AI Agents & Assistants
Moveworks
Rest of world Report an errorPanel rating · 6 judges · How to read the stars
Category median
Sovereignty: 1 of 4 dimensions proven
0–5 in half steps. 5 means the rubric's top anchor is met on the evidence.
by Moveworks, Inc. · www.moveworks.com
Report an error on this page Is this your product? →
Link to this page
Add ?theme=dark to the image address for dark backgrounds.
The badge shows the category and the month of the latest evaluation, and EU-Made where
that is the product’s provenance. It never shows a score.
Moveworks at a glance
- Vendor
- Moveworks, Inc.
- Headquarters
- Not stated on the vendor’s pages as of 26 Oct 2026
- Data hosting
- Not stated on the vendor’s pages as of 26 Oct 2026
- Free plan
- Not stated on the vendor’s pages as of 26 Oct 2026
- Panel verdict
- The AI panel rates Moveworks 2.5/5, the mean of 6 judges. Moveworks, an AI assistant platform for employees to search and act across business applications from US vendor Moveworks, Inc. how scores are made
- As of
- Vendor pages captured 26 Oct 2026; evaluated by the panel 28 Oct 2026. all sources
Read this page as one judge. Each weighs the same scores by what they care about.
The panel's verdict
Moveworks, an AI assistant platform for employees to search and act across business applications from US vendor Moveworks, Inc. (acquired by ServiceNow per its homepage), scores highest on reach and agent building: integrations and knowledge at 6-7 and agent capabilities at 6-7, citing 50+ content sources, over 100 pre-built plugins, custom HTTP connectors with no stated limit, MCP and agent-to-agent support, and compound actions with branches, loops, parallel steps and error handling. Weakest are data use and training at 3-4 and sovereignty at 3-4. The pages state that nothing a user says or rates in chat changes the models, yet disclose that Moveworks teams review masked, anonymized, randomly sampled usage data on a regular release cycle. Judges found no public information on a data processing agreement, retention periods for chats and files, a subprocessor list, or where OpenAI and Azure OpenAI run inference; AWS hosting remains subject to the US CLOUD Act regardless of server location. Admin and access drew the widest spread, 4 to 6, with lower scores citing missing SSO and SCIM provisioning. Pricing transparency sits at 0.
Speaks for it
- Over 50 content sources including Slack, SharePoint, Confluence and Outlook, plus more than 100 pre-built plugins and custom HTTP connectors with no stated count limit.
- Compound actions chain multi-step workflows with conditional branches, loops, parallel steps, error handling and interactive notifications.
- Every plugin run is logged with its external API calls, alongside configuration change, permissions change and RBAC audit logs.
- The PII Viewer add-on lifts PII redaction only when paired with a Setup role and grants nothing on its own.
- An EU Commercial region on AWS is offered with per-datacenter endpoints and credentials, and the vendor states all customer data remains in its region.
Held against it
- Moveworks teams regularly review masked, anonymized, randomly sampled usage data to improve models on a regular release cycle — disclosed, but not a customer-controlled regime.
- Retention is addressed only through an admin-set conversation lookback of 24 hours by default, and we found no public information on retention periods for chats and files or on a data processing agreement.
- We found no public information on training and retention terms with OpenAI and Azure OpenAI, or on where those providers run inference.
- AWS as the hosting provider is US-headquartered and subject to the US CLOUD Act regardless of server location, and we found no public information on a subprocessor list.
- We found no public information on single sign-on, SCIM provisioning, or group-level control over which models, agents and connectors a team may use.
Best for
- You need an employee-facing assistant that searches 50+ content sources and executes actions in HR, IT and finance systems through APIs.
- Your team builds its own automations and wants compound actions with branching, loops and error handling, webhook-triggered agents, and custom HTTP connectors with no stated limit.
- You want connections to internal systems to stay on your side, using customer-hosted Content, Identity, Knowledge and Forms Gateways and the on-premises Moveworks Agent.
- You need a record of what agents did, since every plugin run is logged with its external API calls.
Avoid if
- Your compliance regime requires EU-anchored processing end to end — the contracting entity is Moveworks, Inc. in the USA, hosting runs on AWS, a US-headquartered provider subject to the US CLOUD Act regardless of server location, and the model layer includes OpenAI and Azure OpenAI.
