Sub-Processor List
Last updated: 11 October 2026
Biz Secure Online uses the following third-party sub-processors to deliver our services. This list is maintained for the Australian Privacy Principles, the UK GDPR and the EU GDPR, and is referenced by our Privacy & Data Protection Notice and Data Processing Agreement.
Our application hosting, databases and scan data storage are in Australia (Sydney). Some of the providers below process specific data outside Australia, and each row says where. Our software is compiled into container images on a build machine in the Netherlands; that machine holds no customer data. Sub-processors operate under contractual data protection terms, including Standard Contractual Clauses where applicable.
Platform hosting and storage
| Sub-Processor | Purpose | Data Categories | Processing Location |
|---|---|---|---|
| Supabase | Managed database for the customer portal and the Essential Eight workflow | Account and company details, scan results, Microsoft 365 configuration data, assessment records | Australia (Sydney) |
| Fly.io | Application hosting for the portal API, the scan engine and the Essential Eight API | All data handled by those applications while they run | Australia (Sydney) |
| Upstash | Job queue for scheduled and on-demand scans | Scan job identifiers and the addresses of websites to be scanned | Australia (Sydney) |
| Vercel | Hosting for the customer portal and Essential Eight web application | IP address, request metadata | Australia (Sydney), served through a global edge network |
| Cloudflare | Marketing website hosting, contact form handling, newsletter subscriber list, DNS, CDN and DDoS protection | IP address, request metadata, contact form submissions in transit, newsletter subscribers' names, email addresses and subscription status | Global edge network (nearest point of presence) |
Scanning and reporting
| Sub-Processor | Purpose | Data Categories | Processing Location |
|---|---|---|---|
| Anthropic | AI-written summaries and explanations in scan reports, and AI-drafted text in the Essential Eight assisted assessment | Scan findings for the websites you scan; assessment answers and notes you enter | United States |
| Google (PageSpeed Insights) | Website performance measurements in scan reports | The public address of websites you scan | United States |
| WPScan (Automattic) | Known-vulnerability data for WordPress websites | WordPress version details detected on websites you scan | United States |
| Bright Data | Proxy network, used only when a website refuses our scanners’ own address | Requests to the websites you scan and their public responses | Routed through Australian exit points; provider operates globally |
Payments, email and analytics
| Sub-Processor | Purpose | Data Categories | Processing Location |
|---|---|---|---|
| Stripe | Payment processing and subscription billing | Name, email, billing address, payment method tokens | United States (PCI-compliant) |
| Resend | Transactional email (scan reports, alerts, account notifications, help requests) and our newsletter | Email address, name, notification and newsletter content | United States |
| Microsoft 365 (our own business systems) | Our business email, including contact form submissions and support correspondence | Name, email, message content | Microsoft datacentres |
| Google (Analytics / Tag Manager) | Website analytics and tag management (consent-gated) | IP address (anonymised), page views, browser metadata | United States |
Microsoft 365 services
These apply only if you connect your Microsoft 365 to the portal, or engage our Microsoft 365 Managed Security Service. Your Microsoft 365 data itself stays with Microsoft under your own agreement with them.
| Sub-Processor | Purpose | Data Categories | Processing Location |
|---|---|---|---|
| Microsoft (Microsoft Graph) | Reading the security configuration of your Microsoft 365 when you connect it | Secure Score and security settings, user and licence counts, multi-factor authentication figures. No email or file content | Read from Microsoft; stored in our database in Australia |
| Microsoft (Partner Center) | Managing our delegated admin access (GDAP) to your Microsoft 365, where you approve it | Your organisation name, tenant identifier and the admin relationship details | Microsoft datacentres |
Partner-delivered services
These apply only if you engage penetration testing, dark web monitoring, or social engineering assessment and training, which our partner delivers.
| Sub-Processor | Purpose | Data Categories | Processing Location |
|---|---|---|---|
| Cybershield Technologies | Delivery of penetration testing, dark web monitoring, and social engineering assessment and training | Details of systems in scope and test findings; your monitored domains and any leaked credential records found for them; staff names and email addresses for phishing simulations | South Africa |
| Tsepagala (Pty) Ltd (Cybershield’s hosting provider) | Datacentre hosting for the Abyss Sentinel dark web monitoring platform | Your monitored domains and leaked credential records | South Africa (subject to POPIA) |
Changes to this list
We will update this page when sub-processors are added or removed, and tell affected customers in advance, as our Data Processing Addendum requires.
Questions
If you have questions about our sub-processors or data processing practices, please contact us at support@bizsecure.online.