Employment Hero
Transparency
Breakdown
| Subprocessor list | 30 / 30 | |
| Processing locations | 8 / 8 | |
| Purposes | 7 / 7 | |
| Data processing addendum | 12 / 12 | |
| Trust center | 8 / 8 | |
| Privacy policy | 6 / 6 | |
| security.txt | 6 / 6 | |
| Security page | not found | 0 / 5 |
| Status page | 5 / 5 | |
| Vulnerability disclosure | not found | 0 / 5 |
| Pages still reachable | 8 / 8 | |
| Total | 90 / 100 |
Only documents we can retrieve count: a page behind a login or a broken link scores nothing.
Badge
For Employment Hero's own site; it updates with the rating.
<a href="https://thirdpartyindex.com/vendors/employment-hero"><img src="https://thirdpartyindex.com/badge/employment-hero.svg" alt="Employment Hero transparency rating on Third Party Index" height="20"></a>[](https://thirdpartyindex.com/vendors/employment-hero)Documents
| Document | Verified | Changed | Evidence |
|---|---|---|---|
| Trust center vanta | snapshot | ||
| Subprocessor list vanta | snapshot | ||
| Data processing addendum | snapshot | ||
| Privacy policy | snapshot | ||
| Terms | snapshot | ||
| security.txt | snapshot | ||
| Status page statuspage | snapshot |
Subprocessors
| Name | Purpose | Location | Listed since |
|---|---|---|---|
| Abnormal Security | Processing Activity: Threat detection by scanning inbound emails for suspicious activity, phishing, or malware through content and metadata analysis via APIs. GDPR Transfer Mechanism: Adequacy Decision; Security | European Union | |
| Abstract API | Document management; Processing Activity: Identification of geolocation data to enhance location-based services and user experiences. GDPR Transfer Mechanism: Standard Contractual Clauses | USA | |
| Affinda | Data analytics; Processing Activity: User onboarding, engagement, and product experience optimisation through in-app messaging and tutorials. GDPR Transfer Mechanism: Standard Contractual Clauses | USA | |
| Airtable | Collaboration; Processing Activity: Collaborative management of structured business data in a cloud database that we sync. GDPR Transfer Mechanism: Adequacy Decision | Canada | |
| Amazon Web Services | Cloud provider; Processing Activity: Cloud service provider used for secure data storage, processing, and hosting infrastructure. GDPR Transfer Mechanism: Standard Contractual Clauses | Australia, Ireland, Canada | |
| Anthropic | AI Services; Processing Activity: AI-assisted drafting, analysis, summarisation, workflow support, and coding via the Claude models. Provides AI models in support of our AI/ML-powered features. Data is not used to train Anthropic's AI models under EH's enterprise agreement. GDPR Transfer Mechanism: Standard Contractual Clauses | USA | |
| Appcues | Processing Activity: User onboarding, engagement, and product experience optimisation through in-app messaging and tutorials. GDPR Transfer Mechanism: Standard Contractual Clauses; Product and design | USA | |
| Atlassian | Collaboration; Processing Activity: Comprehensive issue tracking, agile project management, and team collaboration across development and operations teams. GDPR Transfer Mechanism: Standard Contractual Clauses | Australia | |
| Braze | Marketing; Processing Activity: Multi-channel customer engagement services, including personalised messaging and campaign delivery. GDPR Transfer Mechanism: Standard Contractual Clauses | USA | |
| Cloudflare | Cloud Infrastructure; Processing Activity: Content delivery network and web security services providing DDoS protection, DNS resolution, traffic optimisation, and edge caching for EH's web-facing infrastructure. GDPR Transfer Mechanism: Standard Contractual Clauses | USA | |
| Content Snare | Onboarding and Implementation; Processing Activity: Secure collection and storage of customer documents and information during Employment Hero's managed implementation and onboarding, via a client portal where users upload files and complete structured requests. GDPR Transfer Mechanism: Standard Contractual Clauses | Australia, USA | |
| Datadog | Cloud monitoring; Processing Activity: Real-time cloud monitoring and application performance management for infrastructure and application diagnostics. GDPR Transfer Mechanism: Standard Contractual Clauses | USA | |
| dbt Cloud | Data analytics; Processing Activity: Transformation and modelling of warehouse data for analytics GDPR Transfer Mechanism: Standard Contractual Clauses | Australia | |
| Delighted | Processing Activity: Collection and analysis of customer feedback to measure Net Promoter Score (NPS) GDPR Transfer Mechanism: Standard Contractual Clauses; Product and design | USA | |
| DocuSign | Document management; Processing Activity: Secure e-signature collection and automated document lifecycle management for contracts. GDPR Transfer Mechanism: Standard Contractual Clauses | USA | |
| ElevenLabs | AI Voice / Text-to-Speech; Processing Activity: AI-powered text-to-speech voice synthesis used to generate and deliver interviewer voices in AI Video Interview experiences. Processes text input and produces synthetic audio output; may also process any personal data contained in interview script content. GDPR Transfer Mechanism: Standard Contractual Clauses | USA | |
