Version: 1.2 | Effective Date: 14 October 2026 | Last Updated: 14 October 2026
This page lists the third parties that Difinity Pty Ltd (ABN 82 686 692 759) appoints to process Customer Personal Data for the contracted Difinity.ai Services.
Services Sub-processors
The list below is the current Annex 3 list under the Data Processing Agreement. Model providers are conditional Sub-processors only when Difinity funds the model call. If the Customer supplies its own provider key, the provider is the Customer's own provider relationship for that call.
Difinity hosts the Platform in AWS Australia (Sydney, ap-southeast-2). That is the only live region today. Hosting in European Union (Frankfurt) and United States regions is available by arrangement: a dedicated deployment is set up when a customer signs. Model and connector calls can leave the hosting region.
Amazon Web Services Australia Pty Ltd
- Service and purpose: AWS, including Aurora, S3, Secrets Manager and Bedrock: hosting, storage, secret storage and Difinity-hosted model processing
- Customer personal data: Service data, stored content, credentials and model inputs and outputs as applicable
- Data subjects: Customer administrators, authorised people, application end users and people represented in Customer content
- Processing location: Australia (Sydney). Other AWS regions are available by arrangement, with a dedicated deployment set up when a customer signs. Model and connector calls can leave the hosting region
- Transfer mechanism: EU Standard Contractual Clauses adopted in June 2021, UK Addendum and Swiss addendum, as applicable
- Appointment date: Before 2 September 2026
- Privacy, security and processor terms: AWS DPA; AWS sub-processors; Bedrock privacy
- Customer notice: privacy@difinity.ai
Supabase Pte. Ltd.
- Service and purpose: Supabase: authentication and session services
- Customer personal data: Account identifiers, authentication data, session data and minimal profile claims
- Data subjects: Customer administrators and authorised people
- Processing location: in the same region as the organisation's hosting region: Australia (Sydney), or another region where one is agreed
- Transfer mechanism: EU Standard Contractual Clauses Module 2 or 3, UK Addendum and Swiss addendum, as applicable
- Appointment date: Before 2 September 2026
- Privacy, security and processor terms: Supabase DPA; Supabase sub-processors; Supabase security
- Customer notice: privacy@difinity.ai
Stripe Payments Australia Pty Ltd
- Service and purpose: Stripe and Stripe affiliates under Stripe's Data Processing Agreement: card payments, billing and invoicing
- Customer personal data: Customer contact, billing, invoice and payment-related data
- Data subjects: Customer billing contacts and authorised administrators
- Processing location: Multiple locations; Stripe does not publish one fixed processing region for the Services
- Transfer mechanism: EEA Standard Contractual Clauses Modules 1 and 2 and UK International Data Transfer Addendum, as applicable
- Appointment date: Before 2 September 2026
- Privacy, security and processor terms: Stripe DPA; Stripe service providers; Stripe security
- Customer notice: privacy@difinity.ai
OpenAI OpCo, LLC
- Service and purpose: OpenAI: conditional model inference for Difinity-funded calls
- Customer personal data: Model input, output and technical request metadata
- Data subjects: People represented in model input or output
- Processing location: Vendor-selected locations unless data residency is configured; available residency regions include Australia, the United States and Europe, while system data may be processed elsewhere
- Transfer mechanism: EU Standard Contractual Clauses for EEA and Swiss data and the UK Addendum for UK data; APP 8 reasonable steps apply to Difinity's disclosures from Australia
- Appointment date: Before 2 September 2026
- Privacy, security and processor terms: OpenAI DPA; OpenAI sub-processors; OpenAI API data controls
- Customer notice: privacy@difinity.ai
Anthropic, PBC
- Service and purpose: Anthropic: conditional model inference for Difinity-funded calls
- Customer personal data: Model input, output and technical request metadata
- Data subjects: People represented in model input or output
- Processing location: No single default processing country or region is stated in Anthropic's published commercial terms
- Transfer mechanism: EU Standard Contractual Clauses Module 2 or 3, UK Addendum and Swiss addendum, as applicable
- Appointment date: Before 2 September 2026
- Privacy, security and processor terms: Anthropic DPA; Anthropic sub-processors; Anthropic retention
- Customer notice: privacy@difinity.ai
Google Australia Pty Ltd
- Service and purpose: Google: conditional model inference for Difinity-funded calls
- Customer personal data: Model input, output and technical request metadata
- Data subjects: People represented in model input or output
- Processing location: No fixed default region for the Gemini Developer API; data may be processed in countries where Google or its agents maintain facilities unless a region-pinned service is used
- Transfer mechanism: EU Standard Contractual Clauses for controller-to-processor or processor-to-processor transfers and the EU-US Data Privacy Framework, as applicable
- Appointment date: Before 2 September 2026
- Privacy, security and processor terms: Google processor terms; Google sub-processors; Gemini API data controls
