What is Sana? The Workday Acquisition, Pricing, and Best Alternatives in 2026
Sana is an AI knowledge assistant of Swedish origin that Workday agreed to acquire for approximately $1.1 billion on 16 September 2025. The deal closed on 4 November 2025 and the product relaunched on 17 March 2026. The fact that decides most evaluations: Sana Enterprise is now sold as an attachment to Workday HCM or Workday Financial Management, through Workday Flex Credits. If you do not run Workday, you cannot buy that tier on those terms.
Last updated: 2026-09-06. Every quote and figure on this page was fetched from the vendor on 2026-09-06.
Quick Decision Guide
Sana fits an organisation that already runs Workday and wants the assistant to live where its HR and finance data already lives. Certification-wise it is one of the stronger vendors in this set. It is the wrong choice if you do not run Workday and want the enterprise tier, if you need EEA-restricted LLM inference without negotiating for it, or if the work you need automated arrives by telephone.
| If you need... | Sana fits | Better alternative |
|---|---|---|
| An assistant that lives inside Workday HCM or Financial Management | Yes | - |
| SOC 2 and ISO 27001 from the vendor itself | Yes | - |
| To buy the enterprise tier without running Workday | No, sold with Workday HCM or Financial Management | Dust, Glean |
| A published price you can budget from | Team tier only, $30 per user per month | Dust |
| Hosting infrastructure inside the EEA by default | Yes | - |
| LLM inference restricted to the EEA without negotiating for it | No, worldwide routing is the default | - |
| A published retention period for indexed content | Not published | - |
| Voice or phone-channel AI for inbound or outbound calls | No | Ainora |
| Small EU languages (LT, LV, ET) as a first-class channel | Not stated | Ainora |
How Sana Rates
A six-axis scorecard in the format used across our provider pages. Every note is traceable to a Sana or Workday page fetched on 2026-09-06.
| Axis | Rating | Notes |
|---|---|---|
| Commercial availability | Transitional | Sana Enterprise is sold with Workday HCM or Workday Financial Management through Flex Credits. A residual $30 per user per month Team tier is still live on sanalabs.com and its future is undeclared. |
| Pricing transparency | Mixed | The Team tier price is published. Enterprise reads "Custom pricing" on sanalabs.com and is now routed through Workday Flex Credits, which is an allocation rather than a rate card. |
| EU data residency | Mixed | Hosting infrastructure defaults to EEA/EU. Several core sub-processors are recorded as USA regardless, including the primary data store. LLM routing defaults to worldwide absent a specific agreement. |
| Certifications | Strong | SOC 2, ISO 27001 and HITRUST claimed, with an ISO/IEC 27001-certified ISMS named as the basis for its security measures. Single tenant for Sana Agents. |
| Training and logging posture | Mixed | No third-party LLM training, but two hedges are on the page ("unless specifically agreed upon", "whenever possible") and query logs are retained pseudonymised to improve ranking. |
| Channel coverage | Weak | Web and in-Workday surfaces, plus connectors for Box, Confluence, Gmail, Jira, Notion, Salesforce, ServiceNow, SharePoint, Slack and Zoom. No phone or voice channel. |
What is Sana, and what did Workday buy?
Sana built an assistant that indexes a company's systems and answers questions across them, alongside a learning product. Workday bought the company and turned it into the entry point to its own platform. Workday's completion release describes the intent plainly: the addition of Sana "will make Workday the new front door for work - bringing a company's most critical applications and insights into Workday's platform, enabling employees to start and complete their day in Workday - without needing to switch contexts."