- Your data protection review requires a customer-controlled regime over usage data — the captured pages disclose regular Moveworks-team review of masked, anonymized, randomly sampled usage data for model improvement.
- You need a published price to budget — ask the vendor: the public pages we read do not show it
The scores
| Criterion | Panel median |
|---|---|
| Data use, training & retention | 2 of 5 |
| Models & processing location | 2.5 of 5 |
| Admin, identity & access controls | 2.5 of 5 |
| Integrations, connectors & knowledge | 3.5 of 5 |
| Agent capabilities & guardrails | 3.5 of 5 |
| European sovereignty | 2 of 5 |
Data use, training & retention
Show reasoningHide reasoning
How this is scored
What happens to prompts, uploaded files, connected data and outputs: whether any of it trains a model (the vendor's or a model provider's), how long it is kept and where logs live, whether zero-retention is available, and whether a data processing agreement covers it.
0 — No statement on training or retention; the privacy policy is a website policy that does not cover the product.
3 — A general statement that business data is "not used for training", with no word on retention, on the model providers behind the product or on logs.
5 — Business data excluded from training by contract, retention periods stated for chats and files, and a DPA offered to business customers.
8 — No-training commitments stated for the vendor and every model provider it routes to, retention configurable by the admin (including deletion of chat history), zero-data-retention terms with the model providers named, and abuse-monitoring retention described.
10 — Data use fully accounted for: training, retention, logging and abuse monitoring stated per model provider, customer-controlled retention and deletion with an audit trail, outputs and connected data treated as customer data in the DPA, and an independent audit (SOC 2, ISO 27001 or ISO 42001) covering the product.
The Head of IT
The docs state plainly that nothing a user says or rates in chat changes the models, and they disclose that Moveworks teams review masked, anonymized, randomly sampled usage data to improve models on a regular release cycle. Retention is addressed only through an admin-set conversation lookback (24 hours by default); we found no public information on retention periods for chats and files, on a data processing agreement, or on training and retention terms with the named model providers OpenAI and Azure OpenAI. 7 3
The Data Protection Officer
The captured pages state that nothing a user says or rates in chat changes the models and that only data needed to run the service is collected, with the conversation lookback window set by the admin (24 hours by default). We found no public information on retention periods for chats and files, on a data processing agreement, or on training and retention terms with the model providers behind the product; usage data is reviewed masked and anonymized by Moveworks teams to improve the models, which is disclosed but is not a customer-controlled regime. 3 7
The Automation Lead
The documentation states plainly that nothing a user says or rates in chat changes the models, and it discloses that Moveworks teams review masked, anonymized, randomly sampled usage data on a regular release cycle — that is honest, and data minimization is claimed. But we found no public information on retention periods for chats and files, on a data processing agreement, or on zero-retention terms with the model providers behind the assistant, so I could not run a compliant deployment on this alone. 3 7
The Customer-Service Director
The documentation states plainly that nothing a user says or rates in chat changes the models, and is unusually candid that masked, anonymized samples of usage data are reviewed by Moveworks teams to improve models on a regular release cycle. But we found no public information on retention periods for chats and files, on a data processing agreement for business customers, or on how the third-party model providers behind the product handle our transcripts and logs. 3 5 7
The Works Council Member
Nothing a user says or rates in chat changes the models, and that is stated plainly — good. But the same documentation says Moveworks teams regularly review masked, anonymized, randomly sampled usage data on a model improvement cycle, and I found no word on retention with the OpenAI and Azure OpenAI providers, no documented data processing agreement, and no admin deletion of chat history beyond a 24-hour conversation lookback the admin sets. 7 3
The Skeptic
The documentation says plainly that nothing a user says or rates in chat changes the models, yet it also discloses that Moveworks annotation teams and ML engineers review masked, anonymized, randomly sampled usage data and feed it into model improvements on a regular release cycle — honest, but it is human use of your usage data. We found no public information on retention periods for chats and files, on a data processing agreement, or on training and retention terms with OpenAI or Azure OpenAI, the named model providers behind the product. 3 5 7
Models & processing location
Show reasoningHide reasoning
How this is scored
Which models sit behind the product and who runs them, where inference and storage happen, whether the customer can pin processing to the EU, choose or exclude model providers, bring its own model or key, or run the product in its own cloud or on premises.
