SecureRoster is operated by VQS Capital Pty Ltd (ABN 69 682 623 990). We use the following third-party services ("subprocessors") to deliver the Service. This list satisfies our obligations under APP 1.4 (open and transparent management of personal information) and gives our customers what they need for their own data-processing disclosures.
We notify customer admins by email at least 14 days before adding or replacing a subprocessor.
Used for every customer.
| Service | Purpose | Data accessed | Region |
|---|---|---|---|
| Supabase (Supabase Inc.) | Primary database, authentication, file storage, edge functions, realtime. | All app data (encrypted at rest). | Sydney (ap-southeast-2) |
| Expo (Exponent Inc.) | Push notification delivery to iOS and Android devices. | Push token + notification payload (no incident bodies, no banking details). | United States |
| Apple Push Notification Service | Final delivery of iOS push notifications. | Push token + notification payload. | Global (Apple infrastructure) |
| Firebase Cloud Messaging (Google LLC) | Final delivery of Android push notifications. | Push token + notification payload. | Global (Google infrastructure) |
| Google Maps Platform (Google LLC) | Address autocomplete for adding venues; venue geocoding for the sign-on geo-fence check. | Site name and address strings only. | Global (Google infrastructure) |
| Google Gemini API (Google LLC) | Powers the in-app AI help assistant. | Text of help-chat questions you type + your current page path. No personal records, no banking, no incident data. On the free tier, Google may use prompts to improve its models. | Global (Google infrastructure) |
| Vercel Inc. | Hosting and CDN for the admin web app. | Server access logs (IP, user-agent, path). No personal records. | Sydney (syd1) preferred |
| GitHub (GitHub Inc.) | Source code hosting + CI. | No customer data — code only. | United States |
Used only when the customer chooses to enable the corresponding integration.
| Service | Purpose | Data accessed | Region |
|---|---|---|---|
| Xero (Xero Australia Pty Ltd) | Optional accounting integration: push timesheets and invoices to your Xero account. | Venue contact names + emails, timesheet hours and rates, invoice line items. Banking / TFN never transmitted. | Australia (Xero AU tenant) |
| MYOB (MYOB Australia Pty Ltd) — coming soon | Optional accounting integration as an alternative to Xero. | Same scope as the Xero integration. | Australia (MYOB AU tenant) |
Questions about this list, or to request a Data Processing Agreement: privacy@secureroster.com.au
Material additions to the subprocessor list will be notified to customer admins by email at least 14 days before they take effect.