Sub-processors

Version: 1.0 | Effective Date: 2 September 2026 | Last Updated: 2 September 2026

This page lists the third parties that Difinity Pty Ltd (ABN 82 686 692 759) appoints to process Customer Personal Data for the contracted Difinity.ai Services.

Services Sub-processors

The list below is the current Annex 3 list under the Data Processing Agreement. Model providers are conditional Sub-processors only when Difinity funds the model call. If the Customer supplies its own provider key, the provider is the Customer's own provider relationship for that call.

Difinity offers hosting in AWS regions in Australia (Sydney), European Union (Frankfurt) and United States. The region for an organisation is agreed in the order form.

Amazon Web Services Australia Pty Ltd

• Service and purpose: AWS, including Aurora, S3, Secrets Manager and Bedrock: hosting, storage, secret storage and Difinity-hosted model processing
• Customer personal data: Service data, stored content, credentials and model inputs and outputs as applicable
• Data subjects: Customer administrators, authorised people, application end users and people represented in Customer content
• Processing location: Australia (Sydney), European Union (Frankfurt) or United States, according to the order form
• Transfer mechanism: EU Standard Contractual Clauses adopted in June 2021, UK Addendum and Swiss addendum, as applicable
• Appointment date: Before 2 September 2026
• Privacy, security and processor terms: AWS DPA; AWS sub-processors; Bedrock privacy
• Customer notice: privacy@difinity.ai

Supabase Pte. Ltd.

• Service and purpose: Supabase: authentication and session services
• Customer personal data: Account identifiers, authentication data, session data and minimal profile claims
• Data subjects: Customer administrators and authorised people
• Processing location: in the same region as the organisation's hosting region: Australia (Sydney), European Union (Frankfurt) or United States
• Transfer mechanism: EU Standard Contractual Clauses Module 2 or 3, UK Addendum and Swiss addendum, as applicable
• Appointment date: Before 2 September 2026
• Privacy, security and processor terms: Supabase DPA; Supabase sub-processors; Supabase security
• Customer notice: privacy@difinity.ai

Stripe Payments Australia Pty Ltd

• Service and purpose: Stripe and Stripe affiliates under Stripe's Data Processing Agreement: billing and monthly invoicing
• Customer personal data: Customer contact, billing, invoice and payment-related data
• Data subjects: Customer billing contacts and authorised administrators
• Processing location: Multiple locations; Stripe does not publish one fixed processing region for the Services
• Transfer mechanism: EEA Standard Contractual Clauses Modules 1 and 2 and UK International Data Transfer Addendum, as applicable
• Appointment date: Before 2 September 2026
• Privacy, security and processor terms: Stripe DPA; Stripe service providers; Stripe security
• Customer notice: privacy@difinity.ai

OpenAI OpCo, LLC

• Service and purpose: OpenAI: conditional model inference for Difinity-funded calls
• Customer personal data: Model input, output and technical request metadata
• Data subjects: People represented in model input or output
• Processing location: Vendor-selected locations unless data residency is configured; available residency regions include Australia, the United States and Europe, while system data may be processed elsewhere
• Transfer mechanism: EU Standard Contractual Clauses for EEA and Swiss data and the UK Addendum for UK data; APP 8 reasonable steps apply to Difinity's disclosures from Australia
• Appointment date: Before 2 September 2026
• Privacy, security and processor terms: OpenAI DPA; OpenAI sub-processors; OpenAI API data controls
• Customer notice: privacy@difinity.ai

Anthropic, PBC

• Service and purpose: Anthropic: conditional model inference for Difinity-funded calls
• Customer personal data: Model input, output and technical request metadata
• Data subjects: People represented in model input or output
• Processing location: No single default processing country or region is stated in Anthropic's published commercial terms
• Transfer mechanism: EU Standard Contractual Clauses Module 2 or 3, UK Addendum and Swiss addendum, as applicable
• Appointment date: Before 2 September 2026
• Privacy, security and processor terms: Anthropic DPA; Anthropic sub-processors; Anthropic retention
• Customer notice: privacy@difinity.ai

Google Australia Pty Ltd

• Service and purpose: Google: conditional model inference for Difinity-funded calls
• Customer personal data: Model input, output and technical request metadata
• Data subjects: People represented in model input or output
• Processing location: No fixed default region for the Gemini Developer API; data may be processed in countries where Google or its agents maintain facilities unless a region-pinned service is used
• Transfer mechanism: EU Standard Contractual Clauses for controller-to-processor or processor-to-processor transfers and the EU-US Data Privacy Framework, as applicable
• Appointment date: Before 2 September 2026
• Privacy, security and processor terms: Google processor terms; Google sub-processors; Gemini API data controls
• Customer notice: privacy@difinity.ai

Hangzhou DeepSeek Artificial Intelligence Co., Ltd.

• Service and purpose: DeepSeek: conditional model inference for Difinity-funded calls
• Customer personal data: Model input, output and technical request metadata
• Data subjects: People represented in model input or output
• Processing location: People's Republic of China
• Transfer mechanism: No named transfer mechanism is published; DeepSeek states only that it will use appropriate safeguards where required
• Appointment date: Before 2 September 2026
• Privacy, security and processor terms: DeepSeek Privacy Policy; DeepSeek Open Platform Terms. DeepSeek publishes no DPA and no API no-training commitment. Enabled only by the Customer's own model selection in Hub; excluded from the clause 10.4 flow-down.
• Customer notice: privacy@difinity.ai

SpaceXAI (formerly xAI), as named in its Data Processing Addendum effective 24 August 2026

• Service and purpose: xAI (Grok): conditional model inference for Difinity-funded calls
• Customer personal data: Model input, output and technical request metadata
• Data subjects: People represented in model input or output
• Processing location: United States and other countries
• Transfer mechanism: EU Standard Contractual Clauses and UK Addendum under the SpaceXAI DPA; APP 8 reasonable steps apply to Difinity's disclosures from Australia
• Appointment date: Before 2 September 2026
• Privacy, security and processor terms: SpaceXAI DPA; xAI API security
• Customer notice: privacy@difinity.ai

Website and Business Vendors

These vendors support Difinity's own website, marketing and business operations as a controller. They are separate from the Services Sub-processors above and are not part of the Data Processing Agreement. The entries below repeat only what the Privacy Policy section 7.3 already states; the Privacy Policy is the source document.

Change notice and objection

Difinity will give at least 30 days' advance notice before a new or replacement Sub-processor begins processing Customer Personal Data. Notice will be sent by email to the organisation's administrators and this page will be updated.

The Customer may object during that period on reasonable data protection grounds by emailing privacy@difinity.ai. If no commercially reasonable alternative is available, the Customer may terminate the affected Service without penalty, as set out in the Data Processing Agreement.

Scope of this list

This page covers Sub-processors for the contracted Services only. A vendor the Customer appoints directly, including a model provider used with the Customer's own key, a connected system or a customer-registered MCP server, is the Customer's own provider relationship for that interaction.

Difinity's controller-side website, marketing and business vendor register is published above under "Website and Business Vendors" and remains separate from the Services Sub-processors and the Data Processing Agreement.