> How Unito Hub processes work data under GDPR. Subprocessor list, transfers to Canada and the US, legal basis, DPIA considerations and a sample consent text. > > Canonical: https://www.flowconsent.com/en/services/other/unito-hub Other # Unito Hub Unclassified · [Official website](https://unitohub.com) Two way SaaS integration platform from Unito (Montreal, Canada) that synchronises work items, projects, tickets and contacts across tools like Jira, Asana, Trello, ClickUp, Notion, HubSpot, GitHub, Salesforce and Microsoft 365. [Block Unito Hub until consent](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=other) · [Scan my site](https://www.flowconsent.com/en/scan) At a glance - Category [Other](https://www.flowconsent.com/en/services/other) - Consent Unclassified - Prior consent Not required - Documented cookies 4 - Third-party domains 4 - Servers Canada (Montreal) and United States (AWS regions). An EU data residency option is available on enterprise plans. Overview ## What does Unito Hub do? ## **What Unito Hub is** Unito Hub is a SaaS integration platform built by Unito Inc. (Montreal, Canada). It uses OAuth and APIs to read and write items in dozens of productivity, project management, CRM and engineering tools, then keeps them in sync with configurable rules. A typical use case is mirroring Jira tickets into Asana, ClickUp or HubSpot for cross team visibility. ## **Data handled** Unito processes whatever fields the customer maps in the sync flow: titles, descriptions, comments, attachments, due dates, assignees, custom fields, project metadata. It stores OAuth tokens for each connected tool, internal mapping tables, sync audit logs, customer accounts and billing data. The marketing website sets first party cookies and uses standard product analytics. ## **GDPR implications** Unito is a processor under the GDPR. The customer remains controller of all synced personal data (employee names, comments, customer information). The DPA includes SCCs, subprocessor list, security commitments (SOC 2 Type II, ISO 27001) and data subject rights support. ## **Consent and lawful basis** No end user consent is required to operate Unito Hub on internal data. The marketing site itself sets non essential cookies (Google Analytics, HubSpot, LinkedIn) that need consent under ePrivacy. Personal data of employees and customers is processed under Article 6(1)(b) GDPR (contract) or Article 6(1)(f) (legitimate interest), with appropriate transparency in the privacy notice. ## **International transfers** Unito hosts its production environment on AWS in the US, with operational staff in Canada. Canada has a partial adequacy decision, the US relies on SCCs and the EU US Data Privacy Framework. Enterprise customers can request an EU data residency option for their workspace. ## **Practical compliance steps** Sign the DPA, review the Unito subprocessor list, configure least privilege OAuth scopes on each connected tool, restrict who can create syncs, exclude sensitive fields from rules when possible, define retention for sync logs, document the flow in your ROPA and run a DPIA if HR, health or financial data is involved. Compliance ## Unito Hub and the GDPR - Legal basis Article 6(1)(b) GDPR (contract performance) when the customer uses Unito as a business productivity tool. Article 6(1)(f) (legitimate interest) covers service security, abuse prevention and product analytics on the marketing website. - Risk level medium - Applicable regulations GDPR, ePrivacy Directive, German TTDSG, French CNIL guidance on cloud subprocessors, Spanish LOPDGDD, Canadian PIPEDA ### Impact assessment (DPIA) A DPIA is recommended when Unito Hub is used to sync employee performance data, HR records, sensitive customer information, healthcare or financial work items, or when large volumes of data subjects are involved through the connected tools. ### Sample text for your banner > We use Unito Hub (Unito, Canada) to synchronise work items between our internal tools. Unito acts as a processor under a DPA, with transfers to Canada and the United States covered by Standard Contractual Clauses and the EU US Data Privacy Framework. Cookies and trackers ## What Unito Hub sets and contacts - Tracking method OAuth tokens, API keys, webhooks, server side polling between SaaS tools, optional analytics cookies on the marketing site - Server location Canada (Montreal) and United States (AWS regions). An EU data residency option is available on enterprise plans. - Cookieless mode available Yes - Data transferred outside the EU Unito is a Canadian company operating mainly in Canada and the United States. Canada benefits from a partial adequacy decision; transfers to the United States rely on Standard Contractual Clauses and, where applicable, the EU US Data Privacy Framework. ### Cookies set (4) | Name | Type | Duration | Purpose | | -------------- | ---- | -------- | ------------------------------------------------------------------------------------------------ | | unito\_session | http | Session | Strictly necessary cookie that keeps the user signed in to the Unito web app. | | unito\_csrf | http | Session | CSRF protection token used by the Unito web app forms. | | unito\_pref | http | 1 year | Stores UI preferences such as language and theme. | | \_ga | http | 2 years | Google Analytics cookie set by the Unito marketing website to measure traffic; requires consent. | ### Third-party domains contacted (4) - `unito.io` - `app.unito.io` - `api.unito.io` - `cdn.unito.io` Questions ## Frequently asked questions about Unito Hub Can't find your question? Write to us, we answer fast. [Write to us](https://www.flowconsent.com/en/demo) ### Which cookies does Unito Hub set? Unito sets strictly necessary cookies in its web app (unito\_session, unito\_csrf, unito\_pref) for sign in and UI preferences, and uses third party analytics cookies (Google Analytics) on its marketing website, which require consent. ### Do I need user consent to use Unito Hub? No for the application itself when used internally on company data. Yes for the marketing site cookies (analytics, advertising) and for any visible employee data sync that requires transparency under Article 13 GDPR. ### What is the legal basis for processing? Article 6(1)(b) GDPR (contract performance) for the internal productivity use case. Article 6(1)(f) (legitimate interest) for IT security, abuse prevention and aggregate product analytics. Employee data should be assessed against the controller workplace policy and any works council requirements. ### Does Unito transfer data outside the EU? Yes. Unito hosts the production environment on AWS in the United States and operates teams in Canada. Transfers rely on SCCs, the EU US Data Privacy Framework and the partial adequacy decision for Canada. An EU residency option is available for enterprise plans. ### Do I need a DPIA? A DPIA is recommended when Unito Hub synchronises HR records, employee performance data, sensitive customer information or large volumes of personal data through the connected tools. For low risk task syncing between standard project management tools, a DPIA is not normally required. ### How do I implement Unito Hub compliantly? Sign the DPA, review subprocessors, configure least privilege OAuth scopes, restrict who can create flows, exclude sensitive fields, document the data flow in your ROPA, inform employees via the privacy notice or works council, and run a DPIA if HR or sensitive data is involved. ### What are the alternatives? Other integration platforms include Zapier, Make (Integromat), Workato, Tray.io, Boomi, Mulesoft, n8n (open source, EU friendly) and native integrations within the connected SaaS tools. EU based alternatives reduce transfer risk. ### How do I update the cookie policy? List Unito as a processor in the privacy notice when used internally. If you embed any Unito widget on a public site, add the strictly necessary cookies (session, csrf, pref) to your cookie list, plus the marketing site analytics cookies if they end up on your domain. Same category ## More services: Other [See the whole category](https://www.flowconsent.com/en/services/other) ### [Checkly](https://www.flowconsent.com/en/services/other/checkly) [Checkly is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Checkly supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Checkly ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.](https://www.flowconsent.com/en/services/other/checkly) [Other](https://www.flowconsent.com/en/services/other/checkly) · ### [Registria](https://www.flowconsent.com/en/services/other/registria) [Registria is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. Registria offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, Registria empowers organizations to optimize strategy and maximize return on investment.](https://www.flowconsent.com/en/services/other/registria) [Analytics](https://www.flowconsent.com/en/services/other/registria) · ### [WAR.PE](https://www.flowconsent.com/en/services/other/war-pe) [WAR.PE is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. WAR.PE integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, WAR.PE helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/other/war-pe) [Essential](https://www.flowconsent.com/en/services/other/war-pe) · ### [Bullseye](https://www.flowconsent.com/en/services/other/bullseye) [Bullseye is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Bullseye supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Bullseye ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.](https://www.flowconsent.com/en/services/other/bullseye) [Preferences](https://www.flowconsent.com/en/services/other/bullseye) · ### [Site Search 360](https://www.flowconsent.com/en/services/other/site-search-360) [Site Search 360 is an analytics and measurement platform providing deep insights into digital ecosystem performance. It tracks user interactions, measures campaign effectiveness, and identifies optimization opportunities across web and mobile. Site Search 360 offers customizable dashboards, automated alerts, and data export capabilities. By transforming raw data into actionable intelligence, Site Search 360 empowers organizations to optimize strategy and maximize return on investment.](https://www.flowconsent.com/en/services/other/site-search-360) [Analytics](https://www.flowconsent.com/en/services/other/site-search-360) · ### [Sporcle](https://www.flowconsent.com/en/services/other/sporcle) [Sporcle is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Sporcle supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Sporcle ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.](https://www.flowconsent.com/en/services/other/sporcle) [Analytics](https://www.flowconsent.com/en/services/other/sporcle) ## Make your site compliant today. Free up to 25,000 sessions a month. No credit card, no commitment. [Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)