Subprocessors
Last updated: 25 June 2026
Draft for legal review. Items marked
[REVIEW: …] require sign-off from an Australian tech/privacy lawyer before being relied on commercially.Apex uses the following third parties to deliver the platform. Each is contractually obliged to handle personal information consistently with our Privacy Policy and the Australian Privacy Principles. We give 30 days' notice before adding a new subprocessor.
| Subprocessor | Purpose | Data | Location |
|---|---|---|---|
| Amazon Web Services (via Supabase / Lovable Cloud) | Primary application hosting, database, file storage, backups | All Customer Data | Australia (ap-southeast-2, Sydney) |
| Stripe Payments Australia Pty Ltd | Subscription billing, tax calculation, payment processing | Billing contact, card token, subscription metadata | Australia + United States |
| Mailgun (or equivalent transactional email provider) | Sending essential service emails (receipts, alerts, password resets) | Recipient email, message subject and body | United States / EU [REVIEW] |
| Cloudflare | CDN, DDoS protection, edge runtime for the web app | IP address, request metadata | Global edge |
| Plausible / PostHog (cookieless analytics) | Aggregate usage analytics — no third-party advertising | Anonymised page views, country-level IP | EU / United States [REVIEW] |
| Google reCAPTCHA Enterprise | Bot mitigation on signup and contact forms | IP address, browser fingerprint | United States |
RTO partners
When you submit a training enquiry, matched RTO partners receive the minimum data needed to quote. RTO partners act as independent controllers in respect of those leads under their own privacy policies — they are not subprocessors of Apex.
See also: Help · Status · Terms · Privacy · Acceptable Use · Cookies · DPA · Employee Privacy Notice · Refunds · Subprocessors · RTO Partner Agreement