Sub-processors
Current as at: 29 July 2026
These are the third parties we use to run OpsFlow. Each is bound to protect your data and to use it only to provide services to us. We remain responsible to you for what they do.
We give at least 30 days’ notice before adding or replacing a sub-processor that handles customer data. If you reasonably object on data protection grounds, you may terminate the affected service without penalty — see clause 6.5 of the Data Processing Agreement.
To receive change notices: email privacy@opsflow.net.au and we will add you to the notification list.
Core platform
| Sub-processor | What it does | Data it handles | Location |
|---|---|---|---|
| Supabase Inc. (hosted on AWS) | Database, authentication, file storage, backend functions | All customer data, including participant records, documents and compliance records | 🇦🇺 Australia — AWS Sydney (ap-southeast-2) |
| Vercel Inc. | Hosting and delivery of the web application | Web request metadata — IP address, browser, URL paths. No record content is stored | 🌏 Global edge network |
Communications
| Sub-processor | What it does | Data it handles | Location |
|---|---|---|---|
| Twilio Inc. — Voice | Voice calling, call recording, call routing | Phone numbers, call metadata, call recordings | 🇦🇺 Australia — Twilio AU1 (Sydney) |
| Twilio Inc. — Messaging | SMS send and receive | ⚠️ SMS message content, phone numbers | 🌏 Outside Australia |
| Resend | Transactional and notification email delivery | ⚠️ Email content, recipient addresses | 🇺🇸 United States |
| Apple Inc. (APNs) | iOS push notifications | Content-free — a trigger only. No personal information in the payload | 🌏 Outside Australia |
| Google LLC (FCM) | Android push notifications | Content-free — a trigger only. No personal information in the payload | 🌏 Outside Australia |
Business operations
| Sub-processor | What it does | Data it handles | Location |
|---|---|---|---|
| Stripe, Inc. | Payment processing, subscription billing | Billing contact details, payment data. No participant data | 🌏 Outside Australia |
| Annature Pty Ltd | Electronic signature | Documents sent for signature, signer names, emails and audit trail | 🇦🇺 Australia |
| Functional Software, Inc. (Sentry) | Error and performance monitoring. Optional — enabled only where configured | Scrubbed error diagnostics. Payloads are stripped of personal information before transmission | 🌏 Outside Australia |
Connections you choose to make
These only apply if you connect them. When you do, data flows between OpsFlow and your own account with that provider, under your agreement with them.
| Service | What it does | Location |
|---|---|---|
| Microsoft 365 / Microsoft Graph | Sends email and creates calendar events from your own mailbox | Your Microsoft tenant’s region |
| Google Workspace | Sends email and creates calendar events from your own mailbox | Your Google tenant’s region |
⚠️ What this means in practice
Your participant records, documents and call recordings stay in Australia.
Three things do not:
- SMS content — Twilio’s Australian region supports voice, not messaging. If Australian-only processing of message content is a requirement for your organisation, leave SMS disabled.
- Outbound email — sent via Resend in the United States. You can avoid this by connecting your own Microsoft 365 or Google mailbox so email goes through your own tenant.
- Billing data — processed by Stripe offshore. No participant information is involved.
We are accountable under APP 8 and section 16C of the Privacy Act 1988 (Cth) for how these recipients handle information we disclose to them.
Change history
| Date | Change |
|---|---|
| 29 July 2026 | Initial publication |
Questions: privacy@opsflow.net.au