R2 Innovative Technologies, LLC ("R2IT") uses the following third-party subprocessors to operate the Teamworks platform. Each subprocessor is bound by contractual confidentiality and data-protection obligations and is selected based on its ability to provide a level of security and privacy commensurate with the data processed.
R2IT notifies Customers in advance of adding any new subprocessor that will process personal data. Customers may subscribe to subprocessor change notifications by emailing security@r2it.com.
Production Subprocessors
| Vendor | Service | Data Processed | Region |
|---|---|---|---|
| Amazon Web Services, Inc. | Cloud infrastructure: compute, managed database, object storage, CDN, load balancing, container registry, secrets management, and logging | All Customer Data and operational metadata | United States |
R2 Innovative Technologies, LLC (identity provider at login.r2it.com) |
Identity provider (OpenID Connect) — authentication, password and MFA management, session tokens | Authentication identifiers, email, hashed credentials, MFA enrollment data | United States |
| Twilio SendGrid, Inc. | Transactional email delivery (SMTP relay) | Recipient email address, subject, message body of system-generated notifications | United States |
The identity provider at login.r2it.com is operated by R2IT itself, not an external vendor. It is listed as a subprocessor for completeness because it is a logically separate service that holds authentication credentials.
Operational Subprocessors
These vendors support development and operations but do not, in normal operation, process Customer personal data:
| Vendor | Service | Notes |
|---|---|---|
| GitHub, Inc. | Source code hosting, CI/CD pipelines | No Customer personal data is stored. Build logs may incidentally include error messages. |
Future / Conditional Subprocessors
These vendors are not currently in production but may be added as features are enabled. Customers will be notified before any such addition affects their data:
| Vendor | Service | Status |
|---|---|---|
| TBD | SMS delivery for shift reminders | Planned — not yet integrated |
| TBD | Background-check verification | Customer-configurable — added per Customer request |
| TBD | Payment processing (PCI-DSS compliant) | Customer-configurable — full PAN never reaches Teamworks |
Vendor Diligence
For each subprocessor that processes personal data, R2IT reviews:
- Independent security attestations (SOC 2, ISO 27001, or equivalent) where available
- The vendor's data-processing terms and sub-processing practices
- The vendor's incident-notification commitments
- Data residency and transfer mechanisms
Independent attestations for the vendors above are available from each vendor directly:
- AWS: aws.amazon.com/compliance
- Twilio SendGrid: twilio.com/en-us/legal/security
- GitHub: github.com/security
Questions
For questions about subprocessors, to object to a new subprocessor, or to receive change notifications, contact security@r2it.com.