Back to Home
Service Providers
Last updated: 30 September 2026
How this register works
DraftFlow Software (ABN 60 693 461 610) uses the named providers below to operate DraftFlow. This register explains their function, the information involved, the normal processing location and the main safeguards that apply.
A provider's published certification or compliance report belongs to that provider. It does not mean DraftFlow itself is certified. Locations describe the normal service configuration; a provider may use support, security, resilience or corporate functions in other countries under its terms.
Current providers
| Provider | Function | Purpose and data | Location | Safeguards |
|---|---|---|---|---|
| Railway | Cloud application hosting, database and cache | Runs the DraftFlow API and managed production data services. Account, workspace, project, workflow, audit, session and email-queue data. | Singapore (primary production region) | Browser and public API traffic uses HTTPS. Railway states that its primary processing operations occur in the United States even where a selected workload region is elsewhere. |
| Amazon Web Services (AWS S3) | Object storage | Stores uploaded drawings, IFC models, certificates, dossiers, ITP evidence and uploaded signature scans. Uploaded files and retrieval metadata such as file name, content type, company and project. | Australia (Sydney region) | The storage service is configured to require an Australian AWS region, requests server-side encryption and uses short-lived links or authenticated tenant-scoped access. |
| Vercel | Frontend hosting and content delivery network (CDN) | Delivers the website and application frontend. Request metadata such as IP address, user agent, URL and operational logs; static site assets. | Global edge network, including the United States | Provider platform controls and transport encryption apply. Vercel identifies the United States as its primary processing location and may use subprocessors elsewhere. |
| Sentry | Application error monitoring | Captures diagnostic events for reliability and support. Error details, URL or route, browser and device context, user identifier and optional email. | European Union (Germany) | Known password, token and payment fields are filtered before transmission where configured. The organisation is configured for EU data storage in Germany; Sentry's terms permit other processing where Sentry or its subprocessors operate. |
| Resend | Transactional email delivery | Sends account, workflow, security, billing and support email. Email address, sender, subject, message content, delivery and suppression events. | United States | Transport encryption applies. |
| Stripe | Payment processing and subscription billing | Processes subscription payments and billing records. Billing contact, address, tokenised payment details, subscription, invoice and transaction data. | Global processing network, including Australia and the United States | Stripe processes full card details; DraftFlow receives tokenised payment and subscription information. |
| Google Play | In-app subscription billing for the Android app | Processes subscriptions bought in the DraftFlow Android app and reports their status. Purchase token, product, order identifier, subscription state and expiry, the purchasing user, and a one-way identifier derived from the company account. | Global Google infrastructure, including the United States | Google processes the payment and payment details; DraftFlow does not receive card numbers. DraftFlow stores a one-way hash of the purchase token together with the order identifier, product, subscription state, expiry and purchasing user, and checks status directly with Google. Status updates are delivered through Google Cloud Pub/Sub. |
| Google Analytics | Optional website analytics | Measures consented page use and interactions. Page, device, approximate location, referral and interaction data. | Global Google infrastructure; regional collection does not establish an exclusive storage or processing country | Google Analytics loads only on the website and only after analytics consent. It does not run in the DraftFlow Android or iOS apps. |
| Anthropic (Claude), directly or through AWS Bedrock | AI model processing for optional AI features | Processes requests from DraftFlow's optional AI features, only when DraftFlow has switched those features on and a user in a company with AI credits runs one. The files and text the user sends to that feature, such as drawings, QA evidence and request notes, and the model's response. | AI features are switched off, so no requests are sent. When switched on, requests go either to Anthropic's API, which processes them outside Australia, including in the United States, or to AWS Bedrock in the configured region | AI features stay unavailable until a provider is configured. DraftFlow's Australian AI setting refuses to start them unless requests go to AWS Bedrock in Sydney or Melbourne through an Australia-only inference profile. That setting covers the model request only: the application in Singapore reads the file before sending it. |
Railway
Cloud application hosting, database and cache
- Purpose and data
- Runs the DraftFlow API and managed production data services. Account, workspace, project, workflow, audit, session and email-queue data.
