Subprocessor list
This page provides information about the subprocessors that Culture Amp has engaged in accordance with the Culture Amp Data Processing Addendum. As Culture Amp’s Services continue to evolve, our subprocessors may change.
| Company name | Registered office | Contact details | Nature of Processing | Data storage location | Data protection mechanisms |
|---|---|---|---|---|---|
| Atlassian Pty Ltd | USA | privacy@atlassian.com | Atlassian provides project management and collaboration tools used by Culture Amp including Confluence, Jira and Trello. | USA | GDPR DPA and SCCs in place. View privacy policy |
| Amazon Web Services Inc. | USA | Attention: General Counsel 410 Terry Avenue North Seattle, WA. | Amazon Web Services is an Infrastructure-as-a-Service provider, used to host the Culture Amp platform. | USA, Ireland, or Australia | GDPR DPA and SCCs in place. View privacy policy |
| Bugsnag Inc. | USA | privacy@bugsnag.com | Bugsnag is a stability monitoring solution which captures unhandled exceptions, diagnostic data, and version information in browser, mobile and server-side applications via open source SDKs for 50+ software platforms.
All PII fields collected by Culture Amp may be captured and processed by Bugsnag for the use of Culture Amp engineers to diagnose and fix errors. |
USA, EEA | GDPR DPA and SCCs in place. View privacy policy |
| Datadog Inc. | USA | gdpr@datadoghq.com | Datadog is a monitoring and analytics tool for information technology (IT) and DevOps teams that can be used to determine performance metrics as well as event monitoring for infrastructure and cloud services. The software can monitor services such as servers, databases and tools.
All PII fields collected by Culture Amp may be captured and processed by DataDog for the use of Culture Amp engineers to diagnose and fix errors. |
USA | GDPR DPA and SCCs in place. View privacy policy |
| dbt Labs, Inc. (Fishtown Analytics Inc.) | USA | privacy@dbtlabs.com | dbt Labs enables our data analysts and engineers to prepare and transform data in our warehouse for analysis in business intelligence tools. | USA | GDPR DPA and SCCs in place. View privacy policy |
| Fivetran Inc. | USA | privacy@fivetran.com | Fivetran is an ETL (extract, transform, load) tool used to replicate certain data from SaaS tools into a data warehouse for additional analysis. | USA | GDPR DPA and SCCs in place. View privacy policy |
| Functional Software Inc. | USA | security@sentry.io | Sentry is an error monitoring tool. They also provide performance monitoring software. Their platform helps every developer diagnose, fix, and optimize the performance of their code.
All PII fields collected by Culture Amp may be captured and processed by DataDog for the use of Culture Amp engineers to diagnose and fix errors. |
USA, EEA | GDPR DPA and SCCs in place. View privacy policy |
| Glean Technologies Inc. | USA | privacy@glean.com | Glean is an AI-powered SaaS tool that integrates with various data sources and uses machine learning to analyze, interpret, and surface information to end users. Tailored specifically for Culture Amp, it ingests information from numerous corporate data repositories, making them searchable and providing accurate and relevant answers to questions about corporate data and the internet via a familiar ChatGPT-style interface. | USA | GDPR DPA and SCCs in place. View privacy policy |
| Gong Inc. | USA | privacy@gong.io | Gong is an AI bot that joins customer facing Zoom conversations. It is able to transcribe and annotate conversations to help customer facing teams review calls, assist sales coaching and provide intelligence to businesses based on customer facing conversations. | USA | GDPR DPA and SCCs in place. View privacy policy |
| Google Inc. | USA | https://support.google.com | Google is Culture Amp's email and translation services provider. If a customer emails a Culture Amp domain email address, the content of the messages will go to Google. Culture Amp also leverages Google data analytics and services as a translation provider.
In addition, Google Drive and Sheets are used by analytics and data science teams to produce benchmarks, conduct research for product improvement, and perform ad-hoc analysis on customer data. Personal information fields collected by Culture Amp may be stored in Google Drive or Sheets to assist in this analysis and research. |
USA, Chile, Taiwan, Singapore, Ireland, Netherlands, Finland, Belgium | GDPR DPA and SCCs in place. View privacy policy |
| Intercom Inc. | USA | team@intercom.com | Intercom has access to high level account information (i.e. account name and number of users) as well as high level information about administrators authenticated to the platform (i.e. name, email, last login time and last report reviewed). Intercom is used for in-app messaging and analytics within the Culture Amp platform. Culture Amp sends messages to administrators about product improvements and service status from time to time. | USA | GDPR DPA and SCCs in place. View privacy policy |
| Merge API, Inc. | USA | hello@merge.dev | Merge provides integrations to multiple HRIS providers. It enables Culture Amp customers to integrate with their chosen HRIS provider where Culture Amp does not have a native integration. Customer’s employee data is pulled in using a common format from Customer HRIS tools to the Culture Amp platform via Merge. | USA | GDPR DPA and SCCs in place. View privacy policy |
| MongoDB Inc. | USA | info@mongodb.com | MongoDB is a database technology provider. It collects most PII fields collected by Culture Amp in relation regard to our Engagement product. Demographics, surveys, responses and comments are all stored in the databases managed by MongoDB. | USA | GDPR DPA and SCCs in place. View privacy policy |
| Netskope, Inc. | USA | privacy@netskope.com | Netskope is a data loss prevention and web security tooling integrated with Culture Amp platforms and devices to prevent data leakage. | USA | GDPR DPA and SCCs in place. View privacy policy |
| Proofpoint Inc. | USA | privacy@proofpoint.com | ProofPoint is an email security platform which scans all emails sent or received by a Culture Amp email address. The content of these messages and any attachments are scanned for malicious links, malicious code, or suspicious text and a copy of an email may be retained in the ProofPoint platform if it is suspected to be malicious. | USA | GDPR DPA and SCCs in place. View privacy policy |
