Subprocessors
Third-party providers that may access or process workforce data when operating TimeOff Manager.
Last updated: August 24, 2026
PositionMySite uses the subprocessors below to host and deliver TimeOff Manager. This list includes vendors that can access employee or workforce data in the normal course of providing the service.
We will update this page when we add or replace subprocessors that process customer workforce data.
| Vendor | Purpose | Data processed | Region |
|---|---|---|---|
| Cloudflare, Inc. | CDN and Tunnel to the application origin | All customer workforce data in transit and at the edge (including optional clock-in photos) | Canada (application origin); global CDN edge |
| SiteGround (SMTP) | Transactional email delivery | Names, email addresses, and content of workforce notifications (e.g. leave approvals, scheduled reports) | United States |
| Stripe, Inc. | Subscription billing and optional invoice online payments (Stripe Connect) | Customer account billing contacts and payment metadata (not employee time punches) | United States |
| Google LLC (Maps Platform) | Geocoding and map display for work locations and mileage | Addresses, coordinates, and route-related location data | United States |
| Google LLC (Gemini API) | Clock photo face verification when enabled by the customer | Selfie image submitted for verification at clock-in/out | United States |
| Google LLC (Firebase Cloud Messaging) | Mobile push notifications for the kiosk app | Device tokens and notification payloads | United States |
| Google LLC (Analytics) | Website and signed-in app usage analytics (Google Analytics) | Page views, device/browser metadata, and interaction events | United States |
Customers who connect optional calendar or accounting integrations authorize those providers separately for the data synced through those connections.