Sub-processors

Effective 1 June 2026

These are the providers that process personal or campaign data on our behalf. Personal information stays in Australia except where a provider is marked offshore. We do not use any AI or model provider, so applicant information is never sent to one.

  • Fly.io

    Application hosting and compute.

    Location
    Australia (Sydney)
    Data handled
    • All data in transit while a request is handled

  • Neon

    Primary PostgreSQL database.

    Location
    Australia (ap-southeast-2)
    Data handled
    • Account details
    • Campaign records
    • Applicant details

  • Tigris (S3-compatible object storage)

    Encrypted private storage for applicant documents and evidence packs.

    Location
    Australia (Tigris, Sydney home region)
    Data handled
    • Applicant documents (resumes, supporting files)
    • Generated evidence packs

  • Brevo

    Offshore

    Transactional email delivery (verification, notifications, outcome letters).

    Location
    European Union
    Data handled
    • Recipient email address
    • Notification subject and body (never resumes or documents)

  • Resend

    Offshore

    Transactional email delivery (configurable fallback provider).

    Location
    United States
    Data handled
    • Recipient email address
    • Notification subject and body (never resumes or documents)

  • Cloudflare

    Offshore

    Bot protection (Turnstile), DNS and edge delivery.

    Location
    Global edge network
    Data handled
    • IP address
    • Bot-challenge token

Adding or removing a provider is recorded here and reflected in our privacy policy. If a provider processes data offshore, that is disclosed above and explicitly enabled in our configuration.