Workato procurement policy evidence
Only topics backed by verified findings appear below. Each row preserves the platform's exact policy words and capture provenance.
| Topic | Plan or tier | Risk | Their words | Source |
|---|---|---|---|---|
| DPA, audit rights & data residency | All applicable tiers | low | “ If you are a User in the European Economic Area (“EEA”) or the United Kingdom (“UK”), the following provisions apply to you, in addition to the other policies in this Services Privacy Policy. Workato, Inc. is the controller for your personal data. For the purposes of the GDPR, Workato, Inc. is established in the EEA through and Workato Europe, S.A., with office at Av Diagonal Num.497 Esc. P.2 Pta., Barcelona.” | Captured 2026-06-08Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “ Europe, the Middle East and Africa: Central European Time (CET);” | Captured 2026-06-08Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “ Workato offers its Services to customers in various geographic regions, including the United States, the EEA and the UK. However, as described in Sections 3 (Sources of Collection) and 10 (International Transfers), some personal data may nonetheless be collected, transferred to and stored by us in the United States and by our service providers that are based in the United States as necessary for the purpose of providing the Services and for the business purposes described in this Services Privacy Policy. Laws in the U.S. may be less stringent or otherwise different from the laws where you reside. Where applicable or required by law, we will ensure that the recipient of your personal data offers an adequate level of protection and security, for instance by entering into appropriate standard contractual clauses or an alternative mechanism for the transfer of data as approved by the European Commission (Art. 46 GDPR) or other applicable regulators. Moreover, we transfer some of your personal data as a matter of “contractual necessity” (for further information on the type of personal data concerned, please read Section 15.A “Legal Bases For Processing” above).” | Captured 2026-06-08Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “ l) audit our internal processes for compliance with legal and contractual requirements and internal policies;” | Captured 2026-06-08Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “ During and for a period of three (3) years after the termination or expiration of this Agreement, Workato will purchase and maintain insurance coverage as set forth below from reputable insurance companies with an A. M. Best rating of “A - VII” or better/equivalent. Upon request of Account Holder but no more frequently than once per calendar year, Workato will provide certificates of insurance demonstrating its compliance.” | Captured 2026-06-08Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | ambiguous | “ Workato offers the option to host and process customer data in specific non-U.S. localities. When selected, all Account Data (as defined in the Agreement), including Account configurations, meta-data, job history summaries, and the Platform Assets contained within the Account and Transaction Data (as defined in the Agreement), including records of processing of customer data transmitted or processed through the Services, as well as job history details and trigger event data, is stored exclusively in the customer’s selected region. However, some personal information may still be transferred to the U.S. or other locations and processed there, including chat messages, payment information, support tickets and e-mails to Workato support, Usage Data, information posted to blogs, information collected in connection with our educational offerings, information shared with third parties as described above, and certain Services that utilize third party subprocessors located in the U.S. or other locations, as further described on our subprocessor page. Additionally, Platform Assets (as defined in the Agreement) made public by a Workato user will be made available globally, and Platform Assets metadata including username will be stored in the U.S. to facilitate search for those objects that are shared. Please refer to Section 15 (“Notice to European Users”) below for further information applicable to Users in the EEA and the UK. ” | Captured 2026-06-08Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | medium | “ For Users located in other jurisdictions, Workato is a global company and has established internal policies about its processing and handling of personal information under its operations around the world in accordance with this Services Privacy Policy, including by taking, and ensuring that any third parties personal information is transferred to take, necessary measures to ensure continuous implementation of equivalent measures for data security and information privacy when data is transferred to any other country. Workato also maintains appropriate technical and organizational measures to ensure the security, privacy and confidentiality of personal information, and takes measures to prevent unauthorized use of personal information, as further detailed in Section 11 (“Security Measures”). Workato employees are regularly trained to carry out their assigned data security-related duties and responsibilities and handling of personal information. You may see more information about the location of Workato’s and its Affiliates’ offices here and Workato’s sub-processors here. For further inquiries or requests about how your personal information is transferred globally and your related rights under applicable data protection laws, please email privacy@workato.com .” | Captured 2026-06-08Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “ (b) Data Protection Laws. Each party will comply with all data protection laws to the extent applicable to and binding on it. To the extent that any Personal Data (as defined in the DPA) is processed through the Workato Platform by Workato on Account Holder’s behalf, the Data Processing Addendum located at https://www.workato.com/legal/dpa (the “ DPA ”) is incorporated into this Agreement.” | Captured 2026-06-08Open source →Finding permalink → |
