Sub-processor List
Last updated: June 2026
Osapher uses the following third-party sub-processors to deliver our platform. This list is maintained in accordance with our obligations under the Australian Privacy Act 1988 and applicable data protection regulations.
| Sub-processor | Purpose | Data Location | Privacy Policy |
|---|---|---|---|
| Supabase Inc | Database, authentication, storage | Sydney, Australia (ap-southeast-2) | supabase.com/privacy |
| Railway Corp | API server hosting | Singapore (asia-southeast1) — transit only, no persistent data stored | railway.app/legal/privacy |
| Vercel Inc | Web application hosting, CDN | Global CDN, AU/NZ edge nodes | vercel.com/legal/privacy-policy |
| Google LLC | OAuth authentication (Sign in with Google) | USA | policies.google.com/privacy |
| Google LLC | AI Intelligence Audit (Gemini API) | USA | policies.google.com/privacy |
| OpenSanctions Datenbanken GmbH | DFAT sanctions list screening data | Germany (EU) | opensanctions.org/licensing/ |
| Stripe Inc | Payment processing and billing | USA | stripe.com/privacy |
| Resend Inc | Transactional email delivery | USA | resend.com/legal/privacy-policy |
| OpenAI | AI visibility scanning (ChatGPT/GPT-4o) | USA | openai.com/privacy |
| Perplexity AI | AI visibility scanning | USA | perplexity.ai/privacy |
| Anthropic PBC | AI processing (Claude Haiku, AI visibility scanning) | USA | anthropic.com/privacy |
Government Registry Data Sources
Osapher queries the following government registries. These are not sub-processors — they are authoritative public data sources:
- Australian Business Register (ATO)
- NZBN Register (MBIE, New Zealand)
Enterprise Data Residency
For Enterprise KYB customers: verification records, Fracture Score results, officer decisions, VRNT-KYB certificates, and audit logs are stored in Supabase, hosted on AWS in Sydney, Australia (ap-southeast-2). API requests are processed through Railway infrastructure located in Singapore — Railway is used only to run the application server and does not persist Enterprise customer data at rest. Sanctions and PEP screening queries are processed by OpenSanctions Datenbanken GmbH, a third-party screening provider headquartered in Germany, via their hosted API service.
Updates to This List
We will update this page when sub-processors change. Enterprise customers requiring advance notice of sub-processor changes should contact enterprise@osapher.com.