Sub-processors
The list of third parties that process any part of customer data, what each one sees and where they're hosted.
Aicura uses a small set of sub-processors to deliver the service. Every sub-processor is listed here with what they see and where they're hosted. Any changes will be reflected on this page and communicated in advance to affected customers.
Current sub-processors
Amazon Web Services
Role: Infrastructure hosting (compute, database, object storage, secrets, logging, LLM inference via Bedrock).
Data: All customer data, meaning documents, database records, generated outputs and AI inference inputs and outputs.
Location: Primary in ap-southeast-2 (Sydney). Backups in ap-southeast-4 (Melbourne). Both regions are inside Australia. Bedrock inference runs in Australia under enterprise terms that exclude your inputs and outputs from model training, and model providers cannot access prompts or completions.
Auth0 (Okta)
Role: Authentication and identity management.
Data: User email addresses, names and authentication credentials. Passwords are set and stored by Auth0 directly and never touch Aicura's servers. Auth0 does not see document content or register data.
Location: Australian tenant.
Stripe
Role: Subscription billing and payment processing.
Data: Billing information, payment method details, subscription status. Stripe does not see document content or register data.
Location: United States.
Resend
Role: Transactional email delivery, covering welcome emails after signup, weekly briefings to public email subscribers, identity-provider emails forwarded from Auth0 (password set, password reset, verification) and billing emails forwarded from Stripe (receipts, invoices, payment notifications). All outbound email from Aicura's domain goes through Resend.
Data: Recipient email addresses and the content of those emails.
Location: AWS Tokyo (ap-northeast-1), Japan. Resend's closest region to Australia.
Cloudflare
Role: DNS, content delivery, web application firewall, bot mitigation and the proxy that sits in front of the platform and the marketing website.
Data: Inbound HTTP requests pass through Cloudflare's edge. Headers, request metadata and TLS-terminated traffic are visible to Cloudflare during processing. Cloudflare does not retain customer document content.
Location: Global edge network.
Cloudflare D1
Role: Storage for submissions to the website's contact form and briefings subscription form.
Data: The fields submitted on aicura.com.au, meaning name, email, organisation, enquiry type and message. Briefings subscribers' email addresses and subscription state.
Location: Cloudflare global edge.
Grafana Cloud
Role: Application logging, metrics and observability.
Data: Application logs and operational metrics. Logs include user identifiers, tenant identifiers and request metadata, and do not include uploaded document content.
Location: Australia.
What's not on this list
No advertising platforms. No analytics platforms. No data enrichment services. No font or asset CDNs, because fonts and static assets are served from Aicura's own domain, so page loads make no third-party requests. No third parties that receive customer document content beyond what's needed to deliver the service. No LLM providers outside of AWS Bedrock, which runs in Sydney under AWS's enterprise terms (your inputs and outputs are not used to train any model). GitHub Actions builds Aicura's software but processes code only, so no customer data flows there.
Changes to this list
If we add a new sub-processor, we'll update this page and notify customers at least 30 days before the change takes effect. Customers who object to a new sub-processor may terminate their subscription and receive a pro-rated refund for the unused portion of the current term.
Get started with Aicura.
Sign up and start the work. From your first session, you can catalogue your AI systems, run your privacy policy through Aicura's guidance and put your first risk assessments in place.