Skip to content
WorkingClock

Sub-processors

Organizations relying on our Data Processing Agreement are entitled to know which sub-processors handle their data. This is that list.

Last updated: 17 July 2026

What a sub-processor is

A sub-processor is a third party Almaware S.r.l. engages to process personal data on a Controller's behalf under the Data Processing Agreement. We keep this list to what is actually in use — nothing speculative.

Current sub-processors

  • Hosting & infrastructure (application database, cache, object storage, backups) — hosting.almaware.net, Frankfurt, Germany (EU)
  • Payment processing — Stripe, Ireland (EU) / United States — EU Standard Contractual Clauses and the EU-US Data Privacy Framework
  • Transactional email delivery — Amazon Web Services (Amazon SES), eu-west-1, Ireland (EU)
  • Push notifications — Apple Push Notification service (Apple Inc.), Firebase Cloud Messaging (Google LLC), and the Expo push service — United States, where applicable under EU Standard Contractual Clauses and the EU-US Data Privacy Framework
  • Third-party sign-in (authentication only — email and basic profile name) — Google, Apple, Microsoft, and Facebook — United States/multinational, under EU Standard Contractual Clauses and the EU-US Data Privacy Framework where applicable

Payment data

Card details are entered on payment pages hosted by Stripe (Stripe Checkout and the Stripe Customer Portal) and are never transmitted to, processed by, or stored on our servers. Our systems only ever see a Stripe customer/subscription identifier, the plan, the seat count, and invoice metadata such as amount, currency and status. Our card-data environment therefore falls under PCI DSS SAQ A.

First-party processing (not sub-processors)

Product-usage analytics are collected with a self-hosted, cookieless analytics tool running on our own EU infrastructure (covered by "Hosting & infrastructure" above). Because no personal data is shared with a third party, this is first-party processing rather than a sub-processor, and analytics load only where analytics consent has been given.

Notification of changes

Before adding a new sub-processor, we update this page and notify organizations on our Data Processing Agreement at least 30 days in advance, with an opportunity to object on reasonable data-protection grounds, per Article 28 GDPR.

Contact

Questions about sub-processors: support@workingclock.app.