Trust centre
The full subprocessor list.
Every third party that touches OneBookPlus data, plus the one analytics system we run ourselves: what each does, what it sees, and where it stores it. Every row maps to a real production dependency.
This page is the index for due-diligence reviews: the subprocessor tables below, plus links to the security overview, vulnerability disclosure policy, incident-response plan, researcher acknowledgments, and service status.
Trust documents
The reference documents behind this list, each one is a standing page, kept up to date as the platform changes.
Core infrastructure
The vendors running the production database, files, application, and public website. Your business data lives in AWS Sydney (ap-southeast-2), Australia, not the United States. Production is a split: the application (dashboard) runs on AWS ECS Fargate in Sydney, while the public marketing website is served from Vercel's edge network.
| Subprocessor | Purpose | Data accessed | Location |
|---|---|---|---|
Amazon Web Services (Sydney) Supabase production project region | Underlying cloud infrastructure for the production database and storage via Supabase. | All application data at rest, customer records, invoices, bookings, files, audit log. | Australia · AWS ap-southeast-2 (Sydney) |
Supabase @supabase/ssr, @supabase/supabase-js | Managed Postgres, Auth (incl. MFA / TOTP), Storage, and Realtime. | All application data, hashed passwords, MFA factors, session tokens, uploaded files. | Australia · AWS ap-southeast-2 (Sydney) |
Amazon Web Services: ECS Fargate (Sydney) ECS service onebookplus-dashboard, ap-southeast-2 | Hosts the OneBookPlus application (the authenticated dashboard) as containers on AWS ECS Fargate. | Request metadata and short-lived request/response bodies in container memory while serving your session. Persistent data lives in the Supabase-managed database, not on the application containers. | Australia · AWS ap-southeast-2 (Sydney) |
Vercel next ^15, apps/web deployment target | Hosting, edge caching, and serverless function execution for the public marketing website (not the authenticated application). | Request metadata (IP, headers, paths), short-lived request/response bodies in serverless function memory. Application data is not persisted on Vercel. | Global edge network with Sydney point of presence; functions run in nearest region |
Data processors
Vendors that process specific slices of data on our behalf, payments, transactional email, SMS, and calendar sync (plus ATO lodgement, listed ahead of its launch). Some are international; where they are matters less than what they see, which is enumerated below.
| Subprocessor | Purpose | Data accessed | Location |
|---|---|---|---|
Stripe stripe ^20 | Payment processing for OneBookPlus subscriptions and for customer-facing invoicing via Stripe Connect. | Card data (handled by Stripe directly, never touches our servers), payer name and email, billing address, payout bank details for connected accounts. | United States and EU (Stripe-managed regions); AU presence for AUD acquiring |
Resend resend ^6 | Transactional email delivery (invoices, reminders, confirmations, system notifications). | Recipient email address, sender address, message subject and body, delivery status. | United States (AWS-hosted, Resend-managed) |
Twilio src/app/stay/[slug]/actions.ts, src/app/book/[slug]/actions.ts | SMS delivery for booking confirmations, reminders, and notifications where SMS is enabled. | Recipient phone number, message body, delivery status. | United States (Twilio-managed regions); AU sender IDs |
ElevenLabs apps/dashboard/src/app/api/receptionist/elevenlabs/ (initiation, tools, webhook) | Powers the AI Receptionist add-on: answers the business phone number, holds the conversation, and hands back a booking or a message. Only tenants using that add-on are in scope, including a tenant trying it on the shared trial line. | Caller audio, caller phone number, the call transcript, and the booking or service details the caller gives during the call. | United States (ElevenLabs-managed). Bookings written from a call are stored in AWS Sydney. |
Apple iOS in-app purchase flow; APNs device tokens | App Store billing for iOS in-app purchases, and Apple Push Notification service for notifications sent to the iOS app. | Purchase and subscription receipts for in-app purchases, and device push tokens. Apple does not receive your business records. | Apple-managed regions (global) |
Google APIs (Calendar) googleapis ^171, src/lib/google-calendar.ts | Two-way calendar sync for tenants that connect a Google account, bookings written to / read from the connected calendar. | Booking subject, start / end time, attendee email, only for the calendar the tenant explicitly connects. | Google-managed regions (global) |
Australian Taxation Office (ATO): coming soon @onebookplus/sbr-client | Planned direct lodgement of STP pay events, BAS, and tax returns via SBR for the ATO Tax Lodgement add-on (coming soon, not yet available). Listed here so the subprocessor relationship is documented ahead of launch. | When live: lodgement payloads (employee earnings, BAS figures, tax return data) and ATO ABN / TFN identifiers. No data is exchanged with the ATO today. | Australia (Commonwealth Government infrastructure) |
Observability & operations
Vendors that help us keep the platform up and debug it when it is not. They see operational metadata, stack traces, IPs, performance metrics, not business records.
