> Staffbase is a German internal communications platform. Review of its hosting, cookies, legal basis, employee privacy considerations and data residency. > > Canonical: https://www.flowconsent.com/en/services/other/staffbase Other # Staffbase Preferences · [Official website](https://staffbase.com) Staffbase is a German employee communication platform headquartered in Chemnitz. It is used by large enterprises across Europe to publish internal news, run employee surveys, branch communications by audience and reach employees through web, mobile and email. Tenants for European customers are hosted on AWS in Frankfurt. [Block Staffbase until consent](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=other) · [Scan my site](https://www.flowconsent.com/en/scan) At a glance - Category [Other](https://www.flowconsent.com/en/services/other) - Consent Preferences - Prior consent Required - Documented cookies 4 - Third-party domains 6 - Servers European Union by default for European customers: production tenants are hosted on AWS in eu central 1 (Frankfurt). US and APAC tenants are available on AWS in us east 1 and ap southeast 1. The region is locked at tenant provisioning and visible in the tenant URL. Overview ## What does Staffbase do? Staffbase is a leading European employee communication platform, founded in 2014 and headquartered in Chemnitz, Germany. Large enterprises such as DHL, Audi, Adidas and Wuerth use Staffbase to run internal news, employee app channels, surveys and personalised content delivery through web, mobile and email. Staffbase acquired Bananatag in 2021 to add email distribution to the suite. ## **What Staffbase does** Staffbase runs a multi tenant SaaS that combines a content management system for internal news, an employee app available on iOS and Android, a desktop intranet (Staffbase Hub), an email distribution module (Staffbase Email) and an analytics layer. Authentication uses the company's identity provider (Azure AD, Okta, Google Workspace) over SAML or OIDC. Content can be targeted by employee segments using HR attributes. ## **Data and cookies set** Staffbase sets strictly necessary cookies (sb\_session, sb\_token, sb\_csrf) for authentication and CSRF protection. Optional functionality cookies remember theme and reading preferences. Read receipts, click events and survey responses are processed on the server. The mobile SDK uses Firebase Cloud Messaging or Apple Push Notification Service for push, which involves Google and Apple as sub processors but not as advertising vendors. ## **GDPR and ePrivacy implications** Staffbase processes employee data on behalf of the employer as a data processor under Article 28 GDPR. The standard legal basis is legitimate interest of the employer for non mandatory communications and the employment relationship for mandatory ones. In Germany the works council (Betriebsrat) and the federal data protection law (BDSG) impose additional consultation obligations. Read receipt analytics and engagement tracking should be carefully scoped to avoid being characterised as employee monitoring. ## **Consent requirements** Strictly necessary cookies do not require consent. Optional push notifications, geo location for site specific news, and analytics that link engagement to individual employees should be presented as separately consentable preferences inside Staffbase. Public marketing widgets that load Staffbase content on external sites must be gated by a CMP because Art 5(3) ePrivacy applies in that context. ## **Data transfers and hosting** European customers are hosted in AWS eu central 1 (Frankfurt) with no transfer to the United States in production. Support and engineering access from outside the EU is governed by Staffbase DPA and Standard Contractual Clauses. The mobile push notification path uses Google FCM and Apple APNs as sub processors, which are listed in the Staffbase DPA. Customers should verify the region locked at provisioning and the sub processor list in their privacy notice. ## **Practical compliance steps** Sign the Staffbase DPA and pin the EU region. Consult the works council before activating analytics features that reveal individual engagement. Limit read receipt visibility to aggregate dashboards. Configure SSO with the corporate IdP and disable Staffbase native accounts where possible. Document Staffbase, FCM and APNs in the records of processing. Review survey templates so that questions stay within the works agreement. Compliance ## Staffbase and the GDPR Staffbase is classified as “Preferences”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy. - Legal basis For internal employee communication: legitimate interest of the employer (Art 6(1)(f) GDPR) or the employment relationship (Art 6(1)(b)) for mandatory communications, plus consent (Art 6(1)(a)) for optional features like push notifications. For embedded widgets on public marketing sites: prior consent under Art 5(3) ePrivacy. - Risk level medium - Applicable regulations GDPR, BDSG, TDDDG (Germany), ePrivacy Directive, CCPA/CPRA, UK GDPR ### Impact assessment (DPIA) A DPIA is required for typical Staffbase deployments because the platform processes employee personal data at scale, may include profile pictures, organisation chart data, geolocation for mobile push, and survey responses that can include opinions and sentiment. The DPA must specifically describe employee monitoring constraints, the works council role, and any cross border access by support staff. Employee representatives must be consulted in jurisdictions where this is mandatory (Germany Betriebsrat, France CSE). ### Sample text for your banner > This intranet uses Staffbase to deliver internal communications, notifications and surveys. Strictly necessary cookies are set to keep you signed in and to load content. Optional features such as push notifications, analytics on read receipts and personalised content delivery require your separate consent and can be reviewed at any time in your Staffbase preferences. Cookies and trackers ## What Staffbase sets and contacts - Tracking method JavaScript widget embedded into the host page (or a native mobile SDK) that loads a Staffbase content card, branch and tracks employee interactions through first party and third party requests to Staffbase tenant URLs. Authentication is handled via SAML, OIDC or Staffbase native accounts. - Server location European Union by default for European customers: production tenants are hosted on AWS in eu central 1 (Frankfurt). US and APAC tenants are available on AWS in us east 1 and ap southeast 1. The region is locked at tenant provisioning and visible in the tenant URL. ### Cookies set (4) | Name | Type | Duration | Purpose | | ----------- | ------------------ | ------------- | ------------------------------------------------------------------------------------------------------ | | sb\_session | Strictly Necessary | Session | First party session cookie used to maintain the authenticated browser session on the Staffbase