That sentence is the whole strategy, and it is what a buyer should weigh. Sana is no longer a neutral layer over your stack; it is being positioned as the way into one vendor's platform. Whether that is an advantage depends entirely on whether that vendor is already yours.
| Date | Event | What the source says |
|---|---|---|
| 2025-09-16 | Workday signs a definitive agreement to acquire Sana | "Workday will acquire all of the outstanding shares of Sana for approximately $1.1 billion" |
| 2025-11-04 | The acquisition completes | Workday announces it "has completed its acquisition of Sana, a leading AI company building the next generation of enterprise knowledge tools" |
| 2026-03-17 | Relaunch as Sana from Workday | "Sana for Workday and the Sana Self-Service Agent are now available to all Workday customers through Workday Flex Credits - no extra license, no separate paywall." |
| 2026-03-17 | Sana Enterprise is packaged as an attachment | "Sana Enterprise is now available with Workday Human Capital Management (HCM) or Workday Financial Management and through Workday Flex Credits." |
| 2026-05-27 | Sub-processor list last updated | Labels the learning product "Sana Learn / Workday Learn, powered by Sana" throughout and points to the Workday Subprocessor List for Workday affiliates |
| 2026-09-06 | Standalone tier still live | sanalabs.com still sells a Team tier at $30 per user per month, ten months after the acquisition closed |
Sources: Workday newsroom, 16 September 2025; 4 November 2025; 17 March 2026; Sana sub-processor list, last updated 27 May 2026; sanalabs.com pricing. All fetched 2026-09-06.
One thing we deliberately do not repeat from the launch release: the customer quotation about adoption rates and retired licences. It is a testimonial in a vendor press release with no method behind the percentages, and a number without a method is not evidence.
How much does Sana cost, and can you still buy it directly?
The commercial state is transitional, and any page that presents it as settled is guessing. Two things are true at the same time on 2026-09-06, ten months after the acquisition closed.
First, the standalone sanalabs.com pricing page is still live and still publishes a price. Verbatim: "Team / $30 per user / month / Sign up / Unlimited queries and meeting recordings / Up to 50 members per workspace / Our most popular integrations incl. Asana, Gmail, Outlook email, Zendesk, and more. / OpenAI and Claude model selection / 10,000 documents per integration / Priority in email and chat support". A Free tier at $0 sits below it with up to 5 members and 1,000 documents per integration, and above it an Enterprise tier marked "Custom pricing" whose bullets include "Enterprise data processing agreement", "Extended range of LLMs" and an "MCP client for building your own integrations".
Second, Workday simultaneously bundles the same technology into its own subscriptions with no separate licence: "Sana for Workday and the Sana Self-Service Agent are now available to all Workday customers through Workday Flex Credits - no extra license, no separate paywall. Customers receive an allocation of Flex Credits as part of their Workday subscription."
And the sentence that decides the evaluation for most European mid-market buyers: "Sana Enterprise is now available with Workday Human Capital Management (HCM) or Workday Financial Management and through Workday Flex Credits." Sana Enterprise is the general-purpose product, the one with connectors for Box, Confluence, Gmail, Jira, Notion, Salesforce, ServiceNow, SharePoint, Slack and Zoom. It is now sold as an attachment to two Workday products.
What that means in practice: if you run Workday, this is arguably the most frictionless purchase in the whole category, because the credits are already in your subscription. If you do not, the enterprise tier is not available to you on the published terms, and what remains is a $30 per user per month Team tier capped at 50 members per workspace whose future nobody has declared. Ainora's pricing is individual and scoped to the work; the reason we are comfortable comparing here is not price but availability.
Where does Sana process European data?
Correction first, because the widely repeated version of this is wrong. Sana's default hosting is not the United States. Its sub-processor list, a compliance document with a stated last-updated date of 27 May 2026, records the hosting-infrastructure row as "EEA/EU (default) USA (option for US customers)". Anything that tells you Sana defaults to US hosting is out of date, and we are not going to repeat it because it would be convenient for us.
The sharper and more useful finding is what sits underneath the hosting layer. Read the same document row by row and two things become visible: several core sub-processors are recorded as United States regardless of the customer's region, and LLM routing is governed separately from hosting.
