# Carrot Subprocessors

_Current as of February 26, 2026_

### Subprocessor
**Action Verb LLC**  
**Location**  
Las Vegas, Nevada, USA  
**Contact Information**  
[legal@files.com](mailto:legal@files.com)  
**Description of Services**  
Provides secure file storage services supporting the transfer of member data to Carrot’s systems in the United States.  
**Technical and Organizational Measures**  
Maintains documented administrative, technical, and organizational safeguards, including procedures for responding to data subject requests and protecting personal data.

### Subprocessor
**Amazon Web Services, Inc. (AWS)**  
**Location**  
Seattle, Washington, USA  
**Contact Information**  
[AWS Privacy (Chromeless)](https://aws.amazon.com/privacy/)  
**Description of Services**  
Provides cloud infrastructure and log aggregation services.  
**Technical and Organizational Measures**  
Maintains industry-standard administrative, technical, and physical safeguards, including identity and access management controls, encryption, and monitoring mechanisms.

### Subprocessor
**Blueshift**  
**Location**  
United States  
**Contact Information**  
Contact information available upon request.  
**Description of Services**  
Sends employee onboarding and registration communications and processes related personal data for those communications.  
**Technical and Organizational Measures**  
Implements administrative, technical, and physical safeguards designed to protect personal data and support compliance obligations.

### Subprocessor
**Fivetran Inc.**  
**Location**  
Oakland, California, USA  
**Contact Information**  
[privacy@fivetran.com](mailto:privacy@fivetran.com)  
**Description of Services**  
Facilitates secure migration of data from SaaS platforms into Carrot’s data warehouse.  
**Technical and Organizational Measures**  
Maintains security measures including encryption in transit, logical access controls, monitoring safeguards, and physical and environmental protections.

### Subprocessor
**Google LLC**  
**Location**  
Mountain View, California, USA  
**Contact Information**  
[https://support.google.com/cloud/contact/dpo](https://support.google.com/cloud/contact/dpo)  
**Description of Services**  
Provides internal business data storage services.  
**Technical and Organizational Measures**  
Maintains technical and organizational safeguards including access controls, encryption, monitoring, and documented processes to respond to data subject requests.

### Subprocessor
**Microsoft Corporation**  
**Location**  
Redmond, Washington, USA  
**Contact Information**  
[Microsoft Privacy Principles | Microsoft Trust Center](https://www.microsoft.com/en-us/trust-center/privacy)  
**Description of Services**  
Provides data hosting services.  
**Technical and Organizational Measures**  
Maintains administrative, technical, and physical safeguards, including access controls, encryption, monitoring, and data subject request procedures.

### Subprocessor
**OneSchema**  
**Location**  
United States  
**Contact Information**  
Contact information available upon request.  
**Description of Services**  
Processes employee eligibility files to validate, clean, and prepare data prior to ingestion into Carrot’s systems.  
**Technical and Organizational Measures**  
Maintains security controls and documented procedures designed to protect personal data processed on behalf of Carrot.

### Subprocessor
**Snowflake Inc.**  
**Location**  
Bozeman, Montana, USA  
**Contact Information**  
[privacy@snowflake.com](mailto:privacy@snowflake.com)  
**Description of Services**  
Provides cloud-based data warehouse infrastructure supporting reporting and analytics.  
**Technical and Organizational Measures**  
Maintains security and compliance controls including identity and access management, encryption, monitoring, and documented security policies.

### Subprocessor
**Tableau**  
**Location**  
United States  
**Contact Information**  
[Privacy Page](https://www.tableau.com/privacy)  
**Description of Services**  
Provides business intelligence and analytics tools used to generate reports and dashboards.  
**Technical and Organizational Measures**  
Maintains administrative, technical, and physical safeguards designed to protect personal data processed within its platform.