- Location
- Singapore (primary production region)
- Safeguards
- Browser and public API traffic uses HTTPS. Railway states that its primary processing operations occur in the United States even where a selected workload region is elsewhere.
Amazon Web Services (AWS S3)
Object storage
- Purpose and data
- Stores uploaded drawings, IFC models, certificates, dossiers, ITP evidence and uploaded signature scans. Uploaded files and retrieval metadata such as file name, content type, company and project.
- Location
- Australia (Sydney region)
- Safeguards
- The storage service is configured to require an Australian AWS region, requests server-side encryption and uses short-lived links or authenticated tenant-scoped access.
Vercel
Frontend hosting and content delivery network (CDN)
- Purpose and data
- Delivers the website and application frontend. Request metadata such as IP address, user agent, URL and operational logs; static site assets.
- Location
- Global edge network, including the United States
- Safeguards
- Provider platform controls and transport encryption apply. Vercel identifies the United States as its primary processing location and may use subprocessors elsewhere.
Sentry
Application error monitoring
- Purpose and data
- Captures diagnostic events for reliability and support. Error details, URL or route, browser and device context, user identifier and optional email.
- Location
- European Union (Germany)
- Safeguards
- Known password, token and payment fields are filtered before transmission where configured. The organisation is configured for EU data storage in Germany; Sentry's terms permit other processing where Sentry or its subprocessors operate.
Resend
Transactional email delivery
- Purpose and data
- Sends account, workflow, security, billing and support email. Email address, sender, subject, message content, delivery and suppression events.
- Location
- United States
- Safeguards
- Transport encryption applies.
Stripe
Payment processing and subscription billing
- Purpose and data
- Processes subscription payments and billing records. Billing contact, address, tokenised payment details, subscription, invoice and transaction data.
- Location
- Global processing network, including Australia and the United States
- Safeguards
- Stripe processes full card details; DraftFlow receives tokenised payment and subscription information.
Google Play
In-app subscription billing for the Android app
- Purpose and data
- Processes subscriptions bought in the DraftFlow Android app and reports their status. Purchase token, product, order identifier, subscription state and expiry, the purchasing user, and a one-way identifier derived from the company account.
- Location
- Global Google infrastructure, including the United States
- Safeguards
- Google processes the payment and payment details; DraftFlow does not receive card numbers. DraftFlow stores a one-way hash of the purchase token together with the order identifier, product, subscription state, expiry and purchasing user, and checks status directly with Google. Status updates are delivered through Google Cloud Pub/Sub.
Google Analytics
Optional website analytics
- Purpose and data
- Measures consented page use and interactions. Page, device, approximate location, referral and interaction data.
- Location
- Global Google infrastructure; regional collection does not establish an exclusive storage or processing country
- Safeguards
- Google Analytics loads only on the website and only after analytics consent. It does not run in the DraftFlow Android or iOS apps.
Anthropic (Claude), directly or through AWS Bedrock
AI model processing for optional AI features
- Purpose and data
- Processes requests from DraftFlow's optional AI features, only when DraftFlow has switched those features on and a user in a company with AI credits runs one. The files and text the user sends to that feature, such as drawings, QA evidence and request notes, and the model's response.
- Location
- AI features are switched off, so no requests are sent. When switched on, requests go either to Anthropic's API, which processes them outside Australia, including in the United States, or to AWS Bedrock in the configured region
- Safeguards
- AI features stay unavailable until a provider is configured. DraftFlow's Australian AI setting refuses to start them unless requests go to AWS Bedrock in Sydney or Melbourne through an Australia-only inference profile. That setting covers the model request only: the application in Singapore reads the file before sending it.
Overseas disclosure
Some providers process personal information outside Australia, including in Singapore and the United States. Where APP 8 or another cross-border rule applies, DraftFlow takes reasonable steps appropriate to the disclosure. Depending on the provider, these may include reviewing provider terms and published assurance, limiting the information sent, controlling access and using encryption in transit.
Changes and questions
We may add, replace or remove providers as the service changes. We will update this page and give direct notice to active customers where a provider change materially changes how personal information is handled or notice is required by law. Questions or objections can be sent to admin@draftflow.org.