Workflow & Automation · workato.comWorkato
Graded against 804 verified platforms, from its own policy text. Automated assessment against a published rubric — not legal advice.
“Workato will compile statistical and technical data and information related to or generated through the performance, operation and use of the Workato Platform and related features and functionality (together, “ Usage Data ”). For purposes of clarity, Usage Data includes information provided by the Users in connection with the creation or administration of…”
Watch: indemnity liability
Start here. These are the highest-risk verified clauses AIRIN found in the platform's own policy text.
This clause excludes liability of either party and its affiliates for special, indirect, incidental, consequential, punitive, reliance, and exemplary damages and loss of revenue, profits, data, goodwill, or reputation arising from the Agreement, except in cases of gross negligence or willful misconduct and to the extent not prohibited by law.
This clause caps each party's and its affiliates' total aggregate liability for all claims arising out of the Agreement at the amounts paid or payable in the twelve months preceding the liability-triggering event, with exceptions for gross negligence, willful misconduct, and indemnification obligations, to the extent not prohibited by law.
Restricts Account Holder from asserting intellectual property infringement or misappropriation claims against Workato or Users for independently developed Platform Assets that are the same as or similar to Account Holder's, while preserving Account Holder's right to assert claims based on willful misconduct or breach of confidentiality.
Scores derived from 64 enriched findings — same verbatim citations as below. AI-generated, not legal advice.
- Workato's training terms are conditional — check the tier, opt-out, and enterprise exceptions before relying on protection.
- Your outputs and prompts are explicitly yours — Workato's terms include affirmatively protective IP language.
- Data handling is conditional — 2 privacy or retention clauses warrant review before using Workato at scale.
Derived from AI-enriched analysis of the verified findings below — informational only, not legal advice.
How to read this page: Overall risk rates what Workato's own policy terms mean for your prompts, outputs, and data. The benchmark bands below grade those same verified terms relative to peers — a platform in a risky-by-default category can rate HIGH risk and still grade STRONG against its peer set. Both trace to the cited findings.
Policy benchmark
rubric v1.0 — how this is scoredBased on 312 verified, verbatim-cited findings below — read the citations.
Based on 323 verified, verbatim-cited findings below — read the citations.
Automated assessment against a published rubric — not legal advice.
Fully verified — complete core corpus captured and read in full.
- Privacy PolicyVerified - read in full - 139 citationsstaticLast captured 2026-07-27
- Terms of ServiceVerified - read in full - 102 citationsstaticLast captured 2026-06-08
Only citation-backed plan differences are shown here; absent cells mean AIRIN has not verified a tier-specific claim.
Establishes Workato's ownership of all Platform Assets except those created by Account Holder, and grants Account Holder a royalty-free license during the Subscription Term to design, configure, create, use, share, duplicate, and modify Platform Assets including Community Platform Assets.
" (i) As between the parties, Workato owns and retains all right, title, and interest in and to all Platform Assets and all derivatives thereto on the Workato Platform, excluding any Platform Assets created by Account Holder. During the Subs..."
Establishes that Account Holder-created Platform Assets are private by default, requires Account Holder to maintain rights to create integrations with third-party applications, and grants Workato a limited royalty-free license to use private Platform Assets solely to fulfill its obligations, with a restriction against resale.
" (iii) Platform Assets created by Account Holder are private by default in the Account, which means that only Account Holder has access to such Platform Assets. Account Holder shall ensure that it has procured and will maintain the right to..."
This clause restricts Account Holder's subscription to internal business operations only, prohibiting use for the benefit of third parties such as service bureau or time-sharing arrangements, prohibiting third-party access beyond Authorized Users, and prohibiting benchmarking or competitive use without prior written authorization.
" (b) Account Holder acknowledges and agrees that Account Holder’s Subscription to the Workato Platform is limited to Account Holder’s own internal business operations and no right is granted hereunder to use the Workato Platform for the ben..."
Permits processing of personal data to gain business insights and make improvements to products and services, establishing an internal analytics use right.
" Gaining insights about and making improvements to our business, products and services"
This segment defines the scope and purpose of the Services Privacy Policy, identifying what personal information is covered, who the data subjects are, and expressly carves out business customers' consumer data processed in Workato's capacity as a service provider/sub-processor, establishing the foundational legal framework for data collection and use obligations.
" This Services Privacy Policy (this “Services Privacy Policy”) explains how Workato (“we”, “us” or “Workato”) collects, uses, shares, and protects the personal information or personal data we collect about individuals (“you”, “yours”) when ..."
Imposes an obligation on Workato to use appropriate technical and organizational security measures for personal information, while also disclaiming absolute security of Internet/email transmission and placing responsibility on users for their own privacy settings and security choices within the Service.
" We seek to protect personal information using appropriate technical and organizational measures based on the type of personal information and applicable processing activity, as detailed on our Security page. However, no Internet or e-mail ..."