0 — The models behind the product and the processing location are not stated.
3 — The model family is named, but where inference runs and through which provider (the model maker, a hyperscaler, the vendor) is unstated.
5 — Models and their providers named, with an EU processing option stated for storage and at least the default model.
8 — Each available model listed with provider and inference region, EU-only processing selectable by the admin and enforced across models, model providers excludable, and bring-your-own-key or own-cloud deployment documented.
10 — Processing fully under the customer's control and documented: EU-only or on-premises inference for every feature including agents and connectors, open-weight or self-hosted models supported, data flows per feature published, and a residency commitment in the contract rather than on a marketing page.
The Head of IT
Models and providers are named — Moveworks fine-tuned models plus third-party LLMs from Azure OpenAI and OpenAI, with foundation models GPT 5.4 and 5.5 — and hosting runs on AWS with an EU Commercial region, published per-datacenter endpoints and a statement that all customer data stays in its region. The LLM Gateway can prioritize requests by residency requirements, but we found no public information on inference regions per model, an admin-enforced EU-only setting across models, provider exclusions or bring-your-own-key; the on-premises Moveworks Agent exists without a statement that it covers inference. 7 3 10 11
The Data Protection Officer
The models and their providers are named — Moveworks fine-tuned models plus Azure OpenAI and OpenAI, with foundation models GPT 5.4 and 5.5 — and hosting runs on AWS with an EU Commercial region, published per-datacenter base URLs, and the statement that all customer data remains in its region. We found no public information on where model inference actually runs, on an admin setting that pins processing to the EU, or on bring-your-own-key; the LLM Gateway can prioritize requests by data-residency requirements, but no EU commitment for model traffic is published. 3 7 10
The Automation Lead
Every layer is named: Moveworks fine-tuned models plus Azure OpenAI and OpenAI behind an LLM gateway, hosted on AWS with an EU Commercial region, per-datacenter API endpoints and credentials, and gateway routing that can prioritise data-residency requirements. What the captured pages do not show is admin-enforced EU-only inference per model, the ability to exclude a provider, or bring-your-own-key, so I cannot pin every prompt to Europe from the evidence. 3 7 10
The Customer-Service Director
The model line-up is better documented than most: Moveworks' own fine-tuned models plus third-party LLMs from Azure OpenAI and OpenAI, routed through an LLM Gateway with Frontier, Standard or Basic tracks, and customer data can sit in an EU Commercial region on AWS that remains in its region with residency-aware routing. We found no public information on where inference actually runs for those third-party models, or on excluding providers or bringing our own key. 3 7 10
The Works Council Member
The models and providers are named — Moveworks' fine-tuned models plus Azure OpenAI and OpenAI, routed through a residency-aware LLM gateway — and an EU hosting region on AWS is offered where all customer data stays in its region. I found no statement of where the third-party providers actually run inference, and the admin chooses a Frontier, Standard or Basic reasoning track rather than a provider, region or exclusion. 7 3 10
The Skeptic
The models are named — GPT 5.4 and 5.5 foundation models plus Moveworks fine-tuned task models — and so are the providers: Moveworks itself, Azure OpenAI and OpenAI, reached through an LLM gateway that routes each request to "the best model for the task". Hosting is on AWS with regional deployments including EU Commercial, per-datacenter endpoints, credentials registered per data center, and residency-aware routing. We found no public information on where inference runs for the third-party models, on an admin setting to pin processing to the EU or exclude a provider, or on bring-your-own-key or own-cloud deployment. 3 7 10
Admin, identity & access controls
Show reasoningHide reasoning
How this is scored
What the IT department controls: SSO and SCIM provisioning, roles and groups, which models, agents and connectors each group may use, retrieval that respects the permissions of the source system, audit logs, usage reporting, and policies such as data-loss prevention — and whether reporting on staff use is scoped and documented.
0 — No admin features documented; accounts are individual sign-ups.
