Sub-processors
Last updated 2026-05-18. We notify existing customers 30 days before any new sub-processor begins processing their data.
What this list is
Yoursoftware Pty Ltd engages sub-processors to deliver our services. We require each to sign a Data Processing Agreement (DPA) consistent with our customer-facing DPA, the Privacy Act 1988 (Cth), and (for EU data) GDPR Article 28.
This page is reviewed by our CISO function on every sub-processor onboarding or offboarding, on any change to DPA / region / SOC 2 status, and quarterly minimum. Subscribe to change notifications: security@yoursoftware.com.au.
Critical sub-processors
| Vendor | Role | Region | DPA |
|---|---|---|---|
| Anthropic PBC | LLM API (Claude — Haiku / Sonnet / Opus) for document extraction + scoring + content generation | United States (contracted region) | Yes · AU-region addendum in progress |
| Google LLC | Google Workspace (Gmail, Drive, Calendar, Docs, Sheets) for business operations | AU + US | Yes · verification in progress |
| MyCRM (aggregator CRM platform) | Broker customer relationship management; settlement workflow | Australia | Yes · via aggregator broker agreement |
| Netlify Inc | Application hosting + edge functions + form processing for productised apps | United States | Yes · verification in progress |
| Supabase Inc | Postgres + authentication + storage (productised apps v2) | Australia (Sydney region) | Pre-onboarding · DPA signed before v2 production launch |
| Quickli Pty Ltd | Serviceability calculator (where used in YourCSM workflow) | TBC · verification in progress | Pre-confirmation |
| DocuSign | Document signature for settlement documents | United States | Pre-confirmation |
| illion / Frollo | Open Banking data retrieval (where used; per consumer consent under CDR) | Australia | Pre-confirmation |
Significant sub-processors
| Vendor | Role | Region | DPA |
|---|---|---|---|
| Voyage AI (now Anthropic) | Embeddings (semantic search in YourCSM Phase 0B) | United States | Pre-confirmation |
| Xero | Accounting + payroll | Australia | Yes · verification in progress |
| Lakera AI (or approved alternate) | Prompt injection defence (AI guardrails — productised apps) | European Union | Pre-onboarding |
| Vanta Inc | Compliance automation + trust portal | United States | Pre-onboarding |
| 1Password Business | Password + secrets vault | AU + US | Yes |
| Huntress Labs | Managed endpoint detection + response (Wk5-8 rollout) | United States | Pre-onboarding |
| Material Security (or alternate) | Email security + BEC defence | United States | Pre-onboarding |
| Cobalt.io (or approved alternate) | Penetration testing as a service | United States | Pre-onboarding |
| HackerOne (or approved alternate) | Bug bounty platform (private — from Mo 9) | United States | Pre-onboarding |
| Canva Pty Ltd | Brand assets + content design | US (founded AU) | Verification in progress |
| GitHub Inc | Source code repository hosting | United States | Yes |
| N-able (via LMG MSP) / AVDefender | Endpoint protection (cascaded via LMG aggregator partnership) | United States | Yes · via LMG |
Routine sub-processors
| Vendor | Role | Region |
|---|---|---|
| Ideogram AI | AI image generation (marketing only) | United States |
| Orshot | Screenshot automation (marketing only) | United States |
| OpenAI | GPT API (marketing content generation only) | United States |
| Apify | Web scraping (competitive intelligence — no customer data) | United States |
| Better Stack | Public status page | US / EU |
| dmarcian | DMARC aggregate report monitoring | International |
Change notification policy
We notify existing customers 30 days before any new sub-processor begins processing their data. We notify the address on file at contract execution. Existing customers may object to any new sub-processor within 30 days of notification. If we cannot resolve the objection, the customer may terminate the affected service.
To subscribe additional addresses to notifications: security@yoursoftware.com.au.
Questions
Email security@yoursoftware.com.au.
© Yoursoftware Pty Ltd. Per the Privacy Act 1988 (Cth) and APP 8.