Establishes processing of personal data for purposes of business protection, fraud prevention, security of IT systems, and service administration, combining security obligations with permissible data use grounds.
" Administering and protecting our business and the Service, preventing fraud, criminal activity, or misuse of our Service, and ensuring the security of our IT systems, infrastructure and networks (including troubleshooting, testing, system ..."
Grants California residents the right to know specific categories of personal information collected, sources, business purposes, third-party recipients, and specific pieces of personal information held by Workato, as required by CCPA.
" a) Right to know what categories of personal information Workato has collected about you, categories of sources from which the personal information is collected, the business or commercial purpose for collecting, selling, or sharing person..."
Clause A specifies a 48-hour notification timeline for personal information breaches, while Clause B states 'without undue delay' for a broader category of data incidents, creating ambiguity and potential for conflicting interpretations regarding the maximum notification period for the same type of event.
" If Workato becomes aware of and determines that an incident involving personal information qualifies as a breach of security leading to the misappropriation, accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal information that compromises the security, confidentiality or integrity of such personal information, Workato will report such breach to the Workato account holder within 48 hours."
" (c) Security. Workato will maintain data security protections in accordance with industry standards and appropriate technical and organizational measures to ensure the security, privacy and confidentiality of Account Holder Data as set forth in www.workato.com/legal/security (the “ Security Overview ”), which is incorporated into this Agreement. Workato will maintain security incident management policies and procedures and will notify Account Holder without undue delay after becoming aware of any accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Account Holder Data (“ Data Breach ”). Workato will take remedial steps pursuant to its security incident management policies and procedures that are necessary and reasonable to identify and remediate the cause of such Data Breach."
Across documentsClause A specifies a 48-hour notification timeline for personal information breaches, while Clause B states 'without undue delay' for a broader category of data incidents, creating ambiguity and potential for conflicting interpretations regarding the maximum notification period for the same type of event.
" If Workato becomes aware of and determines that an incident involving personal information qualifies as a breach of security leading to the misappropriation, accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal information that compromises the security, confidentiality or integrity of such personal information, Workato will report such breach to the Workato account holder within 48 hours."
" (c) Security. Workato will maintain data security protections in accordance with industry standards and appropriate technical and organizational measures to ensure the security, privacy and confidentiality of Account Holder Data as set forth in www.workato.com/legal/security (the “ Security Overview ”), which is incorporated into this Agreement. Workato will maintain security incident management policies and procedures and will notify Account Holder without undue delay after becoming aware of any accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Account Holder Data (“ Data Breach ”). Workato will take remedial steps pursuant to its security incident management policies and procedures that are necessary and reasonable to identify and remediate the cause of such Data Breach."
Across documentsClause A specifies a maximum notification period of 48 hours for personal information breaches, while Clause B requires notification 'without undue delay' for security incidents affecting Account Holder Data, which could be interpreted as a different or potentially longer timeframe.
" If Workato becomes aware of and determines that an incident involving personal information qualifies as a breach of security leading to the misappropriation, accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, personal information that compromises the security, confidentiality or integrity of such personal information, Workato will report such breach to the Workato account holder within 48 hours."
" (c) Security. Workato will maintain data security protections in accordance with industry standards and appropriate technical and organizational measures to ensure the security, privacy and confidentiality of Account Holder Data as set forth in www.workato.com/legal/security (the “ Security Overview ”), which is incorporated into this Agreement. Workato will maintain security incident management policies and procedures and will notify Account Holder without undue delay after becoming aware of any accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Account Holder Data (“ Data Breach ”). Workato will take remedial steps pursuant to its security incident management policies and procedures that are necessary and reasonable to identify and remediate the cause of such Data Breach."
Across documents
Evidence appendix
Showing priority citations first. The full appendix is available for audit trails; not every citation is a severe risk.
" (a) The pricing and payment terms in the Reseller Agreement apply and all payment will be made directly to the Reseller, and, for the avoidance of doubt, the obligations outlined in Sections 5(a) - (d) of this Agreement shall not apply."
This clause specifies that when purchasing through a reseller, the Reseller Agreement's pricing and payment terms govern and payments flow to the reseller, creating an exception to the standard payment obligations in Sections 5(a)-(d) of the agreement.
AI-generated interpretation, not legal advice.
" Workato will compile statistical and technical data and information related to or generated through the performance, operation and use of the Workato Platform and related features and functionality (together, “ Usage Data ”). For purposes of clarity, Usage Data includes information provided by the Users in connection with the creation or administration of their Account, including names, usernames and email addresses associated with the account, but excludes all data processed in the Services. Workato will not publicly disclose Usage Data unless it is aggregated and anonymized. Workato may use Usage Data during and after the term for the purposes of implementing, operating, maintaining, auditing compliance, and improving (including training and machine learning of) the Services and fulfilling its obligations hereunder. Workato also maintains system log files which may include internet protocol addresses, browser, internet service provider, pages visited within Workato’s Sites, referring/exit pages, search terms, operating system, date/time stamp, and clickstream data."
