Employment Hero

employmenthero.com

Employment Hero declares 58 subprocessors in its subprocessor list, which we last checked on Nov 11, 2026 (evidence). They include Amazon Web Services, Google Cloud and OpenAI. No published changes since we first read it on Sep 22, 2026. 2 tracked vendors name Employment Hero as a subprocessor, including Data Zoo and Lumify Work.

Subprocessors CSV · Atom DORA draft CSV what's this? · 

58 third parties.

NamePurposeLocationListed since
Abnormal Security
Processing Activity: Threat detection by scanning inbound emails for suspicious activity, phishing, or malware through content and metadata analysis via APIs. GDPR Transfer Mechanism: Adequacy Decision; Security
European Union
Abstract API
Document management; Processing Activity: Identification of geolocation data to enhance location-based services and user experiences. GDPR Transfer Mechanism: Standard Contractual Clauses
USA
Affinda
Data analytics; Processing Activity: User onboarding, engagement, and product experience optimisation through in-app messaging and tutorials. GDPR Transfer Mechanism: Standard Contractual Clauses
USA
Airtable Collaboration; Processing Activity: Collaborative management of structured business data in a cloud database that we sync. GDPR Transfer Mechanism: Adequacy DecisionCanada
Amazon Web Services
Cloud provider; Processing Activity: Cloud service provider used for secure data storage, processing, and hosting infrastructure. GDPR Transfer Mechanism: Standard Contractual Clauses
Australia, Ireland, Canada
Anthropic AI
AI Services; Processing Activity: AI-assisted drafting, analysis, summarisation, workflow support, and coding via the Claude models. Provides AI models in support of our AI/ML-powered features. Data is not used to train Anthropic's AI models under EH's enterprise agreement. GDPR Transfer Mechanism: Standard Contractual Clauses
USA
Appcues
Processing Activity: User onboarding, engagement, and product experience optimisation through in-app messaging and tutorials. GDPR Transfer Mechanism: Standard Contractual Clauses; Product and design
USA
Atlassian
Collaboration; Processing Activity: Comprehensive issue tracking, agile project management, and team collaboration across development and operations teams. GDPR Transfer Mechanism: Standard Contractual Clauses
Australia
Braze
Marketing; Processing Activity: Multi-channel customer engagement services, including personalised messaging and campaign delivery. GDPR Transfer Mechanism: Standard Contractual Clauses
USA
Cloudflare
Cloud Infrastructure; Processing Activity: Content delivery network and web security services providing DDoS protection, DNS resolution, traffic optimisation, and edge caching for EH's web-facing infrastructure. GDPR Transfer Mechanism: Standard Contractual Clauses
USA
Content Snare
Onboarding and Implementation; Processing Activity: Secure collection and storage of customer documents and information during Employment Hero's managed implementation and onboarding, via a client portal where users upload files and complete structured requests. GDPR Transfer Mechanism: Standard Contractual Clauses
Australia, USA
Datadog
Cloud monitoring; Processing Activity: Real-time cloud monitoring and application performance management for infrastructure and application diagnostics. GDPR Transfer Mechanism: Standard Contractual Clauses
USA
dbt Cloud Data analytics; Processing Activity: Transformation and modelling of warehouse data for analytics GDPR Transfer Mechanism: Standard Contractual ClausesAustralia
Delighted Processing Activity: Collection and analysis of customer feedback to measure Net Promoter Score (NPS) GDPR Transfer Mechanism: Standard Contractual Clauses; Product and designUSA
DocuSign
Document management; Processing Activity: Secure e-signature collection and automated document lifecycle management for contracts. GDPR Transfer Mechanism: Standard Contractual Clauses
USA
ElevenLabs AI
AI Voice / Text-to-Speech; Processing Activity: AI-powered text-to-speech voice synthesis used to generate and deliver interviewer voices in AI Video Interview experiences. Processes text input and produces synthetic audio output; may also process any personal data contained in interview script content. GDPR Transfer Mechanism: Standard Contractual Clauses
USA
FiveTran Data storage and processing; Processing Activity: Data Extraction Services from internal source and third party systems GDPR Transfer Mechanism: Standard Contractual ClausesAustralia, Canada, USA
FrankieOne
Processing Activity: ID verification services for compliance with Know Your Customer (KYC) / Know Your Business (KYB) requirements. GDPR Transfer Mechanism: Standard Contractual Clauses; Security
Australia
G2.com
Data analytics; Processing Activity: Online review platform used to collect and manage customer reviews. We may use these platforms to send email invitations to customers to provide a review of our services. GDPR Transfer Mechanism: Standard Contractual Clauses