| DPA, audit rights & data residency | All applicable tiers | low | “ Asia-Pacific: Singapore Standard Time (SGT);” | Captured 2026-06-08Open source →Finding permalink → |
| Data retention | All applicable tiers | medium | “ You may update or change the personal information you have provided to us by logging into the Service. We have established internal policies for the deletion of data from customer Accounts following termination of a customer’s subscription to the Service. We will also respond to requests to delete personal information that may be held within our systems, to the extent possible and with the limitation that some information may need to be retained for legal, accounting, or archival purposes (see the “Data Retention” section of this Services Privacy Policy for details). Note that if you remove or request removal of information that you posted in a public area of the Service, copies may remain viewable in cached and archived pages of the Services, or if other Users have copied or saved that information. Therefore, in some cases, we may not be able to delete your personal information. To request removal, deletion, correction or updates of your personal information, contact us at privacy@workato.com . Moreover, if you are a Workato User and would like to opt-out of marketing communications from Workato please contact us at privacy@workato.com or follow the unsubscribe instructions included in the marketing emails. Users in the EU and some other jurisdictions have more specific and additional rights related to their personal information: see Sections 13-15 for more details. In some instances, for example, instances of Embedded functionality or other cases in which Workato has no direct relationship with the end-customers of a corporate User, we process personal data of our corporate User’s end-customers on behalf of our corporate User in our capacity as a service provider / subprocessor. ” | Captured 2026-06-08Open source →Finding permalink → |
| Data retention | All applicable tiers | low | “ Data portability.” | Captured 2026-06-08Open source →Finding permalink → |
| Data retention | All applicable tiers | low | “ (c) Deletion of Accounts and Data. The Accounts consist of: (i) Account configurations, meta-data, job history summaries, and the Platform Assets contained within the Account (together “ Account Assets ”), and (ii) records of processing of Account Holder Data on the Workato Platform, including job history details and trigger event data (“ Transaction Data ”).” | Captured 2026-06-08Open source →Finding permalink → |
| Data retention | All applicable tiers | low | “ (i) All Transaction Data in the Account will be deleted within thirty (30) days from its processing date, unless otherwise configured by Account Holder in its Account in accordance with Account Holder’s Subscription as set forth in the applicable Order form (if applicable).” | Captured 2026-06-08Open source →Finding permalink → |
| Data retention | All applicable tiers | medium | “ Workato will retain your personal information for a period of time consistent with the original purpose of collection (see the “Use of Personal Information” section above) or as long as necessary to comply with our legal obligations, maintain accurate accounting, financial and other operational records, resolve disputes, and enforce our Agreements. We determine the appropriate retention period for personal information on the basis of the amount, nature, and sensitivity of the personal information being processed, the potential risk of harm from unauthorized use or disclosure of the personal information, whether we can achieve the purposes of the processing through other means, and on the basis of applicable legal requirements (such as applicable statutes of limitation). After expiry of the applicable retention periods, your personal information will be deleted. Specific information about retention periods for components of a Workato Account can be found in the relevant section of our online documentation. Please also contact us if you have any questions.” | Captured 2026-06-08Open source →Finding permalink → |
| Data retention | All applicable tiers | low | “ (ii) Account Holder has the ability to delete Account Assets, Account Holder Data and Transaction Data at its own discretion, and to export Account Holder Data.” | Captured 2026-06-08Open source →Finding permalink → |
| Data retention | All applicable tiers | low | “ (iii) Workato will delete the Accounts (together with all associated Account Assets, Transaction Data, and Account Holder Data) left in Workato’s system within ninety (90) days after termination or expiration of this Agreement, or within thirty (30) days after Account Holder’s written request, unless otherwise legally prohibited.” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ In addition to the purposes described above, we disclose personal information to respond to subpoenas, court orders, on legal process, or to establish or exercise our legal rights or defend against legal claims. We may also share such personal information if we believe it is necessary in order to investigate, prevent, or take action regarding illegal activities, suspected fraud, situations involving potential threats to the physical safety of any person, violations or our Terms of Service, or as otherwise required by law. If we are involved in a merger, acquisition, financing due diligence, reorganization, bankruptcy, receivership, dissolution, sale of all or a portion of our assets, or transition of service to another provider (collectively a “Transaction”), your personal information and other information may be shared in the diligence process with representatives or counterparties and others assisting with the Transaction and transferred to a successor or affiliate as part of that Transaction along with other assets. Additionally, we may share information, including personal information with our Affiliates, which include Workato Europe, S.A., and Workato Pte. Ltd., and other Affiliates as updated from time to time for administrative, operational, support and marketing purposes.” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ The Service contains links to websites and applications other than the Service, including websites and applications operated by affiliates and other third parties. We do not determine and we are not responsible for the privacy practices or content of websites and applications owned or operated by third parties. Your browsing and interaction on any third-party website or service, including those that have a link on our Services and/or Site, are subject to that third party’s terms and conditions and policies. We encourage you to read the privacy statements and other terms and conditions of third-party websites and applications linked to the Service every time you leave the Service to access such third-party websites.” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ We may share your personal information by disclosing it to a third party for a business purpose as stated below. We only make these business purpose disclosures under written contracts that describe the purposes, require the recipient to keep the personal information confidential, and prohibit using the disclosed information for any purpose except performing the contract. In the preceding twelve (12) months, Workato has disclosed personal information for a business purpose to the categories of third parties indicated in the chart below in subsection 5.C (“Categories of Third-Party Recipients of Personal Information”). We do not sell personal information. In the preceding twelve (12) months, we have not sold personal information.” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ For all paying Users, we maintain a record of Service subscriptions, invoices, billing and payment information. For Users who pay by credit card, our third-party payment sub-processor as listed on our subprocessor page will process your credit card information. We will collect and associate the payment information with a Subscription ID but we do not store any payment card information ourselves. If you have questions about how our processor or subprocessor protects the data it receives from Users, please refer to its websites as listed in https://www.workato.com/legal/sub-processors .” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ j) comply with applicable laws, lawful requests, and legal process, such as to respond to subpoenas or requests from government authorities;” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “learning management systems, customer relationship management programs, mail- management software, and hosting partners” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ Workato shares personal information with its Affiliates and third-party service providers (such as its credit card processors, learning management systems, support services, research and analytics services, and hosting partners) to provide the necessary hardware, software, networking, storage, and other services we use to operate the Service and maintain a high-quality User experience, or to assist us with our other rightful use of personal information as described in Section 4 (“Use of Personal Information”). Workato may store personal information in internal third-party marketing, customer relationship management (“CRM”) programs and mail-management software to facilitate interactions with Users or potential customers and for Workato’s sales and marketing purposes. Workato may share personal information with its business partners who offer to resell Workato’s products or services, or professional advisers to the extent we are obligated to share or have a legitimate interest in sharing. In all situations where Workato discloses personal information to third parties acting as service providers or "agents" acting on behalf of Workato, Workato requires the recipient to adequately protect personal information and treat it as confidential.” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | low | “ Providing information to current and prospective users of our products and services” | Captured 2026-06-08Open source →Finding permalink → |
| Subprocessors & data sharing | All applicable tiers | medium | “ Compliance with legal obligations and legal process and protecting our rights, privacy, safety or property, and/or that of our affiliates, you or other third parties” | Captured 2026-06-08Open source →Finding permalink → |
| Tier differences | All applicable tiers | low | “ J. Non-public education” | Captured 2026-06-08Open source →Finding permalink → |
| Tier differences | All applicable tiers | medium | “ (a) The pricing and payment terms in the Reseller Agreement apply and all payment will be made directly to the Reseller, and, for the avoidance of doubt, the obligations outlined in Sections 5(a) - (d) of this Agreement shall not apply.” | Captured 2026-06-08Open source →Finding permalink → |
| Tier differences | All applicable tiers | low | “ (k) “ Subscription ” means the Account Holder’s subscription plan for the Workato Platform as set forth in the applicable Order Form.” | Captured 2026-06-08Open source →Finding permalink → |
| Tier differences | All applicable tiers | low | “ (f) “ Non-Paid Products ” means any products that may be made to Account Holder to try at its own option and discretion solely for its own evaluation use at no additional cost. These products include, but are not limited to: trial, test, alpha, beta, pilot, non-production, or non-paid subscriptions.” | Captured 2026-06-08Open source →Finding permalink → |
Informational only, not legal advice. Terms can change; verify every cited source and capture date during procurement review.
📢 POLICY UPDATES ALERT
AIRIN Brief
Built for compliance officers, legal counsel, and SaaS founders. Subscribe to the email digest — one short brief when a tracked vendor materially changes its terms, training policy, or risk rating. Prefer in-app? Watch platforms in your alerts inbox instead.