GOLDNTHREAD SUB PROCESSORS
This is the current list of sub processors that handle customer data, maintained here because clause 6.4 of the SaaS Agreement says it will be. We give at least 30 days notice before adding a new one that processes Customer Data. If you reasonably object on genuine data protection grounds within that period, and we cannot resolve it between us, you may terminate the affected subscription without penalty and take a pro rata refund of prepaid fees.
Current sub processors
| Sub processor | Purpose | Location of processing |
|---|---|---|
| Fly.io | Application and database hosting | Sydney, Australia |
| Amazon Web Services | Backup storage, and photographs and scans uploaded from the field (S3, ap-southeast-2) | Sydney, Australia |
| Resend | Transactional email: invitations, password resets and notifications. Names and email addresses only | United States |
| Google Workspace | Business email and document storage | United States and other Google regions |
What this list does not include
No payment processor. GoldnThread does not yet take payment through the platform. One will be added here, with the notice period above, before any card is charged.
No analytics, advertising, session recording or error tracking service. The marketing site and the application load no third party scripts at all, and fonts are served from our own origin rather than from Google Fonts. There is nothing watching you use this site.
No artificial intelligence or machine learning provider. No customer data is sent to any model provider.
Where your data actually sits
Your building record, its documents, photographs and scans stay in Sydney. The only personal information that leaves Australia is a name and an email address, and only so that we can send you an email.
Two things worth saying plainly
Fly.io and Amazon Web Services are United States headquartered. Your data is stored in Australia, but their corporate parents are subject to United States law, including the CLOUD Act. If we receive a binding order to disclose customer data we will, unless legally prohibited, tell the affected customer before disclosing, disclose only the minimum required, and challenge requests that are overbroad or unlawful.
For New Zealand customers, storing information in Sydney means it leaves New Zealand, which engages information privacy principle 12 of the Privacy Act 2020. Australia is a prescribed comparable jurisdiction under the Act. The Privacy Policy sets out how that works in full rather than leaving you to find it.
Asking about this
Questions about sub processors, or an objection to one: privacy@goldnthread.com.