3 — A team workspace with an owner and member invitations, but no SSO, no roles and no audit log.
5 — SSO, admin and member roles, user management, and an admin view of usage.
8 — SAML/OIDC SSO with SCIM provisioning, group-based permissions for models, agents and connectors, retrieval that inherits source-system permissions, exportable audit logs, and usage analytics with documented scope.
10 — Governance a regulated company can operate: fine-grained policies (DLP, content filters, prompt and output logging rules), audit logs streamed to a SIEM, per-agent ownership and approval, usage reporting that can be aggregated or pseudonymised for works-council agreements, and every admin action logged.
The Head of IT
The role model is real — Administrator, User, Super Administrator, a read-only Setup viewer and a gated PII-viewer add-on that on its own grants no access — and audit coverage is better than most: role assignments and revocations are captured, with real-time configuration, permissions and built-in plugin run logs. For an 800-seat rollout the missing plumbing is identity federation: we found no public information on SSO or SCIM provisioning, group-based entitlements to specific models, agents or connectors, retrieval that inherits SharePoint permissions, or export of audit logs to a SIEM. 8 9 7
The Data Protection Officer
Predefined roles (Administrator, User, Super Administrator) with assignment restricted to senior admins, role and permission changes captured in audit logs, configuration change logs and built-in plugin run logs, and a tightly scoped PII Viewer add-on that controls who can lift PII redaction give a real governance layer. We found no public information on SSO or SCIM provisioning, on group-based permissions for models, agents and connectors, or on streaming audit logs to a SIEM. 8 9
The Automation Lead
Role-based access control is real and layered — Administrator, User and Super Administrator plus a beta read-only Setup viewer and an add-on PII Authorized Viewer that lifts redaction only when paired with a Setup role — and the audit story is better than most, with logs of configuration and permissions changes plus plugin run logs capturing external API calls. We found no public information on SSO or SCIM provisioning, on group-level scoping of which models, agents or connectors a team may use, or on usage analytics scope, which is what I need before wiring this into our ERP. 7 8 9
The Customer-Service Director
Roles go beyond a simple workspace — Administrator, User, Super Administrator, a beta View Only role and even a PII Viewer add-on that must be paired with another role to grant anything — with audit logs for configuration changes, permissions and every plugin run, and role changes themselves captured. We found no public information on single sign-on, SCIM provisioning, or group-level permissions over which models, agents and connectors each team may use, which my IT lead will demand before forty agents go live. 8 9
The Works Council Member
There is a real role system — Administrator, User, Super Administrator plus a read-only Setup role — and three documented logs (audit, configuration change, permissions change) with role assignments captured in the RBAC audit log; the default PII redaction that only a special add-on role can lift is exactly the kind of written rule a works council wants. I found no public information on single sign-on, SCIM provisioning, group-scoped permissions for models, agents or connectors, or usage reporting that can be aggregated or pseudonymised. 8 9
The Skeptic
Roles are documented in real depth — Administrator, User, Super Administrator, a read-only viewer and a PII-authorized viewer that only takes effect paired with another role — and there are four documented log surfaces covering configuration changes, permission changes, plugin runs and role assignments; notably, revoking Super Administrator access is controlled by Moveworks itself. We found no public information on single sign-on, SCIM provisioning, group-level control over which models, agents or connectors each group may use, or export of audit logs. 7 8 9
Integrations, connectors & knowledge
Show reasoningHide reasoning
How this is scored
How the product reaches company knowledge and systems: connectors to file stores, wikis, mail, CRM, ticketing and ERP, how fast and how completely they sync, the API, support for open protocols such as MCP, and how the assistant cites the sources it answers from.
0 — No integrations; users paste text or upload files one at a time.
3 — File upload and one or two connectors (for example a drive), with no API and no statement on sync or citations.
5 — A connector library covering the common file stores, wikis and collaboration tools, answers citing sources, and a documented API.
8 — Connectors to file stores, wikis, mail, CRM and ticketing with incremental sync, custom connectors or MCP support, an API and webhooks for embedding assistants and agents in other tools, and source citations on every grounded answer.
