Sub-processors
IntraWork uses a small set of specialist vendors to deliver the platform. Each sub-processor below is named, scoped to a specific function, and bound by published terms. Because IntraWork deploys per-customer (your operational data lives in your own infrastructure, not ours), the list below describes the vendors that operate inside your deployment — not vendors that aggregate data across customers on our side.
| Sub-processor | Purpose | Data processed | Location | Terms |
|---|---|---|---|---|
| Supabase Inc. | Postgres database hosting, authentication, file storage for your deployment. | All operational data your platform records (contacts, projects, agreements, agent activity, brain content). | Default ap-southeast-2 (Sydney) for Australian customers. Region selectable at deployment. | Supabase DPA |
| Microsoft Corporation | Microsoft Graph access to your Outlook, Calendar, OneDrive, and Teams data inside your existing Microsoft 365 tenant. | Mail metadata and selected message bodies (for activity logging), calendar events, OneDrive file metadata, Teams meeting links. Accessed on-demand; not copied wholesale. | Your Microsoft 365 region, as configured in your tenant. | Microsoft Online Services Terms |
| Anthropic, PBC | Large language model inference for the agent team (Claude). | Prompts and responses generated by your agents, which include operational context drawn from your brain and operational data. May contain personal information about your contacts and operations. | United States. | Anthropic Commercial Terms — Anthropic does not train models on customer data submitted via the API. |
| Microsoft Azure (Static Web Apps) | Compute hosting for the Next.js application that serves your deployment. | No customer data at rest. In-memory only during request processing; logs limited to request metadata. | Australia East. | Microsoft Online Services Terms |
| Wix.com Ltd. (conditional — only if your deployment uses the Wix CMS integration) | Inbound form-relay webhook from a Wix-hosted marketing site to your platform. | Marketing form submissions captured via Wix-hosted contact forms — names, business email addresses, organisation details, and message bodies as provided by the form submitter. | United States. | Wix Terms of Use |
What this list does not include
Anything that processes data exclusively on Jessica O'Donnell's own operating deployment (the IntraWork business operations instance) is not a sub-processor for your deployment. The architecture is single-tenant per customer: your data does not flow through our instance.
We do use general business tools — accounting software, email, file storage — to run IntraWork as a company. These vendors do not process your operational data and are not listed here. If you require visibility into IntraWork's corporate vendor stack for procurement reasons, contact us and we will share it under NDA.
Cross-border data flow
Two flows leave Australia:
- Anthropic (United States). Required for the agent runtime to function. The transfer is disclosed in our privacy policy under Australian Privacy Principle 8. Anthropic's contractual position prohibits training on customer data submitted via the API.
- Wix (United States), where applicable. Only inbound — form submissions originating from a Wix-hosted page travel through Wix infrastructure before reaching your deployment. No outbound flow.
All other sub-processors operate in your selected Australian region (Supabase, Azure) or in your own Microsoft 365 region.
Changes to this list
We will notify you by email at least 30 days before adding or replacing any sub-processor. The notification will name the sub-processor, the function, the data categories, the location, and the effective date. If you object to a change for legitimate security or compliance reasons, contact us and we will work with you on a path forward.
Questions
For questions about any sub-processor relationship, contact security@intrawork.com.au.
Last updated: 2026-05-18.