This segment defines 'Usage Data' as statistical and technical data generated through platform performance and use, specifying what is included (account creation information) and excluded (data processed in the Services), and states that Workato will not publicly disclose Usage Data unless aggregated and anonymized, imposing a restriction on disclosure and establishing a defined term used throughout the policy.
AI-generated interpretation, not legal advice.
" o) use, process and transcribe the call recordings for its internal lawful purposes such as internal analytics and training purposes."
Grants Workato the right to use, process, and transcribe call recordings for internal analytics and training purposes, establishing a permitted use of user data for AI/ML training activities.
AI-generated interpretation, not legal advice.
" Note that we will never email you to ask for your Account information; if you receive such an email, please forward it to privacy@workato.com . If provided, Workato may use your cell phone number to call or text you in order to provide the Services. You hereby acknowledge and agree that Workato may use artificial intelligence, machine learning, or other technologies to enhance its permitted use under this Services Privacy Policy, in accordance with applicable laws, industry standards and its Responsible AI Policy. Workato will be responsible for its use of these technologies and may conduct a review of its use, including the output generated by these technologies. You may learn more about Workato's use of AI by contacting us at privacy@workato.com ."
Permits Workato to use artificial intelligence, machine learning, or other technologies to enhance its permitted uses under the Services Privacy Policy, and acknowledges Workato's responsibility for those technologies, constituting a broad permission for AI/ML-based data processing.
AI-generated interpretation, not legal advice.
" Holder such as activation or upgrading to the latest version through its Account. Workato may, upon at least ninety (90) days’ advance notice, or with notice provided as soon as practicable under the circumstances if a shorter period is required to protect the security, integrity, availability or stability of the Workato Platform, discontinue or limit the use of older versions of such features."
Establishes the procedure for Workato to discontinue or limit older platform feature versions, requiring at least ninety (90) days' advance notice or shorter notice where necessary to protect platform security and integrity.
AI-generated interpretation, not legal advice.
" (c) Feedback. Account Holder may voluntarily give suggestions, ideas, enhancement requests, feedback, or recommendations relating to the Workato Platform (collectively, “ Feedback ”). Feedback does not include Account Holder Data or Account Holder’s Confidential Information. Workato may make, use, sell, reproduce, create derivatives of, display or otherwise practice the Feedback during and after the term. Feedback is provided “AS-IS.” Workato will not publicly associate such Feedback with Account Holder without Account Holder’s prior written consent."
This clause grants Workato a perpetual, irrevocable-style license to make, use, sell, reproduce, create derivatives of, display, or otherwise practice Feedback voluntarily provided by Account Holder, establishing Workato's broad IP rights over Feedback both during and after the term while excluding Account Holder Data and Confidential Information from the definition of Feedback.
AI-generated interpretation, not legal advice.
" (v) Account Holder agrees that Platform Assets created by Workato or Users may be the same as or similar to those created by Account Holder, and that it will not assert any claim against Workato or any Users for infringement or misappropriation of any intellectual property rights to any Platform Assets independently developed by Workato or Users. Nothing herein shall limit Account Holder’s ability to assert any claim based on willful misconduct or breach of confidentiality obligations."
Restricts Account Holder from asserting intellectual property infringement or misappropriation claims against Workato or Users for independently developed Platform Assets that are the same as or similar to Account Holder's, while preserving Account Holder's right to assert claims based on willful misconduct or breach of confidentiality.
AI-generated interpretation, not legal advice.
" (a) TO THE EXTENT NOT PROHIBITED BY LAW, AND EXCEPT FOR A PARTY’S GROSS NEGLIGENCE OR WILLFUL MISCONDUCT, IN NO EVENT WILL EITHER PARTY OR ITS AFFILIATES BE LIABLE FOR ANY SPECIAL, INDIRECT, INCIDENTAL, CONSEQUENTIAL, PUNITIVE, RELIANCE, EXEMPLARY DAMAGES, OR ANY LOSS OF REVENUE, PROFITS (EXCLUDING FEES UNDER THIS AGREEMENT), SALES, DATA, GOODWILL OR REPUTATION THAT RESULT FROM THIS AGREEMENT, EVEN IF SUCH PARTY OR ITS AUTHORIZED REPRESENTATIVE HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES."
This clause excludes liability of either party and its affiliates for special, indirect, incidental, consequential, punitive, reliance, and exemplary damages and loss of revenue, profits, data, goodwill, or reputation arising from the Agreement, except in cases of gross negligence or willful misconduct and to the extent not prohibited by law.
AI-generated interpretation, not legal advice.