10 — The product sits in the company's systems: read and write connectors with documented scopes, MCP servers and clients, contact-centre or telephony integration where relevant, a knowledge layer that can be audited and corrected, and the data, agents and configuration exportable when the customer leaves.
The Head of IT
Slack, OneDrive, Google Drive, SharePoint, Confluence and Outlook sit among 50+ content sources, alongside 100+ pre-built plugins, unlimited custom HTTP connectors, MCP server support, Agent-to-Agent agents, documented REST APIs, webhook listeners and customer-hosted gateways. What I could not verify from the captured pages is how completely and how often content syncs, and whether every grounded answer cites its sources — in a permission-sensitive SharePoint estate that citation and sync story matters. 1 10 11
The Data Protection Officer
Content sources cover Slack, OneDrive, Google Drive, SharePoint, Confluence, Outlook and 50+ other systems; Moveworks maintains built-in system connectors and unlimited custom HTTP connectors, and documents REST APIs, webhook listeners, an MCP workspace, A2A agents, customer-hosted gateways and 100+ pre-built plugins. We found no public information on sync frequency for connectors or on source citations attached to answers. 1 10 11
The Automation Lead
The reach is what I want: fifty-plus content sources including Confluence, SharePoint and Outlook, custom HTTP connectors with no count limit and per-system credentials, over a hundred pre-built plugins, an MCP workspace, agent-to-agent support, REST APIs with webhook listeners, and customer-hosted Content, Identity, Knowledge and Forms gateways that keep the pipe to internal systems under our roof. We found no public information on sync cadence or on source citations for grounded answers, which keeps it a step short of the top. 1 10 11
The Customer-Service Director
The reach is real for a contact centre: Slack, SharePoint, Confluence, Outlook and 50-plus content sources, over 100 pre-built plugins for IT and HR, per-system connectors with their own credentials, MCP and agent-to-agent support, webhooks, and documented REST APIs with separate EU and UK base URLs, plus ServiceNow working together with it. We found no public information on how fast or completely connectors sync, or on how the assistant cites its sources in an answer. 1 10 11
The Works Council Member
The product reaches the systems a company runs on: over 50 named content sources including Slack, SharePoint, Confluence and Outlook, Moveworks-built system connectors plus unlimited custom HTTP connectors, REST APIs with webhooks, MCP and A2A support, and customer-hosted gateways for content, identity, knowledge and forms. I found no statement on how fast or how completely connectors sync, and no evidence that answers cite their sources. 1 11 10
The Skeptic
This is a genuinely broad surface: fifty-plus content sources named, system and custom HTTP connectors with no stated limit, over a hundred prebuilt plugins, REST APIs, webhook listeners, an MCP workspace, Agent-to-Agent support, an on-premises agent, and customer-hosted gateways for content, identity, knowledge and forms. We found no public information on how or how often connectors sync, whether answers cite their sources, or export of data and configuration when a customer leaves. 1 10 11 13
Agent capabilities & guardrails
Show reasoningHide reasoning
How this is scored
What an agent can actually do and where it stops: multi-step tasks, tool use and actions in other systems, scheduling and triggers, human approval before consequential actions, run logs, evaluation and testing before release, and the limits the vendor states rather than hides.
0 — No agents; the product is a chat window, whatever the marketing says.
3 — Saved prompts or custom assistants with instructions and files, but no actions in other systems and no run history.
5 — Agents that call tools or APIs and run multi-step tasks, built without code, with a log of each run.
8 — Agents that act in connected systems with scoped permissions, human approval configurable per action, triggers and schedules, test and evaluation tooling before release, and documented limits and failure handling.
10 — Agents a business can put in production and account for: versioning and staged rollout, evaluation against test sets, monitoring of quality and cost per agent, handover to a human with full context, every action attributable to the agent and the person who deployed it, and the vendor's own statement of what agents must not be trusted with.