USA
Gong
Processing Activity: Revenue intelligence platform used to record, transcribe, and analyse sales calls, emails, and customer interactions to support pipeline management, forecasting, and sales coaching. GDPR Transfer Mechanism: Standard Contractual Clauses; Sales Intelligence
USA
Google AI
Processing Activity: Suite of services supporting EH's core business operations, including identity and authentication (Google SSO), email communications (Gmail), file storage and document collaboration (Google Drive, Google Docs/Sheets/Slides), web traffic analysis (Google Analytics), video conferencing (Google Meet), general workspace and productivity tooling, AI-assisted research and knowledge management (NotebookLM), and AI-assisted drafting, analysis and workflow support (Gemini). Data is not used to train Google's AI models under EH's enterprise agreement. GDPR Transfer Mechanism: Standard Contractual Clauses; Productivity, infrastructure & AI services
USA
Google Gemini AI
AI Services; Processing Activity: AI-assisted drafting, analysis, summarisation, and workflow support. Provides AI models in support of our AI/ML-powered features. Data is not used to train Google's AI models under EH's enterprise agreement. GDPR Transfer Mechanism: Standard Contractual Clauses
USA
Hightouch
Data analytics; Processing Activity: Automated syncing of business data from source systems into the data warehouse via Fivetran for analytics and reporting. Syncing data from the warehouse into business applications for activation and operational use. GDPR Transfer Mechanism: Standard Contractual Clauses
Australia
Intercede Solutions
Business process automation and integration platform (e.g., Workato); Processing Activity: Business process automation and integration platform, leveraging the Workato platform to streamline workflows. GDPR Transfer Mechanism: Standard Contractual Clauses
USA
Intercom
Customer support; Processing Activity: Take information/queries from customers, run it through Fin's AI Agent service, potentially also run a RAG against Zendesk's knowledge base, and then deflect or escalate the customer concerns. GDPR Transfer Mechanism: Standard Contractual Clauses
USA
Langchain
Engineering; Processing Activity: Logging and monitoring input/output data in Hero AI, SmartMatch and large language models (LLM) for optimising performance analytics. GDPR Transfer Mechanism: Standard Contractual Clauses
USA
Loggly Cloud monitoring; Processing Activity: Real-time log aggregation and analysis for debugging and operational monitoring. GDPR Transfer Mechanism: Standard Contractual ClausesUSA
Marketo Marketing; Processing Activity: Lead nurturing, email marketing, and comprehensive automation of marketing activities. GDPR Transfer Mechanism: Standard Contractual ClausesUSA
Metabase Data analytics; Processing Activity: Querying and visualisation of company data for insights and reporting GDPR Transfer Mechanism: Standard Contractual ClausesAustralia, Canada
Microsoft
Cloud Infrastructure; Processing Activity: Cloud infrastructure and productivity services including data storage, compute, and collaboration tooling via Microsoft Azure and Microsoft 365. This also includes AI features like Copilot. Personal Data is not used to train Microsoft's AI models under our agreement. GDPR Transfer Mechanism: Standard Contractual Clauses
USA
Mixmax Processing Activity: Automation of email campaigns, scheduling, and tracking for customer engagement. GDPR Transfer Mechanism: Standard Contractual Clauses; SalesUSA
Mixpanel
Data analytics; Processing Activity: Advanced analytics for tracking user interactions and product performance in web and mobile applications. GDPR Transfer Mechanism: Standard Contractual Clauses
USA
Mux
Processing Activity: Recording, processing, and storing candidate introduction videos for seamless job application evaluations. GDPR Transfer Mechanism: Standard Contractual Clauses; Product and design
USA
Nooks
Processing Activity: AI-powered sales dialling platform used to manage outbound calling workflows, automate call queues, and capture call activity data in support of sales development operations. Data is not used to train Nooks' AI models, as EH has opted out. GDPR Transfer Mechanism: Standard Contractual Clauses; Sales Communications
USA
OpenAI AI
IT; Processing Activity: Integration of AI capabilities into product features, including natural language processing and automated content generation. GDPR Transfer Mechanism: Standard Contractual Clauses
USA
OptinMonster
Marketing; Processing Activity: Integration of AI capabilities into product features, including natural language processing and automated content generation. GDPR Transfer Mechanism: Standard Contractual Clauses