- Customer notice: privacy@difinity.ai
SpaceXAI (formerly xAI), as named in its Data Processing Addendum effective 24 August 2026
- Service and purpose: xAI (Grok): conditional model inference for Difinity-funded calls
- Customer personal data: Model input, output and technical request metadata
- Data subjects: People represented in model input or output
- Processing location: United States and other countries
- Transfer mechanism: EU Standard Contractual Clauses and UK Addendum under the SpaceXAI DPA; APP 8 reasonable steps apply to Difinity's disclosures from Australia
- Appointment date: Before 2 September 2026
- Privacy, security and processor terms: SpaceXAI DPA; xAI API security
- Customer notice: privacy@difinity.ai
Composio (Sampark, Inc., trading as Composio)
- Service and purpose: Composio: broker for connector apps connected through the Composio catalogue. It carries brokered connector calls and holds the linked accounts and their tokens
- Customer personal data: Arguments and results of brokered connector calls, linked-account identifiers, and the OAuth tokens and API keys the broker holds for those accounts
- Data subjects: Customer administrators, authorised people and people represented in connected-system records
- Processing location: United States (AWS us-east-1), outside the hosting region
- Transfer mechanism: EU Standard Contractual Clauses (Modules 2 and 3) under the Composio Data Processing Addendum, as applicable; APP 8 reasonable steps apply to Difinity's disclosures from Australia
- Appointment date: 12 October 2026
- Privacy, security and processor terms: Composio DPA; Composio sub-processors
- Customer notice: privacy@difinity.ai
Exa (Exa Labs, Inc.)
- Service and purpose: Exa: the built-in web search and research tool. The tool is added to an agent version by its builder
- Customer personal data: The search query and the caller's country. Search queries may contain personal information. Difinity does not redact personal information from search queries, because doing so would stop the search returning correct results
- Data subjects: People mentioned in a search query
- Processing location: Outside Australia (United States, and possibly other countries). Exa Labs, Inc. is based in San Francisco, United States and does not publish where it processes queries
- Transfer mechanism: EU Standard Contractual Clauses and UK Addendum under the Exa Data Processing Addendum, as applicable; APP 8 reasonable steps apply to Difinity's disclosures from Australia
- Appointment date: 12 October 2026
- Privacy, security and processor terms: Exa DPA; Exa privacy policy; Exa trust centre. How long Exa keeps queries is set by Exa's own terms
- Customer notice: privacy@difinity.ai
Website and Business Vendors
These vendors support Difinity's own website, marketing and business operations as a controller. They are separate from the Services Sub-processors above and are not part of the Data Processing Agreement. The entries below repeat only what the Privacy Policy section 7.3 already states; the Privacy Policy is the source document.
| Vendor | Purpose | Processing location | Privacy or DPA terms |
|---|---|---|---|
| Amazon Web Services | Public tools, report generation, storage and email delivery | AWS regions used for the public tools | AWS DPA |
| HubSpot | CRM and sales operations | United States and other countries where HubSpot operates | HubSpot DPA |
| PostHog | One project-configuration request per page load before consent, and consented analytics | European Union (Frankfurt), via PostHog Cloud EU | PostHog DPA |
| Google LLC | Google Analytics, when enabled and consented | United States and other countries where Google operates | Google Data Processing Terms |
| Meta Platforms Ireland Limited | Meta Pixel, when enabled and consented | Ireland and other countries described in its terms | Meta Platforms Privacy Policy; Meta Platforms Business Tools Terms |
Change notice and objection
Difinity will give at least 30 days' advance notice before a new or replacement Sub-processor begins processing Customer Personal Data. Notice will be sent by email to the organisation's administrators and this page will be updated. Anyone can ask to be added to the notice list at privacy@difinity.ai. A change in the country where an existing Sub-processor processes Customer Personal Data is treated as a new Sub-processor.
The Customer may object during that period on reasonable data protection grounds by emailing privacy@difinity.ai. If no commercially reasonable alternative is available, the Customer may terminate the affected Service without penalty and Difinity will refund fees prepaid for the period after termination, as set out in the Data Processing Agreement.
Scope of this list
This page covers Sub-processors for the contracted Services only. A vendor the Customer appoints directly, including a model provider used with the Customer's own key, a connected system, an OpenAPI connector or a customer-registered MCP server, is the Customer's own provider relationship for that interaction. Composio and Exa are listed above because Difinity appoints them.
Difinity's controller-side website, marketing and business vendor register is published above under "Website and Business Vendors" and remains separate from the Services Sub-processors and the Data Processing Agreement.