stuck functions. We bring an industry-tuned playbook, a sample org chart, sizing, and a P&L-ready number you can take to your CFO. No charge, no obligation.

Book a Value Assessment See pricing →