Maximus sub-processors
A sub-processor is a third party that processes customer data on Maximus's behalf. Maximus publishes the categories it engages, gives 30 days' notice before that list changes, and holds each engagement to a data-processing agreement that flows the same obligations down from the customer's own contract.
The list is being published and is not live yet. Every cell marked TODO-SUBSTANTIATE is awaiting confirmation of the executed agreement; none of them is a redaction, and no name is written here until the agreement behind it is confirmed. See the request form on the security page to ask for the current list under NDA.
Sub-processors Maximus engages
Every third party Maximus engages to process customer data, what each one processes and the reason it is engaged.
| Sub-processor | Category | Purpose | Data processed | Region |
|---|---|---|---|---|
| TODO-SUBSTANTIATE | Application hosting, edge network and CDN | Serving the Maximus web application and static assets, and terminating TLS at the edge. | TODO-SUBSTANTIATE — request metadata and any customer data in transit at the edge. | TODO-SUBSTANTIATE |
| TODO-SUBSTANTIATE | Managed application database | Storing customer records, agent-run history, audit logs and workspace configuration. | TODO-SUBSTANTIATE — the primary customer data store. | TODO-SUBSTANTIATE |
| TODO-SUBSTANTIATE | Object storage and encrypted backups | Storing exports, generated documents and encrypted backups of the primary datastore. | TODO-SUBSTANTIATE — customer data and derived export artifacts. | TODO-SUBSTANTIATE |
| TODO-SUBSTANTIATE | Payment processing | Processing subscription payments and producing invoices. Card data is entered directly with the payment provider and never touches Maximus servers. | TODO-SUBSTANTIATE — billing contact details and payment instruments held by the provider. | TODO-SUBSTANTIATE |
| TODO-SUBSTANTIATE | Transactional email delivery | Delivering account, security and product emails such as receipts and notifications. | TODO-SUBSTANTIATE — recipient address and message content. | TODO-SUBSTANTIATE |
| TODO-SUBSTANTIATE | Product analytics | Aggregate measurement of how the product is used, to decide what to build next. | TODO-SUBSTANTIATE — pseudonymous usage events. | TODO-SUBSTANTIATE |
| TODO-SUBSTANTIATE | Error monitoring and performance tracing | Capturing exceptions and traces so that defects are detected and diagnosed. | TODO-SUBSTANTIATE — diagnostic metadata, with payload scrubbing. | TODO-SUBSTANTIATE |
| TODO-SUBSTANTIATE | Identity and single sign-on | Authenticating users through the customer's identity provider under SAML 2.0 and SCIM. | TODO-SUBSTANTIATE — authentication identifiers and directory attributes. | TODO-SUBSTANTIATE |
| TODO-SUBSTANTIATE | Foundation model providers | Reasoning over customer signals so the customer success agents can decide when an account needs attention and what to do about it. Customer data is not used to train these models. | TODO-SUBSTANTIATE — the signal and context sent with each inference request. | TODO-SUBSTANTIATE |
| TODO-SUBSTANTIATE | Customer CRM and data-warehouse connectors | Reading customer context from, and writing back to, the systems the customer authorises through OAuth. | TODO-SUBSTANTIATE — records in the connected system, scoped to the OAuth grants the customer approves. | TODO-SUBSTANTIATE |
A row appears here only once the engagement is executed, so this list can lag the systems Maximus operates. Ask for the current list, or query a specific vendor, through the security request form.
Notice before the list changes
A sub-processor list that can change silently is not a disclosure, so the commitment is about the notice, not the list.
Maximus gives 30 days' notice before adding or replacing a sub-processor that processes customer data. The notice goes to the workspace's nominated security contacts, and it names the incoming sub-processor, what it will process and where it will run.
Each sub-processor is bound by a data-processing agreement that flows the same obligations down from the customer's own contract. That includes the commitment that customer data is not used to train foundation models, confidentiality, assistance with data-subject requests, and deletion on termination.
The notification mechanism, the contact it reaches and the objection window are being confirmed and are marked TODO-SUBSTANTIATE on this page until they are. The 30-day period itself is the commitment stated in the data processing addendum, which is the document that governs it.
Need a vendor you don't see listed?
Ask. A vendor that is absent because the agreement is still being executed is a different answer from one that is absent because Maximus does not use it, and the security team will tell you which.
Cells marked TODO-SUBSTANTIATE are pending confirmation and are not published commitments.