Sub-processors
A sub-processor is a third party we use to provide the EventOS service. This page lists every sub-processor that handles your data, what they do, and where they store it. We will notify account holders by email at least 14 days before adding a new sub-processor that handles personal data.
| Sub-processor | Purpose | Data handled | Region |
|---|---|---|---|
| Supabase | Postgres database, authentication, storage | All account, event, and volunteer data | Sydney, Australia |
| Vercel | Web application hosting, edge functions | Request metadata, logs | Sydney, Australia |
| Resend | Transactional email delivery | Recipient email addresses, message content | United States |
| Upstash | Redis for rate limiting | IP addresses, short-lived rate-limit keys | Australia |
| Stripe | Payment processing (paid plans only) | Billing details, customer IDs | United States, Australia |
| Cloudflare | DNS and edge CDN (via Vercel) | Request metadata | Global edge network |
| GitHub | Source-code hosting and CI/CD | No customer data; code only | United States |
Why these regions
NZ does not yet have a comprehensive local cloud offering for our stack. Sydney is the closest major region for Supabase, Vercel, and Upstash, and is covered by Australian Privacy Principles which we consider comparable to the NZ Privacy Act 2020. US-hosted sub-processors (Resend, Stripe) are major incumbents whose privacy practices we have assessed as providing comparable safeguards.
Changes
When we add or remove a sub-processor we will update this list and email all account holders before the change takes effect.