About This Document
This document lists all sub-processors engaged by Smartplace Pty Ltd, trading as Smartta AI to provide services in connection with our workforce management platform. As required by data protection laws including GDPR, CCPA, and the Australian Privacy Act, we maintain this comprehensive list to ensure transparency about data processing activities.
We review providers at least yearly; those handling personal data must protect it under written terms.
1. Sub-processor Categories
Our sub-processors are categorized based on their role in our service delivery:
- Essential Services: Critical infrastructure and core platform functionality
- Infrastructure: Cloud hosting, databases, and technical infrastructure
- Analytics & Monitoring: Performance monitoring and error tracking (locally hosted)
- Security Services: Payment processing and security tools
- Development Tools: Software development and deployment services
2. Current Sub-processor List
Last Reviewed: October 9, 2026
| Service Provider | Service Description | Data Processing Purpose | Data Location | Status | Added Date |
|---|---|---|---|---|---|
| Essential Services | |||||
| Amazon Web Services (AWS) Amazon.com, Inc. Seattle, WA, USA |
Cloud infrastructure, computing, storage, and networking services | All application data storage, processing, and hosting services | Sydney, Australia (ap-southeast-2) |
Active | 2023-01-01 |
| Auth0 by Okta Okta, Inc. San Francisco, CA, USA |
Identity and access management, user authentication | User authentication, session management, identity verification | Australia & United States | Active | 2023-02-15 |
| Cloudflare Cloudflare, Inc. San Francisco, CA, USA |
Bot check (Cloudflare Turnstile) on sign-in | Checks that a sign-in attempt comes from a person, using signals from the visitor's browser. No platform traffic is proxied through Cloudflare and no customer records are sent to it. | Global network | Active | 2023-01-15 |
| SendGrid by Twilio Twilio Inc. San Francisco, CA, USA |
Transactional email delivery and management | User notifications, system alerts, transactional communications | United States (Global delivery) |
Active | 2023-03-01 |
| Twilio SMS Twilio Inc. San Francisco, CA, USA |
SMS delivery and two-factor authentication | Security notifications, 2FA codes, system alerts | Global with Australian local numbers | Active | 2023-03-01 |
| AI Services | |||||
| Anthropic (Claude) Anthropic, PBC San Francisco, CA, USA |
AI model processing for the platform's AI features | Prompts sent by AI features, which may include customer workforce data | United States | Active | 2026-10-15 |
| OpenAI OpenAI OpCo, LLC San Francisco, CA, USA |
AI model processing for the platform's AI features | Prompts sent by AI features, which may include customer workforce data | United States | Active | 2026-10-15 |
| Google (Gemini) Google LLC Mountain View, CA, USA |
AI model processing for the platform's AI features | Prompts sent by AI features, which may include customer workforce data | United States | Active | 2026-10-15 |
| Delivery & Integration Partners | |||||
| NoahFace NoahFace Pty Ltd Sydney, NSW, Australia |
Facial recognition time and attendance hardware and software | Employee clock-in/out via facial recognition, time and attendance data processing | Australia | Active | 2025-09-01 |
| Infrastructure Services | |||||
| Database and caching services are locally hosted on Smartta AI infrastructure - no database sub-processors are engaged. | |||||
| Analytics & Monitoring | |||||
| Analytics and monitoring services are locally hosted on Smartta AI infrastructure - no monitoring sub-processors are engaged. | |||||
| Security & Payment Services | |||||
| Stripe Stripe, Inc. San Francisco, CA, USA |
Payment processing, subscription billing | Payment transactions, billing information, financial records | Global (Stripe Payments Australia) |
Active | 2023-02-01 |
| Xero Xero Limited Wellington, New Zealand |
Accounting software integration | Financial data synchronization, invoice processing | Australia & New Zealand | Active | 2023-05-01 |
| Development & Deployment | |||||
| GitHub GitHub, Inc. San Francisco, CA, USA |
Source code management, CI/CD, software development | Development workflows, deployment logs (no customer data) | United States | Active | 2023-01-01 |
| Docker Hub Docker, Inc. Palo Alto, CA, USA |
Container registry and image management | Application deployment images (no customer data) | United States | Active | 2023-01-01 |
| Atlassian Atlassian Pty Ltd Sydney, NSW, Australia |
Project management, issue tracking, team collaboration | Development workflows, project metadata (no customer data) | Australia | Active | 2025-09-01 |
Data Protection Safeguards
We review providers at least yearly; those handling personal data must protect it under written terms.
3. Data Transfer Mechanisms
For sub-processors located outside Australia:
- Australian Privacy Principles: Before disclosing personal information to an overseas recipient, we take reasonable steps under APP 8 to ensure the recipient handles it consistently with the APPs
- GDPR transfers: Where the GDPR applies, transfers rely on Standard Contractual Clauses or an adequacy decision, as set out in our Data Processing Agreement
4. Sub-processor Management Process
4.1 Provider Review
We review providers at least yearly; those handling personal data must protect it under written terms.
Change Management
Customer Notification: We notify customers by email at least 30 days before a new sub-processor begins processing personal data, as set out in our Data Processing Agreement.
Objection Rights: Customers may object to a new sub-processor within 30 days of the notice. If an objection cannot be resolved, the customer may terminate the affected services without penalty.
5. Removed Sub-processors
The following table shows sub-processors that have been discontinued:
| Service Provider | Service Description | Removal Date | Reason | Data Handling | Replacement |
|---|---|---|---|---|---|
| No sub-processors have been removed to date. | |||||
6. Regional Compliance
6.1 GDPR (EU and UK)
- Transfers from the EEA or UK rely on Standard Contractual Clauses or an adequacy decision, as set out in our Data Processing Agreement
- Right to object to new sub-processors
6.2 CCPA/CPRA (California)
- We do not sell personal information; California residents' rights are described in our Privacy Policy
6.3 Australian Privacy Act
- Reasonable steps under APP 8 before personal information is disclosed to an overseas recipient
- The countries where personal information may be disclosed are listed in our Privacy Policy
Questions and Updates
For questions about our sub-processors or to request updates:
- Privacy Team: privacy@smartplace.ai
- Data Protection Officer: dpo@smartplace.ai
- Security Team: security@smartplace.ai
- Legal Team: legal@smartplace.ai
This list is updated before a new sub-processor is engaged, as set out in our Data Processing Agreement.