USA
Outreach Processing Activity: Customer relationship management for email marketing, lead generation, and sales engagement. GDPR Transfer Mechanism: Standard Contractual Clauses; SalesUSA
Own Backup
Data storage and processing; Processing Activity: Comprehensive backup and recovery solution for relationship management data within Salesforce and other platforms. GDPR Transfer Mechanism: Standard Contractual Clauses
Australia
Ozedi
Processing Activity: SuperStream-compliant messaging and data transmission for superannuation contributions, including secure routing of employer contribution data and payment instructions to superannuation funds. GDPR Transfer Mechanism: Standard Contractual Clauses; Superannuation / Payroll messaging
Australia
Reachdesk Collaboration; Processing Activity: Management and delivery of personalised corporate promotional campaigns. GDPR Transfer Mechanism: Standard Contractual ClausesUSA
Recall.ai
Processing activity: Meeting bot and recording APl used to capture audio, video, transcripts. and metadata from video conferencing platforms, supporting Al-powered meeting notetaking and summarisation features. GDPR Transfer Mechanism: Standard Contractual Clauses
USA
Relevance AI Processing Activity: Deployment of AI agents for business functions, data analysis and customer interactions GDPR Transfer Mechanism: Contractual ClausesAustralia
Salesforce
Processing Activity: Comprehensive customer relationship management (CRM) platform for managing sales, marketing, and customer service. GDPR Transfer Mechanism: Standard Contractual Clauses; Sales
Australia
SendGrid Engineering; Processing Activity: Email delivery service for transactional and marketing communications. GDPR Transfer Mechanism: Standard Contractual ClausesUSA
Shaype
Document management; Processing Activity: Provision of banking infrastructure, including account opening, payments processing, KYC/PEP/sanction checks, and debit card issuance. GDPR Transfer Mechanism: Standard Contractual Clauses
Australia
Sisense Data analytics; Processing Activity: Advanced business intelligence platform for data visualisation and analytics GDPR Transfer Mechanism: Standard Contractual ClausesAustralia, USA
Slack Collaboration; Processing Activity: Real-time messaging and file sharing for team communication and collaboration. GDPR Transfer Mechanism: Standard Contractual ClausesUSA
Snowflake
Analytics and reporting; Processing Activity: Cloud-based SaaS data warehouse used for business intelligence, analytics, reporting, and AI/ML workloads. GDPR Transfer Mechanism: SCCs (Snowflake is a US-headquartered SaaS vendor)
Australia, Canada
Tableau Data analytics; Processing Activity: Visualisation and analysis of business data for reporting and decision-making. GDPR Transfer Mechanism: Standard Contractual ClausesAustralia
Trustpilot
Marketing; Processing Activity: Online review platform used to collect and manage customer reviews. We may use these platforms to send email invitations to customers to provide a review of our services. GDPR Transfer Mechanism: Standard Contractual Clauses
USA
Twilio IT; Processing Activity: Programmable SMS and communication services for customer interactions and notifications. GDPR Transfer Mechanism: Standard Contractual ClausesUSA
Vitally
Customer support; Processing Activity: Customer success platform providing real-time insights and analytics for business intelligence. GDPR Transfer Mechanism: Standard Contractual Clauses
USA
Weavr
Document management; Processing Activity: Embedded finance platform offering payment solutions, virtual accounts, and banking-as-a-service functionality. GDPR Transfer Mechanism: N/A
United Kingdom
Zapier Collaboration; Processing Activity: Workflow automation for connecting and syncing web applications to streamline processes. GDPR Transfer Mechanism: Standard Contractual ClausesUSA
Zendesk Customer support; Processing Activity: Helpdesk and support ticketing system for managing customer service inquiries. GDPR Transfer Mechanism: Standard Contractual ClausesUSA
Zepto
Payment processing; Processing Activity: Real-time account-to-account payment processing, including direct debit, PayTo collections, NPP-based fund disbursements, and payment verification services for superannuation contributions and payroll payments. GDPR Transfer Mechanism: Standard Contractual Clauses
Australia
Zinc
Background Screening; Processing Activity: Pre-employment background screening: processes candidate details submitted on behalf of customer-employers to carry out requested background checks, acting only on Employment Hero's written instructions. GDPR Transfer Mechanism: Standard Contractual Clauses
United Kingdom
ZoomInfo Other; Processing Activity: Business intelligence and B2B contact database for lead generation and marketing. GDPR Transfer Mechanism: Standard Contractual ClausesUSA

