Sub-processor List
Version 1.2, effective 12 November 2026. Published at https://photosentinel.com/legal/sub-processors.
This list forms part of our Privacy Policy and is the Sub-processor List referred to in clause 18.5 of our Master Subscription Agreement. It names the service providers that process personal information for PhotoSentinel, what each one does, where each one processes it, and the countries from which our personnel may access it. We update it when our providers change. Where a location is shown as "not yet confirmed", we are confirming it with the provider and will update this list when we have its answer. Sentinel OS customers receive notice of changes under clause 18.6 of the MSA.
Part B: Sentinel OS
Within your cell
| Provider | What it does | Australia cell | US cell | UAE cell |
|---|---|---|---|---|
| Cloudflare (R2, Workers and Stream) | Image and video storage; livestream video; application hosting | Oceania region | United States | Singapore (images and video) |
| Databricks (Lakebase) | Organisation database | Australia | United States | United Arab Emirates |
Global systems, used for every cell
| Provider | What it does | Where it processes data |
|---|---|---|
| Cloudflare | Network and request metadata (IP address, requested address, browser details) | United States; Portugal (log redundancy) |
| Vercel | Web front ends of the customer application and Help Centre; internal sales system and electronic signing site; our website | Australia (Sydney) for the customer application; other sites not yet confirmed |
| Supabase | Internal sales system database | Australia (Sydney) |
| Stripe | Payments, in a separate account for each cell | United States (not yet confirmed by the provider) |
| Xero | Accounting, in a separate organisation for each cell | Not yet confirmed; we have asked Xero for its data-location statement |
| Pipedrive | Customer relationship management (sales contacts) | European Union or United States, depending on the account; ours is not yet confirmed |
| Unleashed | Inventory and order fulfilment | Not yet confirmed |
| Microsoft (Entra and Microsoft 365) | Staff identity and sign-in; staff email, calendars and messaging | Not yet confirmed |
| Resend | Email delivery | United States (account data); Japan (sending domains) |
| Google Fonts | Fonts on the mobile application, Help Centre and signing page (receives the visitor's IP address) | Google's global network |
| Stadia Maps | Map tiles and address look-up | Not yet confirmed |
| Weatherstack | Weather data | Not yet confirmed; we have asked Weatherstack for its storage statement |
| Anthropic | Help chat (no images or video) | United States |
| EasyPost | Shipping labels and tracking, once we enable it | United States |
Part A: Legacy platform
Applies until the legacy platform closes in June 2027.
| Provider | What it does | Where it processes data |
|---|---|---|
| Oracle Cloud Infrastructure | Hosting, database and image storage | United States (Phoenix); Saudi Arabia (Jeddah); Australia (Melbourne) |
| Wasabi | Image and video storage | Australia (Sydney); United States (US West); Germany (Frankfurt) |
| Celantur | Face and number-plate blurring | Austria |
| Clerk | Customer sign-in | United States |
| Mandrill (Mailchimp Transactional) | Email delivery | United States |
| Clickatell | SMS delivery | Clickatell does not publish a hosting location; not yet confirmed |
| Jira (Atlassian) | Support tickets, until February 2027 | Atlassian's global hosting regions, unless our data location is pinned to one region (not yet confirmed) |
Each legacy customer's data is held in the Oracle and Wasabi location that serves the customer's region.
Our website
| Provider | What it does | Where it processes data |
|---|---|---|
| Google (Tag Manager, Analytics and Ads) | Website analytics and advertising measurement | United States |
| Meta (Facebook) | Advertising remarketing | United States |
| Vercel (BotID) | Bot detection on website forms | United States (not yet confirmed by the provider) |
Personnel access
Our people, including contractors, may access personal information from these countries to provide support and engineering:
- Australia
- United States
- United Arab Emirates
- Vietnam
Changes to this list
| Date | Change |
|---|---|
| 9 November 2026 | First version |
| 10 November 2026 (version 1.1) | Cloudflare Stream, Google Fonts, Meta and Vercel BotID added; Vercel, Microsoft and Oracle descriptions corrected; SMS and push-notification providers removed from Sentinel OS until they are in use; US and UAE cell locations stated |
| 12 November 2026 (version 1.2) | Drafting notes removed. Each location now states what we know, and says where a provider has not yet confirmed it; the location of legacy customer data stated |