About · Sub-processors
Every third party that processes data on our behalf. Reviewed quarterly. Disclosed to clients on contractual request. Per ADR-007.
Supabase, Inc.
AWS ap-southeast-2 (Sydney) · Postgres data, file storage, auth
reviewed 2026-05-03
Amazon Web Services
ap-southeast-2 / ap-southeast-4 · Storage (S3), KMS, Bedrock inference, secondary infra
reviewed 2026-05-03
Anthropic via AWS Bedrock
ap-southeast-2 only via AU-Geo CRIS · Prompt + completion text (PII redacted pre-prompt)
Apac.anthropic.* inference profile only; Opus IDs rejected at module init
reviewed 2026-05-03
Vercel, Inc.
syd1 (Sydney) for functions; control plane US · Web request logs, function execution metadata
Production only. Phase 0β prototype on Cloudflare Pages.
reviewed 2026-05-03
Cloudflare, Inc.
Sydney edges; control plane US · Pages static assets, Pages access gate
Phase 0β alpha frontend only (ADR-018, ADR-021)
reviewed 2026-05-03
PowerSync (JourneyApps Pty Ltd)
PowerSync Cloud Sydney · Sync metadata (no business data passes through PowerSync's storage; ops only)
Phase 1 mobile sync; not active in Phase 0β
reviewed 2026-05-03
Microsoft Corp.
Australia East / Central · Entra SSO; Microsoft Graph for calendar/email
reviewed 2026-05-03
Mapbox, Inc.
Global CDN; Sydney edges · Tile request metadata; geocoding queries
No AU residency commitment; Sydney edges only
reviewed 2026-05-03
Twilio, Inc.
AU edge for SMS routing; account US · SMS recipient phone, MFA codes
AU Sender ID Register mandatory from 1 Jul 2026
reviewed 2026-05-03
DocuSign, Inc.
AU residency tier · E-signature envelopes (engagement letters, quotes, variations)
reviewed 2026-05-03
Inngest
Multi-region · Job payloads (PII redacted at boundary)
reviewed 2026-05-03
Sentry
Multi-region; AU available on Business · Error stack traces (PII excluded via beforeSend)
reviewed 2026-05-03
Axiom
US-region default · Application logs (PII redacted in middleware)
Flag for sovereign customers
reviewed 2026-05-03
Resend
Multi-region · Transactional email (no PII business data)
reviewed 2026-05-03
Xero Ltd
AWS Sydney · Accounting data: invoices, contacts, ledger
reviewed 2026-05-03
BYDA / Before You Dig Australia
AU · DBYD enquiry + response payloads
reviewed 2026-05-03
Geoscape Australia
AU · G-NAF address payloads
reviewed 2026-05-03
Voyage AI
Global (run only on non-PII text) · Embedding text for retrieval
Non-PII only
reviewed 2026-05-03
Willyweather
AU · Weather observation queries by location
reviewed 2026-05-03
EAS (Expo Application Services)
Multi-region · Mobile app build artefacts
reviewed 2026-05-03
Bureau of Meteorology
AU · —
Replaced by Willyweather
reviewed 2026-05-03
Direct Anthropic API
US · —
Replaced by Bedrock Sydney
reviewed 2026-05-03
OpenAI
US/EU · —
Replaced by Anthropic
reviewed 2026-05-03
See `docs/architecture/runbooks/sub-processor-change.md` for the full runbook.