" (b) TO THE EXTENT NOT PROHIBITED BY LAW, AND EXCEPT FOR EACH PARTY’S GROSS NEGLIGENCE, WILLFUL MISCONDUCT OR INDEMNIFICATION OBLIGATIONS UNDER THIS AGREEMENT, IN NO EVENT WILL EITHER PARTY’S OR ITS AFFILIATES’ TOTAL LIABILITY TO THE OTHER PARTY FOR ANY DAMAGES, LOSSES, AND CAUSES OF ACTION ARISING OUT OF OR RELATING TO THIS AGREEMENT (WHETHER IN CONTRACT OR TORT, INCLUDING NEGLIGENCE, WARRANTY, OR OTHERWISE) EXCEED IN THE AGGREGATE THE AMOUNTS PAID OR PAYABLE IN THE TWELVE (12) MONTHS IMMEDIATELY PRECEDING THE EVENT GIVING RISE TO SUCH LIABILITY."
This clause caps each party's and its affiliates' total aggregate liability for all claims arising out of the Agreement at the amounts paid or payable in the twelve months preceding the liability-triggering event, with exceptions for gross negligence, willful misconduct, and indemnification obligations, to the extent not prohibited by law.
AI-generated interpretation, not legal advice.
" Legitimate Interest: We process the following categories of personal data when we believe it furthers our legitimate interests or those of third parties, or your legitimate interest. We will rely on our legitimate interests for processing personal data only after balancing our interests and rights against the impact of the processing on individuals."
Identifies legitimate interests under GDPR Article 6(1)(f) as a legal basis for processing certain categories of personal data, and imposes an obligation on Workato to balance its interests against the impact on individuals before relying on this basis.
AI-generated interpretation, not legal advice.
" You can exercise the rights described above, by sending an email to support@workato.com or calling +1-844-469-6752. You may exercise these rights by yourself or via an authorized agent who meets the agency requirements of CCPA. Once you exercise your rights, you agree to receive communication from us seeking information from you in order to verify your identity as the consumer from whom we have collected the personal information and such other information as reasonably required to enable us to fulfill your request. We will not fulfill your request unless you have provided sufficient information for us to reasonably verify that you are the consumer from whom we collected the personal information, as well as sufficient details necessary to help us handle the request. Note: The Sites do not respond to browser “Do Not Track” (DNT) signals and operates as described in this Services Privacy Policy whether or not a DNT signal is received. If we do so in the future, we will describe how we do so in this Services Privacy Policy."
Establishes the procedure for California residents to exercise CCPA rights, including contact methods, use of authorized agents, identity verification requirements, and the condition that Workato will not fulfill requests without sufficient information to verify identity.
AI-generated interpretation, not legal advice.
" Gaining insights about and making improvements to our business, products and services"
Permits processing of personal data to gain business insights and make improvements to products and services, establishing an internal analytics use right.
AI-generated interpretation, not legal advice.
"employment-related information. Current or past job history."
Provides the substantive definition of professional or employment-related information as including current or past job history, scoping what data falls within this category.
AI-generated interpretation, not legal advice.
" i) analyze usage of our Services for internal purposes, to improve our marketing and outreach to visitors and potential customers, and to improve the content and functionality of the Services;"
Permits use of personal information to analyze service usage for internal purposes, marketing improvement, and content/functionality improvement, establishing analytics as a lawful processing purpose.
AI-generated interpretation, not legal advice.
" n) prevent, identify, investigate and deter fraudulent, harmful, unauthorized, unethical or illegal activity, including cyberattacks and identity theft;"
Permits use of personal information to prevent, identify, investigate, and deter fraudulent, harmful, unauthorized, unethical, or illegal activity including cyberattacks and identity theft, establishing security and fraud prevention as lawful processing purposes.
AI-generated interpretation, not legal advice.
" Under California Civil Code Sections 1798.83-1798.84, California residents are entitled to ask us for a notice identifying the categories of personal information which we share with our affiliates and/or third parties for marketing purposes, and providing contact information for such affiliates and/or third parties. If you are a California resident and would like a copy of this notice, please submit a written request to: support@workato.com or Workato Inc., 1530 Page Mill Road, Suite 100, Palo Alto, California 94304, United States, Attn: Legal. Moreover, we are required by the California Consumer Privacy Act of 2018 (“CCPA”) to provide this CCPA Notice to California residents to explain how we collect, use and share their personal information, and the rights and choices we offer California residents regarding our handling of their personal information, which the CCPA currently defines as “information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household.” This CCPA Notice does not apply to individuals with whom Workato engages in the individuals’ capacity as representatives of businesses that may provide services to Workato, or to which Workato may provide its Services."
Obligates Workato to provide California residents with a notice identifying categories of personal information shared with affiliates and third parties for marketing purposes under California Civil Code Sections 1798.83-1798.84, and provides a procedure for requesting such notice.
AI-generated interpretation, not legal advice.
