Trust centre
The full subprocessor list.
Every third party that touches OneBookPlus data, plus the one analytics system we run ourselves: what each does, what it sees, and where it stores it. Every row maps to a real production dependency.
This page is the index for due-diligence reviews: the subprocessor tables below, plus links to the security overview, vulnerability disclosure policy, incident-response plan, researcher acknowledgments, and service status.
Trust documents
The reference documents behind this list, each one is a standing page, kept up to date as the platform changes.
Core infrastructure
The vendors running the production database, files, application, and public website. Your business records, files and sign-in data are stored in AWS Sydney (ap-southeast-2), Australia; the suppliers further down that process a slice of data overseas say what and where, row by row. Production is a split: the application (dashboard) runs on AWS ECS Fargate in Sydney, while the public marketing website is served from Vercel's edge network.
| Subprocessor | Purpose | Data accessed | Location |
|---|---|---|---|
Amazon Web Services (Sydney) | Underlying cloud infrastructure for the production database and storage via Supabase. | All application data at rest, customer records, invoices, bookings, files, audit log. | Australia · AWS ap-southeast-2 (Sydney) |
Supabase | Managed Postgres, Auth (incl. MFA / TOTP), Storage, and Realtime. | All application data, hashed passwords, MFA factors, session tokens, uploaded files. | Australia · AWS ap-southeast-2 (Sydney) |
Amazon Web Services: ECS Fargate (Sydney) | Hosts the OneBookPlus application (the authenticated dashboard) as containers on AWS ECS Fargate. | Request metadata and short-lived request/response bodies in container memory while serving your session. Persistent data lives in the Supabase-managed database, not on the application containers. | Australia · AWS ap-southeast-2 (Sydney) |
Vercel | Hosting, edge caching, and serverless function execution for the public marketing website (not the authenticated application). | Request metadata (IP, headers, paths), short-lived request/response bodies in serverless function memory. Application data is not persisted on Vercel. | Global edge network with Sydney point of presence; functions run in nearest region |
Data processors
Vendors that process specific slices of data on our behalf: payments, transactional email, SMS, calendar sync, and AI drafting and replies (plus ATO lodgement, listed ahead of its launch). Some are international; where they are matters less than what they see, which is enumerated below.
| Subprocessor | Purpose | Data accessed | Location |
|---|---|---|---|
Stripe | Payment processing for OneBookPlus subscriptions and for customer-facing invoicing via Stripe Connect. | Card data (handled by Stripe directly, never touches our servers), payer name and email, billing address, payout bank details for connected accounts. | United States and EU (Stripe-managed regions); AU presence for AUD acquiring |
Resend | Transactional email delivery (invoices, reminders, confirmations, system notifications). | Recipient email address, sender address, message subject and body, delivery status. | United States (AWS-hosted, Resend-managed) |
Twilio | SMS delivery for booking confirmations, reminders, and notifications where SMS is enabled, and the phone line for the AI Receptionist. | Recipient phone number, message body, delivery status. For AI Receptionist calls, the caller's number and the call audio while the call is in progress, and on the standard voice, what the caller says, turned into text. Twilio keeps no recording of the call. | United States (Twilio-managed regions); AU sender IDs |
ElevenLabs | Powers the premium voice of the AI Receptionist add-on: answers the business phone number, holds the conversation, and hands back a booking or a message. Only businesses whose line uses the premium voice are in scope, plus callers to the shared trial line. | Caller audio, caller phone number, the call transcript, and the booking or service details the caller gives during the call. ElevenLabs deletes each call's audio and transcript 7 days after the call ends, and keeps any audio only when the business has switched call recording on. | United States (ElevenLabs-managed), for 7 days. The transcript, the call record and any booking made on a call are stored in AWS Sydney. |
Apple | App Store billing for iOS in-app purchases, and Apple Push Notification service for notifications sent to the iOS app. | Purchase and subscription receipts for in-app purchases, and device push tokens. Apple does not receive your business records. | Apple-managed regions (global) |
Google APIs (Calendar) | Two-way calendar sync for tenants that connect a Google account, bookings written to / read from the connected calendar. | Booking subject, start / end time, attendee email, only for the calendar the tenant explicitly connects. | Google-managed regions (global) |
Google APIs (help chat matching) | Matches what a person asks the help chat (the chat widget and the Ask Plus page on the OneBookPlus website, and the chat inside OneBookPlus on the web and in the iPhone app) to the pages on the website and in the help centre that best answer it. Google turns the words into numbers that OneBookPlus compares with the same kind of numbers for each of its own pages. Google does not write the reply. If this step is switched off, or Google cannot be reached, the help chat still answers, from its own guide to OneBookPlus. | The words a person has typed into the help chat since its last reply, which the chat may send before its next one, and nothing else: not who typed them, and not their account details or business records, unless they type those into the chat. Also the text of OneBookPlus's own public web pages and help articles, so they can be matched. OneBookPlus uses Google's paid service, under which Google acts as its service provider and says it does not use what it receives or sends back to improve its products. | Google-managed regions (global), among them the United States and countries in Europe, Asia and South America. Google says it may store or process the words in any country where it, or a company working for it, has facilities, and that it keeps a copy of what it receives and sends back for 55 days, only to detect and stop misuse of its service and for any disclosure the law or a regulator requires. Google says its authorised staff may read what it flags as possible misuse, and that the copy it keeps trains no AI models except the ones that detect misuse. OneBookPlus keeps its own record of each chat in AWS Sydney. |
