Service Providers & Data Flows
Version 2026-09-27.2 · applies to Workniva at workniva.com and the field attendance app.
How to read this list
The following providers or provider categories can be involved when a feature is used. Inclusion does not mean every integration is enabled for every workspace. This is a product data-flow summary, not a signed data processing agreement or a verified list of all production subprocessors. Ask the privacy contact for the currently contracted providers, locations, safeguards and relevant data processing terms.
Hosting, storage and email
Hosting infrastructure processes application databases, private files and operational logs. Email delivery providers process addresses and notification/support content. The deployment supports DigitalOcean hosting and local private storage or an S3-compatible provider; the actual infrastructure and location must be confirmed with the operator. Backups can contain the same data and require separate access and retention controls.
AI, transcription and generated speech
A configured AI/vision provider receives submitted prompts, authorized supporting evidence and selected receipts. Sarvam processes submitted speech for transcription. Microsoft Azure Speech processes answer text for spoken output. The AI provider is configurable and is not necessarily the same as either speech provider. Ask which model/provider and retention terms apply before sending sensitive information.
Payments, identity and messaging
Cashfree handles one-time payments for prepaid packs and returns payment references and status; UPI payments made directly to the operator account are verified manually against the payment reference. Google can provide login identity when enabled. Meta WhatsApp Cloud API or Twilio can deliver opted-in WhatsApp messages to the selected phone number. Configured email services deliver verification, support and notifications. Provider accounts, templates and their own terms can affect availability and data handling.
Fonts and diagnostics
Google Fonts receives font requests from the website. Sentry error monitoring is enabled and processes diagnostic events on servers in the European Union. It is configured not to send personal data: request bodies are never transmitted, and user identifiers, cookies, headers and IP addresses are not attached to events. What is sent is the exception type, the code location, and the software version. Customers and the operator should still review events and uploaded content to avoid unnecessary sensitive information in provider payloads or logs.