The Head of IT
Compound actions chain multi-step workflows with conditional branches, loops, parallel steps, graceful error handling and interactive notifications over built-in, HTTP and script actions; webhook listeners enable triggered agents, plugin runs are logged with their external API calls, and evaluation tooling exists including an Eval API in alpha. Approvals appear as built-in actions and an expense-approval quickstart, but we found no public information on approval required per action, scheduled runs, or versioning and staged rollout before release. 12 13 10 9
The Data Protection Officer
Compound actions chain multi-step workflows with conditionals, loops, parallel steps and documented error handling in a low-code editor, built-in plugin logs capture each run, and quickstarts demonstrate a webhook ambient agent and an expense-approval flow, with test tooling present (Eval API in alpha, Message Tester, API Mocker) and guardrails such as content moderation and prompt protection described. We found no public information on scheduled triggers, per-action human-approval configuration as a general control, or versioned staged rollout of agents. 3 9 10 12 13
The Automation Lead
Tool Studio gives me real agents: built-in, HTTP, script and compound actions with branching, loops, parallel steps, error handling and interactive notifications, triggered by webhooks, with built-in actions for handling approvals and every plugin run logged with its external API calls. Testing exists too — Message Tester, API Mocker, a DSL playground and an alpha Eval API — plus published documentation on model limitations. We found no public information on a configurable human-approval gate per consequential action, on agent-scoped permissions distinct from platform roles, or on versioned staged rollout, so production accountability is still partly on trust. 6 9 10 12 13
The Customer-Service Director
Compound actions chain real work — approvals, conditionals, loops, parallel steps, graceful error handling, interactive notifications — into HR, IT and finance systems via APIs, with plugin run logs capturing every external call, webhook-triggered ambient agents, and an Eval API in alpha plus a Chat Evaluator for testing before release. A Handoff data object and a fine-tuned model dedicated to handoff classification speak directly to my human-takeover requirement, but we found no public information on a configurable human-approval gate per action, on per-agent quality and cost monitoring, or on any vendor statement of what agents should not be trusted with. 7 8 9 10 12 13
The Works Council Member
Agents run genuine multi-step workflows — built-in, HTTP, script and compound actions with branches, loops, parallel steps and documented error handling — and every plugin run is logged with its external API calls, with connector credentials scoped per system. My concern for colleagues: the evaluation offering is an alpha API, I found no human-approval gate documented before an agent manages users or handles approvals, and there is no vendor statement of what agents must not be trusted with. 12 13 9 10
The Skeptic
Compound actions chain API calls, scripts, conditional branches, loops and parallel steps with documented error handling, approvals ship as a built-in action with an expense-approval quickstart, webhook listeners drive an ambient agent, and each plugin run leaves a log of its external API calls. Test and evaluation tooling exists but is marked alpha. We found no public information on human approval configured per action, on schedules and triggers beyond webhooks, or on versioning and staged rollout. 9 10 12 13
European sovereignty
panel opinion
Show reasoningHide reasoning
How this is scored
Who the contracting entity and the parent company are, where customer data is hosted, and who the subprocessors are — model providers above all, then hosting, search, telephony and email. Independently sourced by the sovereignty pipeline; for an AI product the model provider is a subprocessor, so a European interface over a non-European model counts as such.
0 — Non-EU vendor and contracting entity, hosting unstated, subprocessors (including model providers) unnamed.
3 — A privacy policy exists, but hosting location is unstated or non-EU and the model providers behind the product are not named as subprocessors.
5 — EU hosting stated and an EU contracting entity, but prompts reach non-EU model providers or other subprocessors without a stated safeguard or EU region.
8 — EU hosting on named infrastructure, EU contracting entity, every subprocessor listed with its location including model providers, EU inference available, and a DPA offered.
10 — Sovereign end to end and evidenced: European ownership, entity, hosting and model processing, every subprocessor European or optional, data export and deletion documented, and a security or certification statement published rather than implied.