| Sub-processor | Role, in Sana's own words | Location |
|---|---|---|
| Google Cloud (GCP), Google Ireland Ltd., Dublin | Hosting infra / Search Infra / Content generation / Internet Security Services | EEA/EU (default) USA (option for US customers) |
| Microsoft Azure, Microsoft Ireland Operations Ltd., Dublin | Search infra / Cloud Services | EEA/EU |
| Redis Labs, Redis, Inc., San Francisco | Pipedream connector processor. Cloud services / infrastructure for core products. Primary data store | USA |
| Amazon Web Services, Inc., Seattle | Pipedream connector processor. Cloud services / infrastructure for core products | USA |
| Anthropic PBC, San Francisco | Search and model infra | USA, with a Zero Data Retention configuration noted |
| Merge API, Inc., San Francisco | Third party integrations provider | USA |
| OpenAI Ireland Ltd., Dublin | Search infra / Content generation | Worldwide routing OR EEA/EU & Switzerland (option only for EU only customers) |
Rows transcribed from the Sana sub-processor list, document header "Sana Sub-processors Last updated: 27 May 2026", downloaded and text-extracted 2026-09-06. The PDF is a multi-column table whose extracted text interleaves across columns; a naive copy and paste will scramble it.
The most citable sentence in this field is in that document, and it is about routing. On the OpenAI row, verbatim:
"Routing is dependent on configurations as agreed between the Subscriber and Sana. If no specific agreement has been entered into, default worldwide routing will apply."
That is a vendor stating, in its own compliance artefact, that the default is worldwide routing of customer content to a language model unless the customer negotiates otherwise. It is not a Sana defect and we do not present it as one. It is a fact about the field: hosting residency and inference routing are two different questions, and buyers routinely ask only the first. Sana is unusual in answering the second in writing.
The practical checklist that follows from it is short. Ask any vendor where data is stored at rest. Then ask, separately and in writing, where inference happens and what the default is if nothing is agreed. Then ask which sub-processors sit outside your region regardless of the hosting choice. Three questions, and most procurement processes ask only the first.
On Sana's own retention of indexed content, chat history and query logs, no default is published. A grep across the security and pricing pages on 2026-09-06 for retention|retain|delete|days returned only the Zero-Day Retention arrangement for third-party language models. We therefore state the absence and no number.
Does Sana train on your data?
No third-party language model is trained on customer content. The full statement from Sana's security page carries two hedges and a logging disclosure that a tick in a comparison table would erase, so here it is intact:
"We use a dedicated training set of internal data to manually and automatically train our ranking algorithm and query rewrite to find the most relevant matches. No customer data, e.g., external content indexed by our service ('Content Data'), are used outside of the isolated tenant, unless specifically agreed upon. For the point of clarity, no customer data is used to train third-party LLMs. To improve ranking, we also log the queries asked by users, and how a user interacts with the results or Sana Agents, so that we can serve the types of queries users need the most in the best way possible. Such data is pseudonymized to ensure confidentiality."
And on the model layer: "Sana Agents is built agnostic to the underlying large language models. Sana offers third party large language model options which are not trained on Content Data. We utilize enterprise security arrangements and, whenever possible, a Zero-Day Retention (ZDR) policy with our third-parties. No customer data is used to train third-party LLMs."
The two phrases to carry into a security review are "unless specifically agreed upon" and "whenever possible". Neither is a red flag on its own; both are the kind of qualifier that decides what a contract actually commits to. And note the logging: user queries and result interactions are retained, pseudonymised, to improve ranking. That is a defensible design and it is also not the same thing as "we never use your data".
Certifications and residency, compared honestly
Sana holds more third-party assurance than Ainora does, and the table says so. A comparison a reader can catch out is worth nothing.
| Item | Sana | Ainora |
|---|---|---|
| SOC 2 | Claimed | No |
| ISO 27001 | Claimed, with an ISO/IEC 27001-certified ISMS | No |
| HITRUST | Claimed | No |
| Hosting region default | EEA/EU for hosting infrastructure | EU-native by design |
| Core sub-processors outside the EEA | Primary data store, core product infrastructure, model infra and integrations recorded as USA | Not applicable |
| Default LLM routing | Worldwide, absent a specific agreement with the subscriber | Not applicable |
| Published retention period for indexed content | Not published | Not published |
| Phone or voice channel | No | Yes |
| Published price | Team tier only. Enterprise is custom and Workday-attached | Individual pricing |
Sana holds SOC 2 and ISO 27001. Ainora holds neither. Sana's security page states "Sana complies with SOC 2, ISO 27001, and HITRUST" and "We use an Information Security Management System (ISMS) certified under ISO/IEC 27001 as the basis for all information security measures." Its pricing page states "Sana Agents is single tenant, SOC2 and ISO 27001 certified, and GDPR compliant. All data is encrypted at rest with AES 256 and in transit with TLS 1.2+." If your procurement process requires either certificate from the vendor itself, Sana clears that bar and we do not. These are claims on vendor pages rather than certificate numbers we inspected, which is the honest limit of the check.
