Legal document
Sub-processor Register
- Version
- v1.0.0
- Effective
Flusso R&D Tax Platform: Sub-processors
This page lists the third-party service providers ("sub-processors") that may process personal information on our behalf to run Flusso R&D Tax Platform. It is referenced from our Privacy Policy (section 6, section 7).
Last updated: 9 November 2026
Flusso Pty Ltd (ABN 86 651 038 078, ACN 651 038 078) uses the sub-processors below. Each is engaged under a written agreement requiring confidentiality and protections consistent with our Privacy Policy and the Australian Privacy Principles. Your primary database records are held in Australia (Sydney); other providers, listed below, may process information overseas.
Sub-processor register
Each row names the provider, its function, the data it processes, its processing location, and the in-repo evidence (a worker binding or a package dependency) that shows it is actually wired. A machine-readable version of this list is docs/legal/rdtp-data-map.json, and scripts/check-data-map.ts fails CI if a provider or binding in the code is missing here.
| Provider | Function | Data processed | Processing location | Evidence |
|---|---|---|---|---|
| AWS RDS (Sydney) | Primary application database (account and claim records) | Account, organisation and RDTI claim records | Australia (Sydney, ap-southeast-2) | infrastructure/src/aws/rds.ts; reached via the HYPERDRIVE binding |
| Cloudflare R2 | File object storage (source library, audit exports, RFI correspondence, firm assets), being migrated to AWS S3 Sydney under Story 338-14 | Documents and files you or your advisor upload or generate | Oceania location hint (best effort), migrating to Australia (Sydney) | apps/api-rdti/wrangler.toml R2 bindings R2_SOURCE_LIBRARY, RDTI_AUDIT_EXPORT_BUCKET, RDTI_RFI_CORRESPONDENCE_BUCKET, FIRM_ASSETS_BUCKET |
| Cloudflare Workers | Application compute, key-value cache, queues and internal service bindings | Request data in transit during processing | United States / global edge | apps/api-rdti/wrangler.toml service, KV and queue bindings |
| Clerk | Authentication and identity management | Name, email, role | United States | @clerk/nextjs dependency in apps/rdti/web/package.json |
| Resend | Transactional and service email | Email address, message content | United States | @flusso/email dependency (reaches api.resend.com over HTTPS) in apps/api-rdti and apps/rdti/web |
| Stripe | Billing and payments | Billing and account details | United States / global | stripe dependency in apps/api-rdti/package.json |
| Anthropic | AI features (large language model), drafting and analysis of R&D claim content | The content you submit to AI features | United States | @anthropic-ai/sdk dependency in apps/api-rdti/package.json |
| Upstash | Caching and rate limiting | Transient operational data | United States | @upstash/redis dependency in apps/api-rdti, apps/api-connect and apps/rdti/web |
| Vercel | Web application hosting | Request data in transit for the web app | United States | infrastructure/src/vercel/projects.ts (hosts apps/rdti/web) |
| HubSpot | Support-ticket sync | Support request content and contact details | United States | External (support requests sync server-side via the gateway; Stories 174-6 and 174-7) |
Note on Cloudflare R2 location. Cloudflare R2 has no Australian jurisdiction. The buckets above use the
OC(Oceania) location hint, which is a best-effort placement hint, not a jurisdictional guarantee. Story 338-14 moves these file objects to AWS S3 Sydney (ap-southeast-2): the staging environment completed the move on 5 November 2026 and production follows under the operator-supervised runbook. This register is updated to name AWS S3 Sydney as the file-object store when the production cut-over is verified.
Infrastructure and operational processing (non-record copies)
The providers below process requests in transit or hold operational data only. They do not hold a durable copy of your account or claim records. They are listed here, and in the data map with recordCopy: false, for completeness.
| Provider | Function | Data processed | Processing location | Evidence |
|---|---|---|---|---|
| Cloudflare Hyperdrive | Connection pooling and short-lived read caching (at most sixty seconds) in front of the AU database | Query results in transit | United States / global edge | apps/api-rdti/wrangler.toml HYPERDRIVE binding |
| AWS Logpush S3 sink | Externally provisioned AU log sink (operational logs, not Claimant Data) | Request and operational logs | Australia (Sydney, ap-southeast-2) | infrastructure/src/cloudflare/logpush.ts |
Artificial intelligence
The AI provider (Anthropic) is named in the register above and described in Privacy Policy section 5.
We do not currently use your content to train these providers' models or our own. The providers' retention of your inputs, and the commitment that they are not used to train their models, are subject to verification before this page is published. See Privacy Policy section 5.
Connectors (engaged only if you choose to link them)
These providers process your information only if you connect the corresponding integration to import data into Flusso R&D Tax Platform. If you do not link a connector, it processes nothing.
| Provider | Function | Data processed | Processing location |
|---|---|---|---|
| Xero | Import general-ledger / accounting data for R&D expense classification | Company financial data you authorise | Australia / New Zealand / global |
| Google (Drive) | Import R&D evidence documents from folders you nominate | Documents you authorise | United States / global |
| Microsoft (OneDrive) | Import R&D evidence from resources you nominate | Documents you authorise | United States / global |
| Atlassian (Confluence) | Import R&D evidence from spaces you nominate | Pages you authorise | United States / global |
| GitHub | Import development evidence from repositories you nominate | Repository evidence you authorise | United States |
Changes to this list
We may update this list as our services change. Where we add a sub-processor that materially affects how your personal information is handled, we will update this page and its "Last updated" date. To be notified of changes, contact privacy@flusso.ai.