Web TechnologiesCSV · Atom

Employment Hero's homepage made 332 requests to 18 domains, and 12 services controlled by another company.

Analytics (3): Cloudflare; reviewed: Mixpanel; usually detected as Analytics: Plausible AnalyticsA/B Testing (2): Webtrends Optimize, OptimizelyTag managers (1): Google CloudMarketing automation (1): OptinMonsterLive chat (1): Qualified.com, Inc.Cookie compliance (1): OneTrustOther (3): usually detected as Issue trackers: Sentry; reviewed as Search engines: Algolia; Video players: Wistia

12 third parties by category: Analytics 3A/B Testing 2Tag managers 1Marketing automation 1Live chat 1Cookie compliance 1Other 3

Third parties 12 · 183 requests
Wistia Wistia 32% of the page's requests 105
Qualified.com, Inc. Qualified 9% of the page's requests 30
OptinMonstersubprocessor OptinMonster 5% of the page's requests 18
OneTrust OneTrust 3% of the page's requests 11
Webtrends Optimize Webtrends Optimize 2% of the page's requests 7
Google Cloudsubprocessor Google Tag Manager <1% of the page's requests 3
Optimizely Optimizely <1% of the page's requests 3
Sentry sentry.io <1% of the page's requests 2
Algolia algolia.net <1% of the page's requests 1
Cloudflaresubprocessor Cloudflare Browser Insights <1% of the page's requests 1
Mixpanelsubprocessor mxpnl.com <1% of the page's requests 1
Plausible Analytics plausible.io <1% of the page's requests 1
First party 1 · 149 requests
Employment Hero Amazon CloudFront Amazon Web Services Employment Hero HSTS HTTP/3 MySQL Nginx Open Graph PHP Plausible RSS React Sentry The SEO Framework WordPress WordPress Block Editor WordPress Site Editor jQuery 3.7.1 jQuery Migrate 3.4.1 styled-components 6.4.4 45% of the page's requests 149

5 tracked companies loaded by the homepage are not in Employment Hero's subprocessor list. A website can use a service without it processing customer data.

Subprocessor of (2)CSV · Atom

2 companies
  • Data Zoo datazoo.com HR Management; Payroll and Employee benefits
  • Lumify Work lumifywork.com Human resources

ComplianceCSV · Atom

Certified
Says it complies with

Certifications as Employment Hero's trust center lists them; reports are usually shared on request (evidence)