Sana Pros and Cons
Pros
- SOC 2, ISO 27001 and HITRUST claimed, with a certified ISMS named as the basis of its security programme.
- Hosting infrastructure defaults to the EEA and EU, through Google Ireland and Microsoft Ireland entities.
- Unusually candid compliance documentation: the sub-processor list states the default routing behaviour in writing, which most vendors do not.
- For Workday customers, no extra licence and no separate paywall. The credits are already in the subscription.
- Sana Agents is single tenant, with AES 256 at rest and TLS 1.2 or higher in transit.
- Model choice is not locked: the Team tier lists OpenAI and Claude model selection; Enterprise adds an extended range.
Cons
- Sana Enterprise is sold with Workday HCM or Workday Financial Management. Without Workday, that tier is not available on the published terms.
- The residual standalone Team tier is capped at 50 members per workspace, and its future has not been declared.
- LLM routing defaults to worldwide unless a specific agreement is entered into.
- The primary data store, core product infrastructure, model infrastructure and the integrations provider are all recorded as United States regardless of hosting region.
- No published retention period for indexed content, chat history or query logs.
- Query logs are retained pseudonymised for ranking improvement, and the training statements carry two qualifiers.
- No phone or voice channel.
Verdict: Who Should Use Sana?
Sana is the right choice for a Workday customer. The credits are already in the subscription, the assistant sits where the HR and finance data sits, and the certification position is among the strongest in this comparison set. For everyone else the calculus changed on 17 March 2026: the general-purpose enterprise product is now sold as an attachment to two Workday applications, and what remains buyable directly is a 50-seat Team tier whose roadmap nobody has published. Treat the commercial state as transitional, and get the answer in writing before you plan around it. If your requirement is that inference as well as storage stays inside the EEA, ask for that specifically, because Sana's own document says the default is worldwide. And if the work you are trying to automate arrives by telephone, in a language other than English, Sana is not built for it. That is where Ainora is a different product rather than a competing one.
Best Sana Alternatives in 2026
1. Ainora
"Sana became the front door to one vendor's platform. Ainora answers the front door you already have: the telephone."
Ainora is a multi-channel AI teammate, EU-native by design. The difference from Sana is not primarily technical, it is availability and channel. Sana Enterprise now attaches to Workday HCM or Workday Financial Management; Ainora attaches to the systems you already run, whichever those are, and picks up the phone in the caller's language while it does it.
Multilingual, including small EU languages that platforms built for the English-speaking market do not cover, with mid-conversation switching. Joins Slack and Microsoft Teams when a colleague mentions it, and executes work across CRM, calendar and ticketing. Deployment is measured in days rather than quarters, and the service runs at 99.9% uptime.
Where we are behind, we say so: Sana holds SOC 2 and ISO 27001, and Ainora holds neither. Pricing is individual and scoped to the work. Hear it running in production before you talk to anyone: +1 (218) 636-0234 (English) and +370 5 200 2620 (Lithuanian).
2. Dust
A Paris company that publishes seat prices, $30 per seat per month for a Pro seat billed monthly and $150 for a Max seat, both excluding VAT, with EU data residency on the self-serve plan. The clearest alternative if what you liked about Sana was buying it directly. Its own gap is that the DPA is Enterprise-only.
3. Glean
Enterprise search first, agents layered on top, with the deepest connector estate in the category and no published price since January 2023. Note that Workday now owns Sana and separately partners with Glean; both facts sit on vendor newsrooms and neither is an exclusive.
4. Guru
A platform plus a services engagement rather than a per-seat tool, with knowledge architecture design bundled in. Publishes no price, holds SOC 2 Type II, and offers no EU hosting region: it states that EU and EEA personal data is transferred to the United States.
