This page lists the third-party service providers (“sub-processors”) that Taskworld engages to operate Ongo Audit, including each sub-processor’s purpose and the region(s) where it processes Customer Personal Data. It is incorporated by reference into the Privacy Policy, the Security page, and the Data Processing Addendum.
This page is the single source of truth for our sub-processor list. The other legal documents reference this page rather than duplicating it.
Current sub-processors
| Sub-processor | Purpose | Region of processing |
|---|---|---|
| Amazon Web Services, Inc. | Cloud hosting, object storage, compute, KMS, and operational logs | Singapore (primary), with limited replication or processing in other AWS regions where required for backup or service operation |
| MongoDB, Inc. (Atlas) | Application database and database backups | Singapore |
| PostHog, Inc. | Product analytics, crash reporting, and session replay (anonymous, device-level; 30-day retention) | European Union (PostHog Cloud EU) |
| Transactional email provider (name to confirm) | Magic-link authentication and system notification emails | Region as set by provider (to confirm) |
| Customer-support tooling (name to confirm) | Handling Customer and Authorized User support requests | Region as set by provider (to confirm) |
Safeguards
- All sub-processors are bound by written data-protection obligations no less protective than those in our DPA.
- Sub-processors may process personal data only on Taskworld’s documented instructions and for the purposes set out above.
- Where a sub-processor processes data outside the data subject’s jurisdiction, Taskworld relies on appropriate transfer mechanisms (such as adequacy decisions, EU Standard Contractual Clauses, or the UK International Data Transfer Addendum) as described in the Privacy Policy and DPA.
Notice of changes
Taskworld will give Customers prior notice of any intended addition or replacement of a sub-processor by updating this page. Customers under the DPA may object on reasonable data-protection grounds within fourteen (14) days of notice as set out in DPA §7.7.4.
For questions about this list, or to subscribe to change notifications, contact privacy@taskworld.com.