" When you participate in any program or request a certification in any educational offerings provided by Workato, we may, with your consent, display information about your participation in these programs and your completion of activities within them, for certification purposes. This information may be disclosed by Workato for marketing or promotional purposes and may be shared with other Users including the admin in your company, organization or team, who are also a part of the Services, as permitted by law."
Permits Workato, with user consent, to display and disclose personal information about participation in educational programs for certification, marketing, and promotional purposes, and to share it with other users including company admins.
AI-generated interpretation, not legal advice.
"If your data has been submitted to us by or on behalf of a Workato corporate User and you wish to exercise any rights you may have under applicable data protection laws, please inquire with the relevant corporate User directly. Because we may only access customer’s data upon their instructions, if you wish to make your request directly to us, please provide us the name of the Workato corporate User who submitted your data to us. We will refer your request to that corporate User and will support them as needed in responding to your request in accordance with our contract with the relevant corporate User."
Establishes the procedure for corporate users' data subjects to exercise data protection rights, requiring requests to go through the relevant corporate user and obligating Workato to refer and support such requests per its contractual obligations.
AI-generated interpretation, not legal advice.
Common questions about Workato's policies
- Does Workato train its AI models on your data?
- Training possible — conditions or opt-outs apply — based on 3 verified findings from Workato's published policy. Informational only, not legal advice.
- Who owns the content you create with Workato?
- You own outputs — with license carve-outs — based on 1 verified finding from Workato's published policy. Informational only, not legal advice.
- Can you use Workato's output commercially?
- Commercial use allowed — based on 2 verified findings from Workato's published policy. Informational only, not legal advice.
Clause detail — protections, your obligations, and coverage
Every clause below is a verbatim quote from Workato's own published policy, read in full and linked to its exact location. Protections and user obligations are reported separately from risk because they are different kinds of clause — an obligation on you is not a risk to your data. Informational only, not legal advice.
✅ Protections found
56 verified clausesClauses in Workato's policies that work in your favour — commitments the platform made to you.
- Confidentiality
“(a) “ Confidential Information ” means non-public information disclosed by a party (the “ Disclosing Party ”) to the other party (the “ Receiving Party ”) that is designated in writing, or identified orally at time of disclosure, by the Disclosing Party as “co…”
This clause defines 'Confidential Information' as non-public information designated or reasonably understood to be confidential, expressly including Account Holder Data, Transaction Data, and private Account Assets, and…
📍 Terms of Service › “Workato Terms of Service”Jump to exact text → - Confidentiality
“(b) The foregoing restrictions do not apply to information that: (i) has been independently developed by the Receiving Party without use of or access to the Disclosing Party's Confidential Information; (ii) has become publicly known through no breach of this s…”
This clause enumerates the standard exceptions to the confidentiality obligations, specifying five categories of information to which the restrictions do not apply: independently developed information, publicly known inf…
📍 Terms of Service › “Workato Terms of Service”Jump to exact text → - Audit rights, DPA & residency
“Workato offers its Services to customers in various geographic regions, including the United States, the EEA and the UK. However, as described in Sections 3 (Sources of Collection) and 10 (International Transfers), some personal data may nonetheless be collect…”
Discloses that personal data may be transferred to and stored in the United States regardless of user location, acknowledges that US laws may provide less protection than laws in users' home jurisdictions, and references…
📍 Article C (Transfer of Personal Data)Jump to exact text → - Moderation & enforcement
“(e) Suspension. Workato may suspend Account Holder’s and/or the Authorized Users’ access to the Workato Platform in the following circumstances: (i) in the event that Account Holder or Authorized Users are in material breach of this Agreement and have not cure…”
Sets out the conditions and procedure under which Workato may suspend Account Holder's or Authorized Users' access to the platform — including for material breach uncured after five days' written notice or for security t…
📍 Terms of Service › “Workato Terms of Service”Jump to exact text → - Indemnity & liabilityindemnity direction
“(ii) Workato shall have no liability under this section to the extent that any third-party claims described herein are based on (A) Account Holder’s use of the Workato Platform in violation of this Agreement or the Documentation, or the written instructions gi…”
This clause carves out exceptions to Workato's indemnification liability, specifying circumstances—such as Account Holder's misuse, third-party materials, unauthorized modifications, or combinations with non-Workato prod…
📍 Terms of Service › “Workato Terms of Service”Jump to exact text → - Indemnity & liabilityindemnity direction
“(c) Indemnification Procedure. These indemnification obligations are contingent upon the party seeking indemnity: (i) promptly giving the indemnifying party written notice of the claim, provided that the failure to do so does not relieve the indemnifying party…”
This clause establishes the procedural requirements that must be satisfied by the party seeking indemnification, including prompt written notice of the claim and granting the indemnifying party sole control of defense an…
📍 Terms of Service › “Workato Terms of Service”Jump to exact text →
+ 50 more verified clauses of this kind on this platform, cited in full in the report.