| Salesforce, Inc. | USA | privacy@salesforce.com | Customer Relationship Management (CRM) platform that records and stores commercial information and interactions with our customers throughout the customer lifecycle. | USA | GDPR DPA and SCCs in place. View privacy policy |
| Skilljar Inc. | USA | https://www.skilljar.com/privacy/ | Skilljar uses SSO login for some customers to validate what course content they can access on our customer training site. Skilljar stores name, email, company, and role type (admin, manager, other). | USA | GDPR DPA and SCCs in place. View privacy policy |
| Temporal Technologies, Inc. | USA | https://pages.temporal.io/contact-us | Temporal provides background task processing for jobs that run on a schedule or other triggers (e.g. send email when the survey opens to all participants). | USA | GDPR DPA and SCCs in place. View privacy policy |
| Twilio Inc. | USA | privacy@twilio.com | Twilio is a cloud-based communications platform that enables Culture Amp to deliver automated messages and notifications via SMS and email. The platform facilitates secure and reliable communication between our team and customers. | USA | GDPR DPA and SCCs in place. View privacy policy |
| Vitally Inc. | USA | privacy@vitally.io | Vitally stores all core customer data in one place - email communication, platform usage, and commercial data. Vitally can read all emails for users with Gmail connected, including sensitive PII. | USA | GDPR DPA and SCCs in place. View privacy policy |
| Zendesk Inc. | USA | privacy@zendesk.com | Zendesk is a Customer Service Quality Assurance Tool that Culture Amp Support leverages to review chats and emails that customers initiate with our team. Contents of the messages are retained in the Klaus platform, however all names and email addresses are masked. | EEA | GDPR DPA and SCCs in place. View privacy policy |
| FustionAuth, Inc. | USA | privacy@fusionauth.io | FusionAuth is a Customer Identity and Access Management platform, which we use for standards-based authentication, identity providers, and API token management. It has basic data about employees including their identity information and employment information. | EEA, APAC and USA | GDPR DPA and SCCs in place. View privacy policy |
| Anthropic | USA | support@anthropic.com | Anthropic is a AI provider that develops and operates large language model AI systems, including the Claude family of AI assistants. Anthropic provides AI inference services via its API, processing text inputs through its language models to generate responses. | USA | GDPR DPA and SCCs in place. View privacy policy |
| ClickHouse, Inc. | USA | privacy@clickhouse.com | ClickHouse is an analytical database provider used to power product reporting and insights features. It stores survey responses, performance data, and employee data records to enable real-time analytics queries. | EEA, APAC and USA | GDPR DPA and SCCs in place. View privacy policy |
| Splunk, Inc. | USA | support@splunk.com | Splunk is a security information and event management (SIEM) and analytics platform used to collect, index, search, monitor, and analyse security and operational event data. Splunk Enterprise Security provides additional security monitoring, correlation, alerting, and investigation capabilities to support threat detection, incident response, and security operations.
All PII fields collected by Culture Amp may be captured and processed by Splunk for the purposes of security monitoring, threat detection, investigation, incident response, and maintaining the security of Culture Amp systems. |
Ireland | GDPR DPA and SCCs in place. View privacy policy |
| ElevenLabs, Inc. | USA | legal@elevenlabs.io | ElevenLabs provides transcription and speach generation services. We use this service to provide dictation and voice capability to features like AI Coach. We use Zero Rentention Mode, so all voice data is processed emphemorally (no storage or training is allowed). The dictaion and voice capability is not core to the platform. Users can choose not to use the services. | USA | GDPR DPA and SCCs in place. View privacy policy |
| DealHub, Inc. | USA | support@dealhub.io | DealHub CPQ is a configure, price, quote platform that streamlines the B2B sales cycle by generating accurate quotes, automating approval workflows, and managing contract terms. Through its seamless integration with Salesforce, it synchronizes live customer and product data, ensuring sales pipelines and financial records remain aligned in real time. Ultimately, this software acts as a subprocessor by capturing and processing customer order data, contract details, and pricing structures during the deal-closing process. | USA | GDPR DPA and SCCs in place. View privacy policy |
| Docusign, Inc. | USA | privacy@docusign.com | Document storage of customer contracts (e.g. General Terms, DPA+SCCs). | USA | GDPR DPA and SCCs in place. View privacy policy |
| Pendo.io, Inc. | USA | pendo@gdpr-rep.com | Pendo processes customer feedback and user research data, including survey responses, interview notes, support interactions, feature requests, and other product feedback submitted by authorized users. The service uses artificial intelligence and machine learning technologies to analyze unstructured text, identify themes and trends, generate summaries, categorize feedback, and provide insights to support product discovery and decision-making. Processing activities may include the collection, storage, organization, aggregation, analysis, summarization, classification, and retrieval of feedback data. AI models may be used to generate insights, recommendations, topic clustering, sentiment analysis, and natural language summaries based on the information provided by users. |
USA | GDPR DPA and SCCs in place. View privacy policy |
Culture Amp Entities
These Culture Amp entities may also act as subprocessors, and help to provide Culture Amp services and support to Customers:
| Company name | Location |
|---|---|
| Culture Amp, Inc. | USA |
| Culture Amp Limited | United Kingdom |
| Culture Amp Pty Ltd | Australia |
| Culture Amp GmbH | Germany |
| Culture Lake | USA |