Australian Taxation Office (ATO): coming soon | Planned direct lodgement of STP pay events, BAS, and tax returns via SBR for the ATO Tax Lodgement add-on (coming soon, not yet available). Listed here so the subprocessor relationship is documented ahead of launch. | When live: lodgement payloads (employee earnings, BAS figures, tax return data) and ATO ABN / TFN identifiers. No data is exchanged with the ATO today. | Australia (Commonwealth Government infrastructure) |
Anthropic (Claude) | Powers the AI Companion app ($25/mo App Marketplace add-on) and the marketing-site chat widget. AI Companion drafts message content (payment chase, no-show follow-up, EOD summaries, etc.) using Claude models on the Anthropic API. The chat widget answers product questions the same way, against a bundled documentation context. Claude writes the replies of the help chat inside OneBookPlus, on the web and in the iPhone app, while that chat is set to answer by itself rather than pass every message to a person, and it tidies the wording of a reply someone at OneBookPlus writes in any help chat, when they ask it to. It also runs the AI Receptionist's standard voice and text replies, and sorts each receptionist call for the business owner. For Content Autopilot it plans blog topics and drafts the blog and social posts the business then approves or discards: the drafting requests go to Anthropic in batches, and topic planning and the owner's own Draft with AI and Rewrite requests go one at a time. | Only the prompt content explicitly sent for the requested action, message templates, the action target (e.g. a single invoice's customer name + amount), and the public docs context for chat. For the AI Receptionist, what the caller says or texts and the business's receptionist setup. For the help chat inside OneBookPlus on the web: up to the last 30 messages of the conversation, among them any reply from someone at OneBookPlus; the person's name from their team profile, the business's name and plan, and the person's role in it; and the address of the OneBookPlus page they have open. To answer, it may look up, for that business only and without changing anything, the business's setup (its kind, time zone and booking page address, whether card payments are set up and whether it takes payment at booking, whether an ABN is on file and whether it is registered for GST, and how many active services and team members it has), its services with each one's price, duration, category and booking page settings, the apps it has installed with each one's status, price and the date any trial or held price ends, and, only for an owner, admin or accountant, the total owed on unpaid invoices and how many there are, and what was collected and spent this month. Those lookups never return a customer's name, email or phone number, or any one invoice. For the help chat in the iPhone app, Messages: up to the last 6 messages of the conversation, which the web and the iPhone app share, the person's own and the chat's replies, with nothing else about who sent them or their business. When someone at OneBookPlus asks it to tidy a reply in any help chat: the draft and up to the last 10 messages of that conversation. For Content Autopilot, these details from the business's OneBookPlus account: the business name, kind and town; the owner's brief answers, tone, hashtags, words to avoid and topics to avoid; its services with descriptions, prices and durations; its shop categories and products with descriptions; the areas it serves; its business phone and email; the titles and addresses of its website pages and blog posts, and the summary, headings and questions of a blog post a social post shares; the first lines of its earlier social posts; any offer, idea or note the owner writes for a post; the descriptions of the photos a post uses, never the photos themselves, including the caption, title or description the business saved with a job photo or job document it ticks for a post, but never a note the customer wrote when sending the photo; when a post shares one, a customer's name and words from a testimonial the business publishes or a quote the owner pastes in with that customer's permission; and, where Search Console is connected, the searches people used to find the website, with each one's impressions, clicks and average position. Never the customer list, bookings, invoices, or the business's emails, texts and chats with customers. Anthropic says it does not use API inputs or outputs to train its models unless OneBookPlus, as its customer, opts in or reports them as feedback, and OneBookPlus does neither. | United States (Anthropic-managed). Anthropic says it stores the data in the United States, may process a request in the United States, Europe, Asia or Australia, and may handle data for safety review, support or incident response in other countries where it operates; it deletes what its API receives and returns within 30 days (a batch's results stay available to us for 29 days from when the batch was created) and may keep data longer to enforce its usage policy or where the law requires. OneBookPlus's own record of what each post was written from, and the post, stays in AWS Sydney. OneBookPlus keeps its own record of each help chat in AWS Sydney. |
Observability & operations
Vendors that help us keep the platform up and debug it when it is not. They see operational metadata, stack traces, IPs, performance metrics, not business records.