Service statusCSV · Atom

Aug 15: no incident reportedAug 16: no incident reportedAug 17: no incident reportedAug 18: 1 incident (1 major)Aug 19: no incident reportedAug 20: no incident reportedAug 21: no incident reportedAug 22: no incident reportedAug 23: no incident reportedAug 24: no incident reportedAug 25: no incident reportedAug 26: no incident reportedAug 27: no incident reportedAug 28: no incident reportedAug 29: no incident reportedAug 30: no incident reportedAug 31: no incident reportedSep 1: 1 incident (1 major)Sep 2: 1 incident (1 no impact stated)Sep 3: no incident reportedSep 4: no incident reportedSep 5: no incident reportedSep 6: no incident reportedSep 7: no incident reportedSep 8: no incident reportedSep 9: no incident reportedSep 10: no incident reportedSep 11: 1 incident (1 major)Sep 12: no incident reportedSep 13: no incident reportedSep 14: no incident reportedSep 15: no incident reportedSep 16: no incident reportedSep 17: no incident reportedSep 18: no incident reportedSep 19: no incident reportedSep 20: no incident reportedSep 21: no incident reportedSep 22: no incident reportedSep 23: no incident reportedSep 24: no incident reportedSep 25: no incident reportedSep 26: no incident reportedSep 27: no incident reportedSep 28: no incident reportedSep 29: no incident reportedSep 30: no incident reportedOct 1: no incident reportedOct 2: no incident reportedOct 3: no incident reportedOct 4: no incident reportedOct 5: no incident reportedOct 6: 1 incident (1 minor)Oct 7: no incident reportedOct 8: no incident reportedOct 9: no incident reportedOct 10: no incident reportedOct 11: no incident reportedOct 12: no incident reportedOct 13: 1 incident (1 major)Oct 14: 1 incident (1 major)Oct 15: no incident reportedOct 16: no incident reportedOct 17: no incident reportedOct 18: no incident reportedOct 19: no incident reportedOct 20: no incident reportedOct 21: no incident reportedOct 22: no incident reportedOct 23: no incident reportedOct 24: no incident reportedOct 25: 1 incident (1 major)Oct 26: no incident reportedOct 27: 2 incidents (1 critical, 1 major)Oct 28: no incident reportedOct 29: no incident reportedOct 30: no incident reportedOct 31: no incident reportedNov 1: no incident reportedNov 2: 1 incident (1 minor)Nov 3: no incident reportedNov 4: no incident reportedNov 5: no incident reportedNov 6: no incident reportedNov 7: no incident reportedNov 8: no incident reportedNov 9: no incident reportedNov 10: no incident reportedNov 11: no incident reportedNov 12: no incident reported

90 days agotoday

  • 11 incidents in 90 days
  • 8 major or critical
  • 2 h 11 min typical time to resolve
  • 3 days longest major
BeganIncidentImpactLasted
Error Saving Management Notesminor2 h 7 min
Users unable to load expense managementmajor21 min
HR Platform currently experience a 504 errorcritical2 h 11 min
Investigating: Issue accessing employee filesmajor4 h 42 min
Users are encountering an error message when submitting timesheets on the Employment Hero Work Appmajor54 min
Users are unable to access expense claims and managementmajor1 h 24 min
Candidates are unable to view/open offer lettersminor3 h 1 min
HR Documents - Optional Clauses are not disappearing from finalised documentsmajor6 h 22 min

Incidents per month

0 4 8 Dec 2025: 4 incidents (1 major, 1 minor, 2 no impact stated) · typical time to resolve 5 h 19 min Jan 2026: 2 incidents (1 major, 1 minor) · typical time to resolve 2 h 49 min Feb 2026: 2 incidents (1 minor, 1 no impact stated) · typical time to resolve 1 h 36 min Mar 2026: 1 incident (1 major) · typical time to resolve 1 h 27 min Apr 2026: 3 incidents (1 major, 2 minor) · typical time to resolve 14 h 3 min May 2026: 2 incidents (1 critical, 1 no impact stated) · typical time to resolve 24 h 45 min Jun 2026: 7 incidents (3 major, 4 minor) · typical time to resolve 2 h 31 min Jul 2026: 2 incidents (2 major) · typical time to resolve 19 h 2 min Aug 2026: 1 incident (1 major) · typical time to resolve 1 h 10 min Sep 2026: 3 incidents (2 major, 1 no impact stated) · typical time to resolve 6 h 22 min Oct 2026: 6 incidents (1 critical, 4 major, 1 minor) · typical time to resolve 2 h 11 min Nov 2026: 1 incident (1 minor) · typical time to resolve 2 h 7 min Dec 2025Jan 2026Feb Mar Apr May Jun Jul Aug Sep Oct Nov

