R2 Innovative Technologies, LLC ("R2IT") uses the following third-party subprocessors to operate the Teamworks platform. Each subprocessor is bound by contractual confidentiality and data-protection obligations and is selected based on its ability to provide a level of security and privacy commensurate with the data processed.
R2IT notifies Customers in advance of adding any new subprocessor that will process personal data. Customers may subscribe to subprocessor change notifications by emailing security@r2it.com.
Production Subprocessors
| Vendor | Service | Data Processed | Region |
|---|---|---|---|
| Amazon Web Services, Inc. | Cloud infrastructure: compute, managed database, object storage, CDN, load balancing, container registry, secrets management, and logging | All Customer Data and operational metadata | United States |
R2 Innovative Technologies, LLC (identity provider at login.r2it.com) |
Identity provider (OpenID Connect) — authentication, password and MFA management, session tokens | Authentication identifiers, email, hashed credentials, MFA enrollment data | United States |
| Twilio SendGrid, Inc. | Transactional email delivery (SMTP relay) | Recipient email address, subject, message body of system-generated notifications | United States |
The identity provider at login.r2it.com is operated by R2IT itself, not an external vendor. It is listed as a subprocessor for completeness because it is a logically separate service that holds authentication credentials.
Operational Subprocessors
These vendors support development and operations but do not, in normal operation, process Customer personal data:
| Vendor | Service | Notes |
|---|---|---|
| GitHub, Inc. | Source code hosting, CI/CD pipelines | No Customer personal data in normal operation. Internal pre-production issue reports may incidentally include personal data typed by R2IT staff. |
Future / Conditional Subprocessors
These vendors are not currently in production but may be added as features are enabled. Customers will be notified before any such addition affects their data:
| Vendor | Service | Status |
|---|---|---|
| TBD | SMS delivery for shift reminders | Planned — not yet integrated |
| TBD | Background-check verification | Customer-configurable — added per Customer request |
| TBD | Payment processing (PCI-DSS compliant) | Customer-configurable — full PAN never reaches Teamworks |
| Anthropic PBC | AI-assisted text processing and retrieval-augmented assistance | Planned — not in production. Currently used only in R2IT internal pre-production environments. |
Vendor Diligence
For each subprocessor that processes personal data, R2IT reviews:
- Independent security attestations (SOC 2, ISO 27001, or equivalent) where available
- The vendor's data-processing terms and sub-processing practices
- The vendor's incident-notification commitments
- Data residency and transfer mechanisms
Independent attestations for the vendors above are available from each vendor directly:
- AWS: aws.amazon.com/compliance
- Twilio SendGrid: twilio.com/en-us/legal/security
- GitHub: github.com/security
- Anthropic: trust.anthropic.com
Questions
For questions about subprocessors, to object to a new subprocessor, or to receive change notifications, contact security@r2it.com.