| FiveTran | Data storage and processing; Processing Activity: Data Extraction Services from internal source and third party systems GDPR Transfer Mechanism: Standard Contractual Clauses | Australia, Canada, USA | |
| FrankieOne | Processing Activity: ID verification services for compliance with Know Your Customer (KYC) / Know Your Business (KYB) requirements. GDPR Transfer Mechanism: Standard Contractual Clauses; Security | Australia | |
| G2.com | Data analytics; Processing Activity: Online review platform used to collect and manage customer reviews. We may use these platforms to send email invitations to customers to provide a review of our services. GDPR Transfer Mechanism: Standard Contractual Clauses | USA | |
| Gong | Processing Activity: Revenue intelligence platform used to record, transcribe, and analyse sales calls, emails, and customer interactions to support pipeline management, forecasting, and sales coaching. GDPR Transfer Mechanism: Standard Contractual Clauses; Sales Intelligence | USA | |
| Processing Activity: Suite of services supporting EH's core business operations, including identity and authentication (Google SSO), email communications (Gmail), file storage and document collaboration (Google Drive, Google Docs/Sheets/Slides), web traffic analysis (Google Analytics), video conferencing (Google Meet), general workspace and productivity tooling, AI-assisted research and knowledge management (NotebookLM), and AI-assisted drafting, analysis and workflow support (Gemini). Data is not used to train Google's AI models under EH's enterprise agreement. GDPR Transfer Mechanism: Standard Contractual Clauses; Productivity, infrastructure & AI services | USA | ||
| Google Gemini | AI Services; Processing Activity: AI-assisted drafting, analysis, summarisation, and workflow support. Provides AI models in support of our AI/ML-powered features. Data is not used to train Google's AI models under EH's enterprise agreement. GDPR Transfer Mechanism: Standard Contractual Clauses | USA | |
| Hightouch | Data analytics; Processing Activity: Automated syncing of business data from source systems into the data warehouse via Fivetran for analytics and reporting. Syncing data from the warehouse into business applications for activation and operational use. GDPR Transfer Mechanism: Standard Contractual Clauses | Australia | |
| Intercede Solutions | Business process automation and integration platform (e.g., Workato); Processing Activity: Business process automation and integration platform, leveraging the Workato platform to streamline workflows. GDPR Transfer Mechanism: Standard Contractual Clauses | USA | |
| Intercom | Customer support; Processing Activity: Take information/queries from customers, run it through Fin's AI Agent service, potentially also run a RAG against Zendesk's knowledge base, and then deflect or escalate the customer concerns. GDPR Transfer Mechanism: Standard Contractual Clauses | USA | |
| Langchain | Engineering; Processing Activity: Logging and monitoring input/output data in Hero AI, SmartMatch and large language models (LLM) for optimising performance analytics. GDPR Transfer Mechanism: Standard Contractual Clauses | USA | |
| Loggly | Cloud monitoring; Processing Activity: Real-time log aggregation and analysis for debugging and operational monitoring. GDPR Transfer Mechanism: Standard Contractual Clauses | USA | |
| Marketo | Marketing; Processing Activity: Lead nurturing, email marketing, and comprehensive automation of marketing activities. GDPR Transfer Mechanism: Standard Contractual Clauses | USA | |
| Metabase | Data analytics; Processing Activity: Querying and visualisation of company data for insights and reporting GDPR Transfer Mechanism: Standard Contractual Clauses | Australia, Canada | |
| Microsoft | Cloud Infrastructure; Processing Activity: Cloud infrastructure and productivity services including data storage, compute, and collaboration tooling via Microsoft Azure and Microsoft 365. This also includes AI features like Copilot. Personal Data is not used to train Microsoft's AI models under our agreement. GDPR Transfer Mechanism: Standard Contractual Clauses | USA | |
| Mixmax | Processing Activity: Automation of email campaigns, scheduling, and tracking for customer engagement. GDPR Transfer Mechanism: Standard Contractual Clauses; Sales | USA | |
| Mixpanel | Data analytics; Processing Activity: Advanced analytics for tracking user interactions and product performance in web and mobile applications. GDPR Transfer Mechanism: Standard Contractual Clauses | USA | |
| Mux | Processing Activity: Recording, processing, and storing candidate introduction videos for seamless job application evaluations. GDPR Transfer Mechanism: Standard Contractual Clauses; Product and design | USA | |
| Nooks | Processing Activity: AI-powered sales dialling platform used to manage outbound calling workflows, automate call queues, and capture call activity data in support of sales development operations. Personal Data is not used to train Microsoft's AI models under our agreement. GDPR Transfer Mechanism: Standard Contractual Clauses; Sales Communications | USA | |
| OpenAI | IT; Processing Activity: Integration of AI capabilities into product features, including natural language processing and automated content generation. GDPR Transfer Mechanism: Standard Contractual Clauses | USA | |