The Head of IT
The contracting entity is Moveworks, Inc., a US company, though hosting is on AWS with an EU Commercial region and a statement that all customer data remains in its region, and the model layer includes OpenAI and Azure OpenAI. The pipeline flags AWS as US-headquartered and subject to the US CLOUD Act regardless of server location, and we found no public information on an EU contracting entity, a DPA, or a full subprocessor list with locations. 3 7 10
The Data Protection Officer
Hosting is on named infrastructure — AWS — with an EU Commercial region, per-datacenter API endpoints, and the statement that all customer data remains in its region, but AWS remains subject to the US CLOUD Act wherever it hosts, and the contracting entity is Moveworks, Inc., a US company whose homepage presents Moveworks and ServiceNow working together as one. We found no public information on an EU contracting entity, on a subprocessor list with locations, on where OpenAI and Azure OpenAI process prompts, or on a data processing agreement covering the product. 1 3 7 10
The Automation Lead
A US company hosts on AWS with an EU Commercial region, per-datacenter endpoints and a stated commitment that all customer data remains in its region. But the model providers behind the assistant are OpenAI and Azure OpenAI with no stated EU inference region or safeguard, we found no public subprocessor register or data processing agreement, and the AWS hosting remains subject to the US CLOUD Act regardless of server location. 3 7 10
The Customer-Service Director
An EU Commercial region on AWS, with customer data stated to remain in its region, is a genuine start, but Moveworks is a US company — per its own homepage now acquired by ServiceNow — AWS remains subject to the US CLOUD Act wherever the servers sit, and prompts reach OpenAI and Azure OpenAI models. We found no public information on the contracting entity and ownership, on a subprocessor list with locations and safeguards, or on a data processing agreement. 1 3 5 7
The Works Council Member
The contracting entity is Moveworks, Inc. in the USA, now acquired by ServiceNow; hosting is on AWS, which stays subject to the US CLOUD Act even in the offered EU region, and prompts reach OpenAI and Azure OpenAI with no stated EU inference region or safeguard. I found no published DPA and no subprocessor list. 1 3 7
The Skeptic
This is a US vendor — its own homepage announces it works together with ServiceNow — hosted on AWS, a US-headquartered provider subject to the US CLOUD Act regardless of server location, answering through OpenAI and Azure OpenAI models. An EU Commercial region is offered with per-region endpoints and a claim that all customer data remains in its region and is never transferred elsewhere. We found no public information on an EU contracting entity, a subprocessor list, EU inference for the model providers, or a data processing agreement. 1 3 7 10
Pricing transparency
not rated — the vendor publishes no price
Show reasoningHide reasoning
How this is scored
Whether a company can compute the real annual cost from public pages alone: price per seat, per agent, per conversation or per usage unit, what is included in each tier, usage limits and overage, which models, connectors or agents cost extra, minimum seats and term.
0 — No public prices at all; every customer is a sales call.
3 — A starting price or "from" figure exists, but usage limits, included models and what scales the cost are unclear.
5 — Prices per tier are public with the main inclusions, but usage limits, overage, agent runs or enterprise features (SSO, audit logs, EU processing) are unpriced or "on request".
8 — Every tier priced publicly with seat or usage units, usage limits and overage rates, add-ons listed, minimum seats and term stated.
10 — Complete price computability: annual cost derivable for a given number of seats, agents or conversations, with every usage rate, model surcharge, add-on and support tier and the cancellation and data-return terms published.
The Head of IT not rated — no public information
We found no public information on pricing transparency: none of the captured pages we read — homepage, agent-builder page, the legal hub and the API documentation — show a price, tier, seat term or usage unit. 1 2 4 10
The Data Protection Officer not rated — no public information
We found no public information on pricing in the captured pages: no per-seat or per-usage price, tier inclusions, usage limits, minimum term or cancellation terms appear on the homepage, platform or documentation pages we read. 1 2 3
The Automation Lead not rated — no public information
We found no public information on pricing transparency: the captured homepage, platform, legal and developer pages show no seat, tier, usage or overage figures and no minimum seats or term, so a real annual cost cannot be computed from public evidence. 1 2 4
The Customer-Service Director not rated — no public information
We found no public information on pricing: no per-seat, per-conversation or usage-based figure appears on the captured homepage, legal pages or API documentation. My CFO cannot forecast a cost per conversation for half a contact centre's traffic from public pages alone; every quote will be a sales call. 1 4 10
The Works Council Member not rated — no public information
I found no public information on pricing transparency: no price per seat, tier, usage unit or term appears on the homepage, the agent-builder features page, the security page or the legal hub, so a works council cannot compute a real annual cost from the captured pages. 1 2 3 4
The Skeptic not rated — no public information
We found no public information on pricing on any page we read, including the homepage, the agent-builder feature page and the legal hub: no price per seat, per agent or per usage unit, no tiers, no usage limits and no term or minimum stated. What a thousand seats cost is not derivable from these captures. 1 2 4
European sovereignty — proven facts
1 of 4 dimensions provenBuilt only from facts shown on the vendor's own pages. A dimension we could not prove is left open, not scored as zero.