| Subprocessor | Purpose | Data accessed | Location |
|---|---|---|---|
Sentry | Error and exception reporting from the web app for triage and debugging. | Stack traces, route paths, request metadata, and user IDs where attached. PII in payloads is scrubbed by Sentry's data filters. | United States (Sentry-managed) |
Upstash (Redis) | Rate-limiting for public endpoints and authentication routes. | IP addresses and route identifiers used as rate-limit keys. No business data. | Upstash-managed regions (selectable; defaults to nearest provider region) |
Vercel Analytics & Speed Insights | Aggregate page-view and Core Web Vitals telemetry for performance monitoring. | Anonymous, aggregated visitor metrics. No personal identifiers. | Vercel-managed |
Cloudflare | Turnstile bot challenge on sign-up, sign-in and the email-resend form, and edge routing for the onebookplus.com domain. | Visitor IP address, browser signals and the challenge token issued for that attempt. No business data. | Cloudflare-managed global edge |
Google Analytics | Aggregate visit reporting for the public marketing website only. It is consent-gated: nothing loads until you accept analytics cookies, and it never loads on the authenticated dashboard. | Page paths, referrer, approximate location, device and browser. No business data. | Google-managed regions (global) |
OneBookPlus first-party analytics (not a third party) | Our own interaction analytics for the public marketing website: which pages are read, how far people scroll, where on a page they click, whether a form was started and abandoned, and page performance timings. Listed here because it is the honest answer to what touches your data, even though nobody outside OneBookPlus receives it. | Page path, scroll depth, click position and element, form start and abandon signals, and performance timings, against a daily-rotating anonymous identifier. No form field values are ever captured. | Australia · AWS ap-southeast-2 (Sydney), in our own database |
Tenant-connected marketing integrations (Mailchimp, Google Ads, Meta Ads) | Only active for a business that connects one of these accounts itself, from its own settings. Nothing is sent to any of them until that connection is made. | For a connected account only: the contact list or conversion events that business chooses to sync. Disconnecting stops the exchange. | Vendor-managed regions (global) |
A few notes on this list
- Production data stays in Sydney. Your business records, files and sign-in data are stored in Australia, in AWS ap-southeast-2 (Sydney). Some specialist suppliers process a defined slice of data overseas, and every one of them is listed row by row in the OneBookPlus subprocessor table. That table is the one above, and each row names the data the supplier can see.
- No data brokers, no ad networks. We do not sell or share customer data with marketing networks. There is no third-party advertising tracking on the authenticated dashboard.
- Tenant opt-in for integrations. Google Calendar and the marketing integrations in the table above (Mailchimp, Google Ads, Meta Ads) only exchange data when a business connects them from its own settings, and disconnecting stops the exchange. Xero Sync and ATO lodgement are coming soon and will follow the same explicit opt-in model.
- Changes. When we add or remove a subprocessor we update this page. Sign up for changelog notifications at /changelog.
Trust & data residency FAQ
- Which OneBookPlus subprocessors hold data outside Australia, and what do they see?