| OptinMonster | Marketing; Processing Activity: Integration of AI capabilities into product features, including natural language processing and automated content generation. GDPR Transfer Mechanism: Standard Contractual Clauses | USA | |
| Outreach | Processing Activity: Customer relationship management for email marketing, lead generation, and sales engagement. GDPR Transfer Mechanism: Standard Contractual Clauses; Sales | USA | |
| Own Backup | Data storage and processing; Processing Activity: Comprehensive backup and recovery solution for relationship management data within Salesforce and other platforms. GDPR Transfer Mechanism: Standard Contractual Clauses | Australia | |
| Ozedi | Processing Activity: SuperStream-compliant messaging and data transmission for superannuation contributions, including secure routing of employer contribution data and payment instructions to superannuation funds. GDPR Transfer Mechanism: Standard Contractual Clauses; Superannuation / Payroll messaging | Australia | |
| Reachdesk | Collaboration; Processing Activity: Management and delivery of personalised corporate promotional campaigns. GDPR Transfer Mechanism: Standard Contractual Clauses | USA | |
| Recall.ai | Processing activity: Meeting bot and recording APl used to capture audio, video, transcripts. and metadata from video conferencing platforms, supporting Al-powered meeting notetaking and summarisation features. GDPR Transfer Mechanism: Standard Contractual Clauses | USA | |
| Relevance AI | Processing Activity: Deployment of AI agents for business functions, data analysis and customer interactions GDPR Transfer Mechanism: Contractual Clauses | Australia | |
| Salesforce | Processing Activity: Comprehensive customer relationship management (CRM) platform for managing sales, marketing, and customer service. GDPR Transfer Mechanism: Standard Contractual Clauses; Sales | Australia | |
| SendGrid | Engineering; Processing Activity: Email delivery service for transactional and marketing communications. GDPR Transfer Mechanism: Standard Contractual Clauses | USA | |
| Shaype | Document management; Processing Activity: Provision of banking infrastructure, including account opening, payments processing, KYC/PEP/sanction checks, and debit card issuance. GDPR Transfer Mechanism: Standard Contractual Clauses | Australia | |
| Sisense | Data analytics; Processing Activity: Advanced business intelligence platform for data visualisation and analytics GDPR Transfer Mechanism: Standard Contractual Clauses | Australia, USA | |
| Slack | Collaboration; Processing Activity: Real-time messaging and file sharing for team communication and collaboration. GDPR Transfer Mechanism: Standard Contractual Clauses | USA | |
| Snowflake | Analytics and reporting; Processing Activity: Cloud-based SaaS data warehouse used for business intelligence, analytics, reporting, and AI/ML workloads. GDPR Transfer Mechanism: SCCs (Snowflake is a US-headquartered SaaS vendor) | Australia, Canada | |
| Tableau | Data analytics; Processing Activity: Visualisation and analysis of business data for reporting and decision-making. GDPR Transfer Mechanism: Standard Contractual Clauses | Australia | |
| Trustpilot | Marketing; Processing Activity: Online review platform used to collect and manage customer reviews. We may use these platforms to send email invitations to customers to provide a review of our services. GDPR Transfer Mechanism: Standard Contractual Clauses | USA | |
| Twilio | IT; Processing Activity: Programmable SMS and communication services for customer interactions and notifications. GDPR Transfer Mechanism: Standard Contractual Clauses | USA | |
| Vitally | Customer support; Processing Activity: Customer success platform providing real-time insights and analytics for business intelligence. GDPR Transfer Mechanism: Standard Contractual Clauses | USA | |
| Weavr | Document management; Processing Activity: Embedded finance platform offering payment solutions, virtual accounts, and banking-as-a-service functionality. GDPR Transfer Mechanism: N/A | United Kingdom | |
| Zapier | Collaboration; Processing Activity: Workflow automation for connecting and syncing web applications to streamline processes. GDPR Transfer Mechanism: Standard Contractual Clauses | USA | |
| Zendesk | Customer support; Processing Activity: Helpdesk and support ticketing system for managing customer service inquiries. GDPR Transfer Mechanism: Standard Contractual Clauses | USA | |
| Zepto | Payment processing; Processing Activity: Real-time account-to-account payment processing, including direct debit, PayTo collections, NPP-based fund disbursements, and payment verification services for superannuation contributions and payroll payments. GDPR Transfer Mechanism: Standard Contractual Clauses | Australia | |
| ZoomInfo | Other; Processing Activity: Business intelligence and B2B contact database for lead generation and marketing. GDPR Transfer Mechanism: Standard Contractual Clauses | USA |
Listed as a subprocessor by (1)
Purposes as each company states them.
Data Zoo datazoo.com HR Management; Payroll and Employee benefits
Changes
None since tracking began.