tenant. | | sb\_token | Strictly Necessary | 8 to 24 hours | First party authentication token issued by Staffbase or the corporate IdP after SSO login. | | sb\_csrf | Strictly Necessary | Session | First party CSRF protection cookie used to mitigate cross site request forgery on form submissions. | | sb\_locale | Preferences | 1 year | First party preference cookie storing the language selected by the employee. | ### Third-party domains contacted (6) - `staffbase.com` - `app.staffbase.com` - `cdn.staffbase.com` - `api.staffbase.com` - `fcm.googleapis.com` - `push.apple.com` Questions ## Frequently asked questions about Staffbase Can't find your question? Write to us, we answer fast. [Write to us](https://www.flowconsent.com/en/demo) ### Which cookies does Staffbase set? Staffbase sets strictly necessary cookies sb\_session (browser session), sb\_token (authentication token, typically 8 to 24 hours) and sb\_csrf (session, CSRF protection). Optional cookies remember theme and language preferences. The mobile SDK does not use cookies; it uses Firebase Cloud Messaging and Apple Push Notification Service tokens. ### Do employees have to consent to Staffbase? Strictly necessary cookies for authentication do not require consent. Optional features such as push notifications, geo location for site specific news and analytics that link engagement to an individual employee should be presented as separate preferences and consented to inside the Staffbase app or web settings. ### What is the legal basis for processing employee data? Performance of the employment contract (Art 6(1)(b) GDPR) for mandatory communications such as HR notices, health and safety alerts and policy updates. Legitimate interest of the employer (Art 6(1)(f)) for non mandatory engagement, with a documented balancing test and works council consultation where required. Consent (Art 6(1)(a)) for optional features. ### Are data transferred outside the EU? European tenants are hosted in AWS Frankfurt with no production transfer to the United States. Support and engineering teams may access the tenant from non EU locations under Standard Contractual Clauses. Firebase Cloud Messaging and Apple Push Notification Service involve Google and Apple as sub processors, with their own transfer mechanisms. ### Is a DPIA required? Yes. Staffbase processes employee personal data at scale, can include behavioural analytics (read receipts, click maps), and may be considered a tool for systematic monitoring of employees. A DPIA is recommended and in many cases legally required. The works council must be consulted in Germany and in France (CSE). ### How do I implement Staffbase compliantly? Sign the EU DPA, pin the region at provisioning. Configure SSO with the corporate identity provider and disable native Staffbase accounts. Limit engagement analytics to aggregate dashboards. Consult the works council before activating individual click and read tracking. Document Staffbase, FCM and APNs in the records of processing and in the employee privacy notice. ### Are there alternatives to Staffbase? Comparable European employee communication platforms include Beekeeper (Switzerland), Workvivo (Ireland, Zoom owned), LumApps (France), and Speakap (Netherlands). For Microsoft heavy environments, SharePoint Viva Engage or Yammer are alternatives. Each has its own hosting region, DPA terms and feature footprint. ### How do I update the cookie policy? List the three strictly necessary cookies (sb\_session, sb\_token, sb\_csrf) with their duration and purpose. Mention the optional functionality cookies (theme, language). On the mobile side, document FCM and APNs in the privacy notice with their respective transfer mechanisms. The intranet privacy notice should also describe engagement analytics and how to opt out. Same category ## More services: Other [See the whole category](https://www.flowconsent.com/en/services/other) ### [Applied CSR24](https://www.flowconsent.com/en/services/other/applied-csr24) [Applied CSR24 is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. Applied CSR24 offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, Applied CSR24 empowers organizations to optimize strategy and maximize return on investment.](https://www.flowconsent.com/en/services/other/applied-csr24) [Analytics](https://www.flowconsent.com/en/services/other/applied-csr24) · ### [DoorLoop](https://www.flowconsent.com/en/services/other/doorloop) [DoorLoop is a marketing platform that equips businesses with tools to amplify their digital presence and drive customer acquisition. It supports audience segmentation, campaign automation, and cross-channel engagement. DoorLoop provides real-time analytics and reporting dashboards for performance measurement and strategy optimization. By combining data intelligence with marketing execution, DoorLoop helps deliver the right message to the right audience at the right time.](https://www.flowconsent.com/en/services/other/doorloop) [Marketing](https://www.flowconsent.com/en/services/other/doorloop) · ### [CloudSponge](https://www.flowconsent.com/en/services/other/cloudsponge) [CloudSponge is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. CloudSponge integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, CloudSponge helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/other/cloudsponge) [Essential](https://www.flowconsent.com/en/services/other/cloudsponge) · ### [Countable](https://www.flowconsent.com/en/services/other/countable) [Countable is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Countable integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Countable helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/other/countable) [Other](https://www.flowconsent.com/en/services/other/countable) · ### [Buildertrend](https://www.flowconsent.com/en/services/other/buildertrend) [Buildertrend is a versatile web technology that supports digital platforms with specialized functionality and enhanced capabilities. It provides robust tools and services that integrate with modern websites and applications seamlessly. Buildertrend is designed to improve operational efficiency, user experience, and digital performance. Trusted by developers and businesses alike, Buildertrend offers reliable solutions that scale with organizational needs and evolving web standards.](https://www.flowconsent.com/en/services/other/buildertrend) [Preferences](https://www.flowconsent.com/en/services/other/buildertrend) · ### [Merlin](https://www.flowconsent.com/en/services/other/merlin) [Merlin is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Merlin supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Merlin ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.](https://www.flowconsent.com/en/services/other/merlin) [Preferences](https://www.flowconsent.com/en/services/other/merlin) ## Make your site compliant today. Free up to 25,000 sessions a month. No credit card, no commitment. [Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)