📋 Rules you must follow
6 verified clausesWhat Workato requires of YOU. These are your obligations, not risks to your data or IP, so they are cited here and excluded from this platform's risk rating.
- Moderation & enforcementconduct restrictions
“(a) Account Holder will not, and will not authorize any third party to, directly or indirectly: (i) interfere or attempt to interfere with the proper working or other User’s use of the Workato Platform, including through abuse of server capacity; (ii) reverse…”
This clause enumerates specific prohibited conduct by Account Holder, including interfering with platform operations, reverse engineering, copying or altering the platform, and other prohibited uses, establishing enforce…
📍 Terms of Service › “Workato Terms of Service”Jump to exact text → - Moderation & enforcement
“Each party agrees to comply with the U.S. Foreign Corrupt Practices act, the UK Bribery Act 2010 and other applicable anti-corruption, anti-bribery or anti-money laundering law (together, " Anti-Corruption Laws ”), and agrees not to violate, cause the other pa…”
This clause obligates both parties to comply with applicable anti-corruption, anti-bribery, and anti-money laundering laws including the FCPA and UK Bribery Act, and prohibits offering or receiving improper payments or g…
📍 Terms of Service › “Commercial Crime”Jump to exact text → - Moderation & enforcement
“The Workato Platform and derivatives thereof are subject to export controls and sanctions laws and regulations of the United States and other jurisdictions (the “ Export Controls ”). The parties will comply with applicable Export Controls. Account Holder will…”
This clause restricts Account Holder from using the Workato Platform in any manner that would violate applicable export controls and sanctions laws, including use in embargoed countries or for prohibited end uses such as…
📍 Terms of Service › “Commercial Crime”Jump to exact text → - Commercial useconduct restrictions
“(b) Account Holder acknowledges and agrees that Account Holder’s Subscription to the Workato Platform is limited to Account Holder’s own internal business operations and no right is granted hereunder to use the Workato Platform for the benefit of third parties…”
This clause restricts Account Holder's subscription to internal business operations only, prohibiting use for the benefit of third parties such as service bureau or time-sharing arrangements, prohibiting third-party acce…
📍 Terms of Service › “Workato Terms of Service”Jump to exact text → - Moderation & enforcementconduct restrictions
“contractual usage limit, (6) for any system or application in which the failure of the Workato Platform could create a risk of personal injury or death, such as medical systems, life sustaining or life-saving systems, transportation systems, or nuclear systems…”
This clause continues the list of use restrictions by prohibiting use beyond contractual usage limits and use in high-risk systems where platform failure could cause personal injury or death, and generally prohibits any…
📍 Terms of Service › “Workato Terms of Service”Jump to exact text →
+ 1 more verified clause of this kind on this platform, cited in full in the report.
What the policies actually cover
17 topics- Product telemetry & usage tracking20 clauses
- Advertising & tracking2 protective5 clauses
- Sale or sharing of personal data6 protective8 clauses
- Sensitive data (biometric, location, health)1 protective9 clauses
- Children's data1 protective3 clauses
- Government & law-enforcement disclosure3 clauses
- Does not train on your content3 protective3 clauses
- Trains by default, opt-out available1 clause
- Arbitration & class-action waiver1 clause
- Damages & liability cap8 clauses
- Indemnity direction5 protective7 clauses
- Terms can change at any time4 protective5 clauses
- Deletion rights & post-termination survival5 protective8 clauses
- Auto-renewal & cancel window1 clause
- Feedback ownership1 clause
- Breach-notification promises2 protective3 clauses
- Conduct restrictions3 obligations3 clauses
152 further verified clauses are cited on this page but not yet assigned a topic.
Cross-clause notes
Two verified clauses intersect on the same subject matter: the Privacy Policy, § 7 (Correcting, Updating or Deleting Your Information) addresses how long content is retained, and the Privacy Policy, § F (Usage Data) addresses use of content in connection with model training or service improvement. Both clauses are in force at the same time — read them together.
The Terms of Service, Terms of Service › “Workato Terms of Service” describes rights the platform takes in user content, and the Privacy Policy, § B (Other Information Sharing) describes disclosure of data to third parties or subprocessors. Both clauses are in force at the same time — read them together.
Verified retention clauses point in different directions: the Privacy Policy, § 8 (Data Retention) describes broad or open-ended retention, while the Privacy Policy, § 7 (Correcting, Updating or Deleting Your Information) describes deletion or erasure. Which clause controls in a given situation is not resolved by the documents' text alone — this is surfaced as an ambiguity, treated as Caution.
Automated cross-reference against the published rubric — not legal advice.
Clause intelligence
Canonical clauses and stance patterns extracted from the same gate-verified citations shown on this page.
The clause allows indefinite, perpetual, or necessity-based retention.
