Book a Demo

AI governance for Australian schools.

Home

Sub-processors

Last updated: 26 April 2026

Overview

Arvoe uses a small number of carefully selected third-party providers to operate the Arvoe Platform. We publish this list so schools and prospective customers can understand where their data is processed, by whom, and under what terms.

We follow a least-privilege principle when engaging sub-processors: each provider listed below has a defined operational role, processes only the data necessary for that role, and is bound by a Data Processing Agreement or equivalent contract.

Current sub-processors

Supabase, Inc.

Role
Primary database, authentication, file storage, and backend functions for the Arvoe Platform.
Data processed
Tenant content including risk registers, policies, controls, stakeholder records, conversation history, and authentication credentials.
Country of processing
Australia.
ProviderPrivacySecurity (SOC 2 Type II)

Anthropic PBC

Role
Large language model inference for AI features, including Ask Arvoe.
Data processed
Conversational inputs and outputs containing tenant content submitted to AI features.
Country of processing
United States.
Retention & training
Customer data is processed transiently with a maximum 7-day retention window for safety and abuse-monitoring purposes only. Anthropic does not use Arvoe customer data to train its models. Zero Data Retention is available on request under the Anthropic DPA at higher token rates.
ProviderPrivacyDPATrust

Microsoft (Azure OpenAI Service)

Role
Embedding model inference for semantic search and retrieval across Arvoe entities.
Data processed
Short text fragments from tenant content, converted to vector embeddings.
Country of processing
Australia.
ProviderPrivacyDPATrust

Vercel, Inc.

Role
Hosting and serverless function execution for the Arvoe customer-facing web application.
Data processed
Session data and request payloads in transit. Data at rest is held in Supabase, not Vercel.
Country of processing
Australia.
ProviderPrivacyDPASecurity (SOC 2 Type II)

Cloudflare, Inc.

Role
Edge proxy and request routing for optional external integrations, including Model Context Protocol (MCP) endpoints.
Data processed
Authentication tokens and request/response payloads in transit. No data at rest.
Country of processing
Cloudflare's global edge network. For Australian users, execution typically occurs at Australian edge locations.
ProviderPrivacyDPATrust (SOC 2 Type II)

Resend, Inc.

Role
Transactional email delivery for in-app feedback submissions and contact form messages.
Data processed
Sender email address, message content, and any tenant context included by the user when submitting feedback.
Country of processing
United States.
ProviderPrivacySecurity

Cross-border data transfers

Some sub-processors above process data outside Australia. Where Arvoe transfers data overseas, we rely on:

  • The contractual protections in each provider's Data Processing Agreement, including standard contractual clauses where applicable
  • Australian Privacy Principle 8 obligations to take reasonable steps to ensure overseas recipients do not breach the APPs in relation to that data
  • The provider's published security certifications (SOC 2 Type II, ISO 27001) where available

The cross-border transfers above are limited to Anthropic (United States) for AI features, and Resend (United States) for transactional email. All other sub-processors process Arvoe customer data within Australia.

Notification of changes

Arvoe will provide existing customers with at least 30 days' notice where reasonably practicable, and in any event before processing begins, before engaging a new sub-processor that will process customer data, or before relocating the country of processing for an existing sub-processor.

Notification will be sent by email to each customer's nominated administrator contact. Customers have the right to object to the engagement of a new sub-processor in accordance with their Data Processing Agreement with Arvoe. If an objection cannot be reasonably resolved, customers have the right to terminate their subscription.

This page will be updated to reflect any change at the time the change takes effect.

Questions

If you have a question about Arvoe's sub-processors, our Data Processing Agreement, or our broader privacy and security posture, please contact us:

Arvoe Pty Ltd

Email: privacy@arvoe.ai
Gold Coast, Queensland, Australia