Sub-processors
Last updated: 9 June 2026
Rostery is a product of Notion Tech Pty Ltd (ACN 698 318 124). This page lists every third party we engage to help deliver the service, and forms part of our Data Processing Agreement. Australian Privacy Principle 8 requires us to tell you where your data goes; naming the recipients is the only honest way to do that.
Core sub-processors
These are engaged for every customer. The service cannot operate without them.
| Sub-processor | What it does | Data it can see | Location | Engaged |
|---|---|---|---|---|
| Vultr Holdings | Cloud hosting for the application and database | All customer data at rest | Sydney, Australia | Always |
| Resend | Transactional email — invites, password resets, notifications, statements | Name, email address, message content | United States | Always |
Optional sub-processors
These are engaged only when a customer turns on the relevant feature or connects the relevant account. If you never enable AI features, no data reaches an AI provider. If you never connect a mailbox, we never read one.
| Sub-processor | What it does | Data it can see | Location | Engaged |
|---|---|---|---|---|
| Anthropic | AI features — note drafting, risk signals, incident classification, document reading | The text or document submitted to the feature | United States | AI features enabled |
| Groq | Fast AI inference for interactive features | The text submitted to the feature | United States | AI features enabled |
| Deepgram | Speech to text for voice notes and the AI receptionist | Audio submitted for transcription | United States | Voice features enabled |
| Twilio | SMS and voice — shift alerts, approval requests, the AI receptionist | Phone number, message content | United States | SMS or voice enabled |
| Google (Maps Platform) | Geocoding, route distance and map display for EVV and travel | Addresses and location coordinates | United States | Maps or travel features enabled |
| OpenStreetMap Foundation (Nominatim) | Address lookup and autocomplete | Partial address text entered by the user | United Kingdom / EU | Address autocomplete used |
| Google (Gmail API) | Reading a connected mailbox for provider invoice ingestion | Messages in the mailbox the customer connects | United States | Gmail mailbox connected |
| Microsoft (Graph API) | Reading a connected Microsoft 365 mailbox for invoice ingestion | Messages in the mailbox the customer connects | United States / Australia | Microsoft 365 mailbox connected |
| Xero | Accounting export of invoices and bills | Invoice, contact and financial records | Australia / New Zealand | Xero connected |
| Intuit (QuickBooks) | Accounting export of invoices and bills | Invoice, contact and financial records | United States | QuickBooks connected |
Government systems
Claims and payment files are lodged with the National Disability Insurance Agency and, for aged care, with Services Australia. These are not sub-processors — they are the funding bodies your organisation already reports to, and disclosure to them is the purpose for which the data was collected.
Cross-border disclosure
Customer data is hosted in Australia. Where an optional sub-processor above is located overseas, enabling that feature means the specific data described in the table may be processed in that country. Under Australian Privacy Principle 8 we remain accountable for how those recipients handle it, and each is engaged under terms requiring protections substantially similar to the Australian Privacy Principles.
Notice of changes
We will update this page before engaging a new sub-processor that handles personal information. Customers with a signed DPA can ask to be notified of changes in writing, and may object to a new sub-processor on reasonable data-protection grounds.
Questions
Email [email protected] or call +61 468 447 062 if you need this list in another format, or a security or privacy assessment of any listed provider for your own due diligence.