“Workato will retain your personal information for a period of time consistent with the original purpose of collection (see the “Use of Personal Information” section above) or as long as necessary to comply with our legal obligations, maintain accurate accounting, financial and other operational records, resolve disputes, and enforce our Agreements. We determine the appropriate retention period for personal informa...”Open source citation
The clause allows indefinite, perpetual, or necessity-based retention.
“Workato will retain your personal information for a period of time consistent with the original purpose of collection (see the “Use of Personal Information” section above) or as long as necessary to comply with our legal obligations, maintain accurate accounting, financial and other operational records, resolve disputes, and enforce our Agreements. We determine the appropriate retention period for personal informa...”Open source citation
The clause provides a deletion or time-bounded retention path.
“(iii) Workato will delete the Accounts (together with all associated Account Assets, Transaction Data, and Account Holder Data) left in Workato’s system within ninety (90) days after termination or expiration of this Agreement, or within thirty (30) days after Account Holder’s written request, unless otherwise legally prohibited.”Open source citation
The clause imposes arbitration, class-action waiver, or jury-trial waiver terms.
“14. Dispute Resolution and Arbitration.”Open source citation
The clause imposes arbitration, class-action waiver, or jury-trial waiver terms.
“(i) Attorneys’ Fees. In the event of any suit or action to enforce or interpret any provision of this Agreement (or that is based on this Agreement), the prevailing party is entitled to recover, in addition to other costs, reasonable attorney fees in connection with the suit, action, or arbitration, and in any appeals. The determination of the prevailing party and the amount of reasonable attorney fees to be paid ...”Open source citation
Tier matrix
Plan-level conditions detected from citation-backed clauses. Empty tiers mean AIRIN has not captured decisive tier language yet.
| Tier | Surface | Verdict | Risk | Citations |
|---|---|---|---|---|
| All applicable tiers | data retention | conditional | MEDIUM | 3 |
| All applicable tiers | governing law disputes | conditional | MEDIUM | 1 |
| All applicable tiers | indemnity liability | conditional | MEDIUM | 1 |
| All applicable tiers | privacy data use | worsens | HIGH | 11 |
| All applicable tiers | prompt ownership | conditional | MEDIUM | 1 |
| All applicable tiers | subprocessors data sharing | conditional | MEDIUM | 3 |
| All applicable tiers | training use | conditional | MEDIUM | 8 |
| Free | commercial use | conditional | MEDIUM | 1 |
| Free | subprocessors data sharing | worsens | HIGH | 2 |
| Pro / Paid | audit rights dpa residency | conditional | MEDIUM | 1 |
| Pro / Paid | governing law disputes | conditional | MEDIUM | 1 |
| Pro / Paid | indemnity liability | conditional | MEDIUM | 1 |
Policy evolution
Open full timelineBefore/after stance changes across captured policy versions. When no material delta exists yet, AIRIN shows the latest citation-backed stance events instead.
retention worsened from low/deletion or time bound to medium/indefinite or necessity based.
“(iii) Workato will delete the Accounts (together with all associated Account Assets, Transaction Data, and Account Holder Data) left in Workato’s system within ninety (90) days after termination or expiration of this Agreement, or within thirty (30) days after Account Holder’s written request, unless otherwise legally prohibited.”Before citation
“Workato will retain your personal information for a period of time consistent with the original purpose of collection (see the “Use of Personal Information” section above) or as long as necessary to comply with our legal obligations, maintain accurate accounting, financial and other operational records, resolve disputes, and enforce our Agreements. We determine the appropriate retention period for personal information on the basis of the amount, nature, and sensitivity of the personal information being processed, the potential risk of harm from unauthorized use or disclosure of the personal information, whether we can achieve the purposes of the processing through other means, and on the basis of applicable legal requirements (such as applicable statutes of limitation). After expiry of the applicable retention periods, your personal information will be deleted. Specific information about retention periods for components of a Workato Account can be found in the relevant section of our online documentation. Please also contact us if you have any questions.”After citation
retention improved from medium/indefinite or necessity based to low/deletion or time bound.
“Workato will retain your personal information for a period of time consistent with the original purpose of collection (see the “Use of Personal Information” section above) or as long as necessary to comply with our legal obligations, maintain accurate accounting, financial and other operational records, resolve disputes, and enforce our Agreements. We determine the appropriate retention period for personal information on the basis of the amount, nature, and sensitivity of the personal information being processed, the potential risk of harm from unauthorized use or disclosure of the personal information, whether we can achieve the purposes of the processing through other means, and on the basis of applicable legal requirements (such as applicable statutes of limitation). After expiry of the applicable retention periods, your personal information will be deleted. Specific information about retention periods for components of a Workato Account can be found in the relevant section of our online documentation. Please also contact us if you have any questions.”Before citation
“(iii) Workato will delete the Accounts (together with all associated Account Assets, Transaction Data, and Account Holder Data) left in Workato’s system within ninety (90) days after termination or expiration of this Agreement, or within thirty (30) days after Account Holder’s written request, unless otherwise legally prohibited.”After citation
data sharing improved from high/sale or sell to medium/third party or vendor sharing.
