Sub-processors.
Last updated: 1 June 2026
PitlaneHQ engages the third-party service providers ("sub-processors") listed below to deliver the Service. This page is the canonical, authoritative list referenced by our Privacy Policy and the Customer Data Processing Addendum.
Sub-processors are categorised by the function they perform. Some are engaged for every workshop (infrastructure, payments, communications, observability); others are opt-in and are only engaged when a workshop activates the corresponding integration.
Infrastructure and storage
Engaged for every workshop. These providers host or back up the Service.
| Sub-processor | Purpose | Location | Data processed |
|---|---|---|---|
| Microsoft Azure | Application hosting, primary database, secrets management | Australia (East — Sydney) | All workshop and customer data |
| Cloudflare Inc. | CDN, DDoS protection, Web Application Firewall | Global edge network | Request metadata, IP addresses |
| Amazon Web Services | Encrypted backup storage (S3) | Australia (ap-southeast-2 — Sydney) | Encrypted backup bundles |
| Backblaze Inc. | Secondary encrypted backup storage (B2) | United States | Encrypted backup bundles |
Payments and communications
Engaged for every workshop. Note that Stripe processes PitlaneHQ's subscription billing — it is not the payment processor your workshop uses to collect payments from your own customers. That is PitlanePay (eWAY), listed under Opt-in integrations below.
| Sub-processor | Purpose | Location | Data processed |
|---|---|---|---|
| Stripe Payments Australia Pty Ltd | Subscription billing for the PitlaneHQ platform itself | Australia + United States | Workshop billing contact, payment method, transaction history |
| Twilio Inc. | SMS delivery (booking reminders, quote approvals, customer communications) | United States | Phone numbers, message content |
| Resend (Anti-Spam Inc.) | Transactional email delivery | United States | Email addresses, message content |
Observability and developer tooling
Engaged for every workshop. Used to detect and resolve service issues.
| Sub-processor | Purpose | Location | Data processed |
|---|---|---|---|
| Functional Software, Inc. (Sentry) | Application error tracking and performance monitoring | Germany (EU region) | Stack traces, request identifiers, user identifiers, browser metadata |
AI processing
Engaged only when a workshop activates Workshop Brain or an AI assistance feature. Data submitted for AI processing is scoped to the requesting workshop and is not pooled across workshops or used to train models served to others. Licensed third-party technical data is excluded from any model training.
| Sub-processor | Purpose | Location | Data processed |
|---|---|---|---|
| Amazon Web Services (Bedrock) | AI inference for Workshop Brain and AI assistance features (draft SMS replies, quote/invoice wording, technician-note cleanup, job estimation, vehicle image analysis). Outputs are drafts for human review; no solely-automated decisions with legal effect. | Australia and the wider Asia-Pacific region (varies by feature — see cross-border note) | Workshop-scoped job, quote, and message text submitted for the requested AI feature |
Opt-in integrations
Engaged only when a workshop explicitly activates the corresponding integration in Settings. Data flows to these providers stop when the workshop disconnects the integration.
| Sub-processor | Purpose | Location | Data processed |
|---|---|---|---|
| eWAY (PitlanePay) | Card payment processing for PitlanePay — collects card payments from your own customers (invoice payment links, POS, booking deposits) | Australia | Customer cardholder data (tokenised), payment amounts, transaction records |
| Xero Limited | Accounting integration — synchronises invoices and contacts | Australia / New Zealand | Customer contact details, invoice line items, payment records |
| Intuit Inc. (QuickBooks Online) | Accounting integration — synchronises invoices and contacts | United States | Customer contact details, invoice line items, payment records |
| Vehicle Visuals | Vehicle illustration / animation lookup for customer-facing quotes and inspections | United States | Vehicle make, model, and year (no personal identifiers) |
Cross-border disclosure (APP 8)
Primary hosting, the production database, and encrypted backups (Microsoft Azure and Amazon Web Services — S3) are located in Australia (Sydney). The following sub-processors process some or all data outside Australia under contractual safeguards equivalent to Australian Privacy Principle 8. Specifically:
- AWS Bedrock (Asia-Pacific region) — AI features use one of two AWS Bedrock inference profiles depending on the underlying model. Some features (such as classification, translation detection, and technician-note cleanup) run on an Australia-only profile, under which data stays in Australia. Others — including SMS draft generation, quote/invoice wording, job estimation, and vehicle image analysis — run on an Asia-Pacific cross-region profile, under which an individual request may be processed in another Asia-Pacific region (for example Singapore, Tokyo, or Seoul) but not outside the Asia-Pacific geography. Covered by the AWS Data Processing Addendum; reliance on APP 8.2(b).
- Sentry (Germany) — GDPR-equivalent jurisdiction, Standard Contractual Clauses in place.
- Stripe, Twilio, Resend, Backblaze, Cloudflare, Intuit, Vehicle Visuals (United States) — contractual safeguards under the relevant Data Processing Addendums; reliance on APP 8.2(b) (recipient bound by substantially similar law) and APP 8.2(c) (your consent, where applicable).
Notification of changes
We will provide workshops with at least 30 days' notice before engaging a new sub-processor that will process workshop or customer personal information. Notice will be provided by:
- An in-product banner visible to workshop administrators
- An update to this page (this date in "Last updated" will change)
- For material changes, an email to the workshop's registered billing contact
If your workshop objects to a new sub-processor for a good-faith reason, contact us at privacy@pitlanehq.com.au within the 30-day notice window and we will work in good faith to either resolve the concern or, if unable to do so, permit you to terminate the affected Service component.
Contact
Questions about sub-processors or our supply chain:
- Email: privacy@pitlanehq.com.au
- General enquiries: hello@pitlanehq.com.au