| Subprocessor | Purpose | Data accessed | Location |
|---|---|---|---|
Sentry @sentry/nextjs ^10, sentry.server.config.ts, sentry.edge.config.ts | Error and exception reporting from the web app for triage and debugging. | Stack traces, route paths, request metadata, and user IDs where attached. PII in payloads is scrubbed by Sentry's data filters. | United States (Sentry-managed) |
Upstash (Redis) @upstash/ratelimit, @upstash/redis, src/lib/rate-limit.ts | Rate-limiting for public endpoints and authentication routes. | IP addresses and route identifiers used as rate-limit keys. No business data. | Upstash-managed regions (selectable; defaults to nearest provider region) |
Vercel Analytics & Speed Insights @vercel/analytics, @vercel/speed-insights | Aggregate page-view and Core Web Vitals telemetry for performance monitoring. | Anonymous, aggregated visitor metrics. No personal identifiers. | Vercel-managed |
Cloudflare packages/web-shared/src/components/turnstile-widget.tsx; NEXT_PUBLIC_CLOUDFLARE_TURNSTILE_SITE_KEY | Turnstile bot challenge on sign-up, sign-in and the email-resend form, and edge routing for the onebookplus.com domain. | Visitor IP address, browser signals and the challenge token issued for that attempt. No business data. | Cloudflare-managed global edge |
Google Analytics packages/web-shared/src/components/google-analytics.tsx, gated by hasAnalyticsConsent() | Aggregate visit reporting for the public marketing website only. It is consent-gated: nothing loads until you accept analytics cookies, and it never loads on the authenticated dashboard. | Page paths, referrer, approximate location, device and browser. No business data. | Google-managed regions (global) |
OneBookPlus first-party analytics (not a third party) packages/web-shared/src/components/analytics/web-analytics-beacon.tsx, POSTs to /api/analytics/collect | Our own interaction analytics for the public marketing website: which pages are read, how far people scroll, where on a page they click, whether a form was started and abandoned, and page performance timings. Listed here because it is the honest answer to what touches your data, even though nobody outside OneBookPlus receives it. | Page path, scroll depth, click position and element, form start and abandon signals, and performance timings, against a daily-rotating anonymous identifier. No form field values are ever captured. | Australia · AWS ap-southeast-2 (Sydney), in our own database |
Tenant-connected marketing integrations (Mailchimp, Google Ads, Meta Ads) Per-tenant integration settings; no platform-wide connection exists | Only active for a business that connects one of these accounts itself, from its own settings. Nothing is sent to any of them until that connection is made. | For a connected account only: the contact list or conversion events that business chooses to sync. Disconnecting stops the exchange. | Vendor-managed regions (global) |
Anthropic (Claude) @anthropic-ai/sdk ^0.95.1; src/lib/ai-companion/engine.ts (paid app); src/lib/claude-chat.ts (public chat widget) | Powers the AI Companion app ($25/mo App Marketplace add-on) and the marketing-site chat widget. AI Companion drafts message content (payment chase, no-show follow-up, EOD summaries, etc.) using Claude models on the Anthropic API. The chat widget answers product questions the same way, against a bundled documentation context. | Only the prompt content explicitly sent for the requested action, message templates, the action target (e.g. a single invoice's customer name + amount), and the public docs context for chat. Never bulk database scrapes; never tenant-wide data. Anthropic does not use API inputs to train models. | United States (Anthropic-managed). Tenant data at rest remains in AWS Sydney. |
A few notes on this list
- Production data stays in Sydney. Your business records, files and sign-in data are stored in Australia, in AWS ap-southeast-2 (Sydney). Some specialist suppliers process a defined slice of data overseas, and every one of them is listed row by row in the OneBookPlus subprocessor table. That table is the one above, and each row names the data the supplier can see.
- No data brokers, no ad networks. We do not sell or share customer data with marketing networks. There is no third-party advertising tracking on the authenticated dashboard.
- Tenant opt-in for integrations. Google Calendar and the marketing integrations in the table above (Mailchimp, Google Ads, Meta Ads) only exchange data when a business connects them from its own settings, and disconnecting stops the exchange. Xero Sync and ATO lodgement are coming soon and will follow the same explicit opt-in model.
- Changes. When we add or remove a subprocessor we update this page. Sign up for changelog notifications at /changelog.
Trust & data residency FAQ
- Which OneBookPlus subprocessors hold data outside Australia, and what do they see?
- 14 of the suppliers on this page process data outside Australia: Vercel, Stripe, Resend, Twilio, ElevenLabs, Apple, Google APIs (Calendar), Sentry, Upstash (Redis), Vercel Analytics & Speed Insights, Cloudflare, Google Analytics, Tenant-connected marketing integrations (Mailchimp, Google Ads, Meta Ads) and Anthropic (Claude). Your business records, files and sign-in data are stored in Australia, in AWS ap-southeast-2 (Sydney). Some specialist suppliers process a defined slice of data overseas, and every one of them is listed row by row in the OneBookPlus subprocessor table. What crosses a border is the specific payload each of those suppliers needs for its one job, and the table above states that payload row by row alongside the evidence we checked it against.
- What is a subprocessor?
- A subprocessor is a third-party vendor that processes some of your data on OneBookPlus's behalf, for example Stripe for payments, Resend for email, or Twilio for SMS. This page lists every subprocessor OneBookPlus uses, what it does, what data it can access, and where that data is processed.
- Does OneBookPlus sell or share customer data with advertisers?
- No. OneBookPlus does not sell or share customer data with data brokers or marketing networks, and there is no third-party advertising tracking on the authenticated dashboard. Optional integrations such as Google Calendar only exchange data when a tenant explicitly connects them. Xero Sync and ATO lodgement are coming soon, once live, they too will only exchange data on explicit opt-in.
- Does Anthropic use OneBookPlus data to train AI models?
- No. The AI Companion add-on and the marketing-site chat widget send only the specific prompt content needed for the requested action to Anthropic, and Anthropic does not use API inputs to train its models. Tenant data at rest remains in AWS Sydney.
For the encryption, MFA, and incident-response detail behind these answers, read the OneBookPlus security overview.
Ask about a specific vendor
Email security@onebookplus.com.au and we will answer with specifics. For data subject access or deletion requests, see the privacy policy.
Reviewed by Bishal Shrestha