“We may share your personal information by disclosing it to a third party for a business purpose as stated below. We only make these business purpose disclosures under written contracts that describe the purposes, require the recipient to keep the personal information confidential, and prohibit using the disclosed information for any purpose except performing the contract. In the preceding twelve (12) months, Workato has disclosed personal information for a business purpose to the categories of third parties indicated in the chart below in subsection 5.C (“Categories of Third-Party Recipients of Personal Information”). We do not sell personal information. In the preceding twelve (12) months, we have not sold personal information.”Before citation
“(ii) Workato represents and warrants that it has all title and license required to provide the Workato Platform and that the Workato Platform will not and does not infringe or misappropriate any third party’s intellectual property rights; the exclusive remedy for a violation of these warranties is indemnity as described in Section 10(b) (Indemnification by Workato).”After citation
Latest stance: third party or vendor sharing on privacy data use
“For all paying Users, we maintain a record of Service subscriptions, invoices, billing and payment information. For Users who pay by credit card, our third-party payment sub-processor as listed on our subprocessor page will process your credit card information. We will collect and associate the payment information with a Subscription ID but we do not store any payment card information ourselves. If you have questions about how our processor or subprocessor protects the data it receives from Users, please refer to its websites as listed in https://www.workato.com/legal/sub-processors .”Open timeline citation
Latest stance: indefinite or necessity based on data retention
“Workato will retain your personal information for a period of time consistent with the original purpose of collection (see the “Use of Personal Information” section above) or as long as necessary to comply with our legal obligations, maintain accurate accounting, financial and other operational records, resolve disputes, and enforce our Agreements. We determine the appropriate retention period for personal information on the basis of the amount, nature, and sensitivity of the personal information being processed, the potential risk of harm from unauthorized use or disclosure of the personal information, whether we can achieve the purposes of the processing through other means, and on the basis of applicable legal requirements (such as applicable statutes of limitation). After expiry of the applicable retention periods, your personal information will be deleted. Specific information about retention periods for components of a Workato Account can be found in the relevant section of our online documentation. Please also contact us if you have any questions.”Open timeline citation
Latest stance: training permitted on training use
“Note that we will never email you to ask for your Account information; if you receive such an email, please forward it to privacy@workato.com . If provided, Workato may use your cell phone number to call or text you in order to provide the Services. You hereby acknowledge and agree that Workato may use artificial intelligence, machine learning, or other technologies to enhance its permitted use under this Services Privacy Policy, in accordance with applicable laws, industry standards and its Responsible AI Policy. Workato will be responsible for its use of these technologies and may conduct a review of its use, including the output generated by these technologies. You may learn more about Workato's use of AI by contacting us at privacy@workato.com .”Open timeline citation
Latest stance: training permitted on training use
“Workato will compile statistical and technical data and information related to or generated through the performance, operation and use of the Workato Platform and related features and functionality (together, “ Usage Data ”). For purposes of clarity, Usage Data includes information provided by the Users in connection with the creation or administration of their Account, including names, usernames and email addresses associated with the account, but excludes all data processed in the Services. Workato will not publicly disclose Usage Data unless it is aggregated and anonymized. Workato may use Usage Data during and after the term for the purposes of implementing, operating, maintaining, auditing compliance, and improving (including training and machine learning of) the Services and fulfilling its obligations hereunder. Workato also maintains system log files which may include internet protocol addresses, browser, internet service provider, pages visited within Workato’s Sites, referring/exit pages, search terms, operating system, date/time stamp, and clickstream data.”Open timeline citation
Capture recency
- Privacy Policy:Last captured 2026-07-27· verified 2026-07-27
- Terms of Service:Last captured 2026-06-08· verified 2026-06-08verified once — no re-scan in 94 days
Dates state when our pipeline captured and verified each document — not when the vendor last changed it. Documents are re-scanned on a recurring cadence; a document verified once says so until a re-scan confirms it again.
↑ 9 more findings this quarter vs last (296 vs 287). First scan: June 2026.
Compare and stack are saved in your browser. Open compare · View your stack. A correction triggers an automated re-read of Workato's policies — no human edits the data.
Need this for procurement or legal diligence?
Free shows today's risk. A Stack Audit gives you a citable, verbatim-sourced PDF across your whole AI stack — and flags the moment a vendor's terms change.
Every finding above is a verbatim quote from Workato's own published policy, captured to an immutable snapshot and read in full through a two-gate verification pipeline. Confidence labels and any analysis are AI-generated and informational only — not legal advice.
AIRIN Brief
Built for compliance officers, legal counsel, and SaaS founders. Subscribe to the email digest — one short brief when a tracked vendor materially changes its terms, training policy, or risk rating. Prefer in-app? Watch platforms in your alerts inbox instead.