- 15 of the suppliers on this page process data outside Australia: Vercel, Stripe, Resend, Twilio, ElevenLabs, Apple, Google APIs (Calendar), Google APIs (help chat matching), Anthropic (Claude), Sentry, Upstash (Redis), Vercel Analytics & Speed Insights, Cloudflare, Google Analytics and Tenant-connected marketing integrations (Mailchimp, Google Ads, Meta Ads). Your business records, files and sign-in data are stored in Australia, in AWS ap-southeast-2 (Sydney). Some specialist suppliers process a defined slice of data overseas, and every one of them is listed row by row in the OneBookPlus subprocessor table. What crosses a border is the specific payload each of those suppliers needs for its one job, and the table above states that payload row by row alongside the evidence we checked it against.
- What is a subprocessor?
- A subprocessor is a third-party vendor that processes some of your data on OneBookPlus's behalf, for example Stripe for payments, Resend for email, or Twilio for SMS. This page lists every subprocessor OneBookPlus uses, what it does, what data it can access, and where that data is processed.
- Does OneBookPlus sell or share customer data with advertisers?
- No. OneBookPlus does not sell or share customer data with data brokers or marketing networks, and there is no third-party advertising tracking on the authenticated dashboard. Optional integrations such as Google Calendar only exchange data when a tenant explicitly connects them. Xero Sync and ATO lodgement are coming soon, once live, they too will only exchange data on explicit opt-in.
- Does Anthropic use OneBookPlus data to train AI models?
- Anthropic's published policy is that API inputs and outputs are not used to train its models unless the customer, here OneBookPlus, opts in or reports them as feedback. OneBookPlus has not opted in, and feedback to Anthropic is switched off for its account. The AI Companion add-on, the AI Receptionist, the marketing-site chat widget, the help chat inside OneBookPlus and Content Autopilot send Anthropic only the prompt content needed for the requested action; for Content Autopilot that is the details listed in the table above, never the customer list, bookings, invoices, or the business's emails, texts and chats with customers. Anthropic says it deletes what it receives within 30 days, unless its safety systems flag it or the law requires it to keep it longer. OneBookPlus's own records stay in AWS Sydney.
- What does the help chat inside OneBookPlus send to Anthropic?
- OneBookPlus sets the help chat inside OneBookPlus, for every business at once, either to answer by itself or to pass every message to a person, and only while it answers by itself does it send a conversation to Anthropic for a reply. While a conversation is with a person, its new messages are not sent for a reply. On the web the chat sends up to the last 30 messages of the conversation, the person's name from their team profile, the business's name and plan, the person's role in it and the address of the OneBookPlus page they have open. It may also look up that business's setup, services and installed apps and, for an owner, admin or accountant, its totals for unpaid invoices and for this month's takings and spending. Its lookups only read, cover only that business, and never return a customer's name, email or phone number. In the iPhone app, in Messages, it sends up to the last 6 messages of the conversation, which the web and the iPhone app share, with nothing else about who sent them or their business. Whichever way the chat is set, when someone at OneBookPlus asks Claude to tidy the wording of a reply they are writing in any help chat, the draft and up to the last 10 messages of that conversation go to Anthropic. Anthropic's rules on training and on deleting what it receives, in the answer above, apply to these too, and OneBookPlus keeps its own record of each help chat in AWS Sydney.
- What does the OneBookPlus help chat send to Google?
- Before the help chat replies, on the OneBookPlus website or inside OneBookPlus, it may send Google the words the person has typed since its last reply, so it can find the pages on the website and in the help centre that best answer them. Nothing else goes with them: not who typed them, and not their account details or business records, unless they type those into the chat. Google does not write the reply. OneBookPlus uses Google's paid service, and Google says it does not use what it receives or sends back to improve its products, keeps a copy for 55 days only to detect and stop misuse of its service and for any disclosure the law or a regulator requires, and may store or process the words in any country where it, or a company working for it, has facilities, among them the United States and countries in Europe, Asia and South America. If this step is switched off, the help chat still answers, from its own guide to OneBookPlus.
For the encryption, MFA, and incident-response detail behind these answers, read the OneBookPlus security overview.
Ask about a specific vendor
Email security@onebookplus.com.au and we will answer with specifics. For data subject access or deletion requests, see the privacy policy.
Reviewed by Bishal Shrestha