critical major minor no impact stated

Components affected

ComponentIncidents
HR Software10
Create Pay Run1
Time & Attendance1

As Employment Hero's status page reports its own incidents (scheduled maintenance left out), read every few hours since (evidence)

Incidents reported by Employment Hero's subprocessorsCSV · Atom

332 reported incidents in the last 30 days, by 17 of the vendors Employment Hero lists as subprocessors.

A subprocessor list names a company, not the service an incident touched. This does not show that Employment Hero was involved.

DateCompanyIncidentImpactLasted
OpenAIGPT-image-2.5 and 2.6 Sunburst & Flare High error rate minor32 min
SnowflakeINC20000347 minor32 min
Twilio· SendGridMMS Delivery Failures from Twilio to GCI United States minor3 min
Twilio· SendGridSMS Delivery Failures from Twilio 10DLC to AT&T United States minor4 h 3 min
Twilio· SendGridSMS Delivery Failures from Twilio to Orange Sierra Leone minorongoing
Twilio· SendGridSMS Delivery Failures From Long Code Numbers to AT&T in the US minor1 h 19 min
Twilio· SendGridSMS Delivery Delays from Twilio to MTS Kazakhstan minorongoing
Twilio· SendGridSMS Delivery Failures from a Subset of Twilio Phone Numbers to Tcell Tajikistan minorongoing
OpenAIUnable to start new Workspace Agent runs critical9 h 42 min
Twilio· SendGridMMS Delivery Delays from a Subset of Twilio Long Codes to Multiple Small Networks in United States minorongoing
Twilio· SendGridSMS Delivery Failures from a Subset of Twilio Phone Numbers to K-Cell Kazakhstan minor7 h 23 min
OpenAIElevated errors affecting logins, sign-ups, and ChatGPT features minor8 min
Twilio· SendGridVoice Call Failures in JP1 minor3 h 51 min
dbt LabsCloud IDE sessions failed to load no impact stated8 min
Twilio· SendGridSMS Delivery Failures from Twilio to Turkcell Turkey minor3 h 54 min
QualtricsLatency in multiple services in the Japanese region minor53 min
Twilio· SendGridRetroactive Incident Impacting Twilio Usage APIs no impact stated1 min
ElevenLabsScribe v3 Live outage major1 h 53 min
AnthropicElevated errors on Fable 52 and Mythos 52 no impact stated1 min
Twilio· SendGridIssue resolved minor1 h 43 min
Twilio· SendGridSMS Delivery Receipt Delays from Twilio Phone Numbers to Movistar Venezuela minor3 h 26 min
dbt LabsDegraded run performance due to dbt State service disruption no impact stated—
Twilio· SendGridGateway API (Lookup API) Failure Increase on Verizon in United States minor10 h 23 min
OpenAIIncorrect cost data in Costs API exports no impact stated2 h 20 min
OpenAIElevated Errors On API minor42 min

And 307 more. All of them: CSV · Who is around them.

ChangesCSV · Atom

See the list as we read it on any date: Time machine

  1. Changed certification: ISO/IEC 27701 evidence
  2. Added certification: ISO/IEC 42001 evidence
Rating badge for Employment Hero's site

Employment Hero transparency rating

It updates with the rating.

<a href="https://thirdpartyindex.com/vendors/employment-hero"><img src="https://thirdpartyindex.com/badge/employment-hero.svg" alt="Employment Hero transparency rating on Third Party Index" height="20"></a>
[![Employment Hero transparency rating on Third Party Index](https://thirdpartyindex.com/badge/employment-hero.svg)](https://thirdpartyindex.com/vendors/employment-hero)