5. Lindy
Self-serve US agent platform, Slack-first and English-first, US data residency. Fastest to try, furthest from a European data policy.
6. Relevance AI
Build-your-own agents with a self-serve interface, Sydney and San Francisco. Worth a look if the appeal of Sana was agent building rather than the Workday packaging.
Frequently Asked Questions
Sana is an AI knowledge assistant of Swedish origin, now owned by Workday. Workday announced a definitive agreement to acquire it for approximately $1.1 billion on 16 September 2025, completed the acquisition on 4 November 2025, and relaunched the product on 17 March 2026 as Sana from Workday. Its two commercial faces today are Sana for Workday plus the Sana Self-Service Agent, bundled into Workday subscriptions through Flex Credits, and Sana Enterprise, which extends beyond Workday with connectors for Box, Confluence, Gmail, Jira, Notion, Salesforce, ServiceNow, SharePoint, Slack, Zoom and others.
Not the enterprise tier, on the terms Workday has published. The 17 March 2026 launch release states: "Sana Enterprise is now available with Workday Human Capital Management (HCM) or Workday Financial Management and through Workday Flex Credits." A prospect that does not run Workday HCM or Workday Financial Management cannot buy Sana Enterprise on those terms. What remains is the residual Team tier still being sold on sanalabs.com at $30 per user per month, and its future is undeclared. The commercial state is transitional and should be treated as such.
The standalone page at sanalabs.com still publishes a Team tier at $30 per user per month, with unlimited queries and meeting recordings, up to 50 members per workspace, 10,000 documents per integration, and OpenAI and Claude model selection, alongside a Free tier at $0 and an Enterprise tier marked "Custom pricing". Fetched 2026-09-06. Sana for Workday and the Self-Service Agent carry no separate licence and are drawn from a customer's Workday Flex Credits allocation.
By default, yes, for hosting infrastructure. Sana's sub-processor list, last updated 27 May 2026, records Google Cloud through Google Ireland Ltd. for hosting, search infrastructure and content generation with the location column reading "EEA/EU (default) USA (option for US customers)", and Microsoft Azure through Microsoft Ireland Operations Ltd. as EEA/EU. Claims that Sana defaults to US hosting are out of date and we do not repeat them. Several core sub-processors are US-only regardless, and LLM routing is a separate question with a different answer.
Worldwide, unless you negotiate otherwise. The sub-processor list states, for the OpenAI row: "Routing is dependent on configurations as agreed between the Subscriber and Sana. If no specific agreement has been entered into, default worldwide routing will apply." The routing column for that row reads "Worldwide routing OR EEA/EU & Switzerland (option only for EU only customers)". Hosting residency and inference routing are two different questions, and this sentence is the clearest statement of that difference published by any vendor in this field.
Yes. Sana's security page states: "Sana complies with SOC 2, ISO 27001, and HITRUST" and "We use an Information Security Management System (ISMS) certified under ISO/IEC 27001 as the basis for all information security measures." Its pricing page states: "Sana Agents is single tenant, SOC2 and ISO 27001 certified, and GDPR compliant. All data is encrypted at rest with AES 256 and in transit with TLS 1.2+." Ainora holds neither SOC 2 nor ISO 27001, and the comparison table on this page says so.
Not third-party LLMs, and the vendor's own sentences carry two hedges that matter. Verbatim: "No customer data, e.g., external content indexed by our service ('Content Data'), are used outside of the isolated tenant, unless specifically agreed upon" and "We utilize enterprise security arrangements and, whenever possible, a Zero-Day Retention (ZDR) policy with our third-parties." Sana also states that it logs user queries and result interactions to improve ranking, retained in pseudonymised form. That is not the same as a blanket no, and a comparison table should not flatten it to a tick.
No. Sana is a text and knowledge product across the web and, through the Workday packaging, inside Workday itself. There is no phone or voice channel. That is the structural gap for a company whose work arrives by telephone, and it is what Ainora is built around.
Founder & CEO, AInora
Building AI digital administrators that replace front-desk overhead for service businesses across Europe. Previously built voice AI systems for dental clinics, hotels, and restaurants.
View all articles