YourCSM Sub-processors
Last updated 2026-08-19. We notify existing customers 30 days before any new sub-processor begins processing their data.
What this list is
Yoursoftware Pty Ltd engages sub-processors to deliver our services. We require each to sign a Data Processing Agreement (DPA) consistent with our customer-facing DPA, the Privacy Act 1988 (Cth), and (for EU data) GDPR Article 28.
This page is reviewed by our security function on every sub-processor onboarding or offboarding, on any change to DPA / region / SOC 2 status, and quarterly minimum. Subscribe to change notifications: security@yoursoftware.com.au.
Client-selectable AI providers (browser-direct)
YourCSM is local-first. When a broker classifies a document, the document text is sent from the broker's browser to the AI provider configured in Settings. In the ordinary (bring-your-own-key) case that call goes directly to the provider and we do not proxy, relay, or store it. There is one exception, set out below. Supported providers:
- Google (Gemini) — the default document classification provider; used unless the broker changes it · United States and other Google regions · browser-direct
- Anthropic (Claude) — document classification where the broker selects it · United States (contracted region) · browser-direct on a bring-your-own-key account · also listed under Critical sub-processors
- Groq — document classification where the broker selects it · United States · browser-direct
Exception — internal-account Claude relay. Where a user is signed in on a Yoursoftware-issued internal account, YourCSM does not send Claude requests browser-direct. It routes them through a Yoursoftware-operated endpoint (/api/ai, Microsoft Azure, Australia East) so the organisation's API key remains server-side, and the endpoint forwards the request to Anthropic. In that configuration document text transits Yoursoftware infrastructure. It is not retained there. This path does not apply to brokers using their own API key. Yoursoftware Pty Ltd is listed as a Critical sub-processor below in respect of this relay.
Separately, YourCSM queries the Australian Business Register (ABR) (Australia) for ABN lookups against public register data only — no customer RESTRICTED data is transmitted.
Critical sub-processors
| Vendor | Role | Region | DPA |
|---|---|---|---|
| Anthropic PBC | LLM API (Claude — Haiku / Sonnet / Opus) for document extraction + scoring + content generation | United States (contracted region) | Yes · AU-region addendum in progress |
| Google LLC | Google Workspace (Gmail, Drive, Calendar, Docs, Sheets) for business operations | AU + US | Yes · verification in progress |
| CRM provider (MyCRM) | Broker customer relationship management; settlement workflow | Australia | Yes · via aggregator agreement |
| Microsoft Azure | Application hosting (static site + Azure Functions + Front Door) for productised apps; also hosts the account sign-in backend and the internal-account AI relay | Australia East | Yes · Microsoft Products & Services DPA |
| Google LLC (Gemini API) | Default AI document classification + field extraction. Receives client document text from the broker's browser. | United States and other Google regions | Pre-confirmation · terms verification in progress |
| Groq Inc | AI document classification where the broker selects it. Receives client document text from the broker's browser. | United States | Pre-confirmation |
| Yoursoftware Pty Ltd (own infrastructure) | Account sign-in; and, for internal accounts only, relay of Claude requests via /api/ai — document text transits in memory, not retained | Australia East (Azure) | n/a — controller / operator |
| Supabase Inc | Postgres + authentication + storage (productised apps v2) | Australia (Sydney region) | Pre-onboarding · DPA signed before v2 production launch |
| Quickli Pty Ltd | Serviceability calculator (where used in YourCSM workflow) | TBC · verification in progress | Pre-confirmation |
| DocuSign | Document signature for settlement documents | United States | Pre-confirmation |
| illion / Frollo | Open Banking data retrieval (where used; per consumer consent under CDR) | Australia | Pre-confirmation |
Significant sub-processors
| Vendor | Role | Region | DPA |
|---|---|---|---|
| Xero | Accounting + payroll | Australia | Yes · verification in progress |
| Lakera AI (or approved alternate) | Prompt injection defence (AI guardrails — productised apps) | European Union | Pre-onboarding |
| 1Password Business | Password + secrets vault | AU + US | Yes |
| Huntress Labs | Managed endpoint detection + response (Wk5-8 rollout) | United States | Pre-onboarding |
| Material Security (or alternate) | Email security + BEC defence | United States | Pre-onboarding |
| Cobalt.io (or approved alternate) | Penetration testing as a service | United States | Pre-onboarding |
| HackerOne (or approved alternate) | Bug bounty platform (private — from Mo 9) | United States | Pre-onboarding |
| Canva Pty Ltd | Brand assets + content design | US (founded AU) | Verification in progress |
| GitHub Inc | Source code repository hosting | United States | Yes |
| N-able (via LMG MSP) / AVDefender | Endpoint protection (cascaded via LMG aggregator partnership) | United States | Yes · via LMG |
Routine sub-processors
| Vendor | Role | Region |
|---|---|---|
| Ideogram AI | AI image generation (Marketing use only) | United States |
| Orshot | Screenshot automation (Marketing use only) | United States |
| OpenAI | GPT API (marketing content generation only) | United States |
| Apify | Web scraping (competitive intelligence — no customer data) | United States |
| Better Stack | Public status page | US / EU |
| dmarcian | DMARC aggregate report monitoring | International |
Removed sub-processors
| Vendor | Former role | Removed | Basis |
|---|---|---|---|
| Voyage AI (now Anthropic) | Embeddings for semantic pre-classification (YourCSM Phase 0B) | 2026-08 | Feature withdrawn; the endpoint is absent from the shipped application and removed from the Content Security Policy, so no data can be sent to it. |
| Netlify Inc | Static hosting for productised apps | 2026-07 | Production hosting migrated to Microsoft Azure (Australia East). |
Change notification policy
We notify existing customers 30 days before any new sub-processor begins processing their data. We notify the address on file at contract execution. Existing customers may object to any new sub-processor within 30 days of notification. If we cannot resolve the objection, the customer may terminate the affected service.
To subscribe additional addresses to notifications: security@yoursoftware.com.au.
Questions
Email security@yoursoftware.com.au.
© Yoursoftware Pty Ltd. Per the Privacy Act 1988 (Cth) and APP 8.