| Legal entity | Not determined | — | uncited Report an error |
|---|---|---|---|
| Ownership | Not determined | — | uncited Report an error |
| Data residency | Not determined ⚠ unverified | — | uncited Report an error |
| Subprocessors | US CLOUD Act reach ⚠ unverified | 0/2 pts | 3 Report an error |
Questions about Moveworks
Is Moveworks European?
No. whats-best.ai classifies Moveworks as Rest of world.
Where does Moveworks store data?
Not stated on the vendor’s pages as of 26 Oct 2026.
Does Moveworks have a free plan?
Not stated on the vendor’s pages as of 26 Oct 2026.
What are the best alternatives to Moveworks?
As of 28 Oct 2026, the panel rates Langdock (4/5), Dust (3.5/5) and Unique AI (3.5/5) highest among the other 15 AI Agents & Assistants products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is Langdock (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: how scores are made. The full list, with European products first: Moveworks alternatives.
Where this could be wrong
- Evidence ages. The oldest capture behind this page is from 26 Oct 2026. Vendors change pricing and policies without notice; every fact reflects its source as of the capture date shown in the registry.
- Weak sourcing — Data residency. Not confirmed on the vendor’s own pages as captured.
- Weak sourcing — Subprocessors. AWS keeps customer data in the selected region (EU Commercial is offered), but as a US-headquartered provider it remains subject to the US CLOUD Act regardless of server location.
- AI can misread a source. Extraction and judgement are automated; a citation guarantees traceability, not infallibility. If something here is wrong, say so — no account needed, every report is decided within 5 business days, and accepted corrections are published.
What we left out
A claim that does not survive our checks costs us the claim, not the page. This is what was taken off this one.
- We found no public information on pricing on the pages we read (moveworks.com, moveworks.com/us/en/platform/ai-agent-builder, moveworks.com/us/en/platform/security, moveworks.com/us/en/legal, moveworks.com/us/en/legal/privacy-policy, docs.moveworks.com/harness/llm-fundamentals and 7 more). If the vendor publishes it somewhere else, send us the page. Know more? Tell us
- 9 integrations facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 6 compliance facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 6 legal facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 2 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material. Know more? Tell us
- 1 sovereignty dimension could not be confirmed on the vendor’s own pages and is shown as unknown. Know more? Tell us
Sources (13)
The pages every claim on this page was read from — each one checked, dated, and kept verifiable.
- 1 Vendor homepage www.moveworks.com Checked 26 Oct 2026 Details →
- 2 Features page (agent builder) www.moveworks.com Checked 26 Oct 2026 Details →
- 3 Security page www.moveworks.com Checked 26 Oct 2026 Details →
- 4 Legal hub with terms www.moveworks.com Checked 26 Oct 2026 Details →
- 5 Privacy policy www.moveworks.com Checked 26 Oct 2026 Details →
- 6 Models & processing location — found from sitemap docs.moveworks.com Checked 26 Oct 2026 Details →
- 7 Models & processing location — found from sitemap docs.moveworks.com Checked 26 Oct 2026 Details →
- 8 Admin, identity & access controls — found from sitemap docs.moveworks.com Checked 26 Oct 2026 Details →
- 9 Admin, identity & access controls — found from sitemap docs.moveworks.com Checked 26 Oct 2026 Details →
- 10 Integrations, connectors & knowledge — found from sitemap docs.moveworks.com Checked 26 Oct 2026 Details →
- 11 Integrations, connectors & knowledge — found from sitemap docs.moveworks.com Checked 26 Oct 2026 Details →
- 12 Agent capabilities & guardrails — found from sitemap docs.moveworks.com Checked 26 Oct 2026 Details →
- 13 Agent capabilities & guardrails — found from sitemap docs.moveworks.com Checked 26 Oct 2026 Details →