Sub-processor register
Everyone with access to your data.
Named, with what they do for us, and where they do it from. If this register changes, we post the change here before it takes effect and email affected customers.
Current register
| Vendor | Purpose | Region | Since |
|---|---|---|---|
Google Cloud Platform Google Cloud Australia Pty Ltd | Application hosting, database, file storage, and backups. All customer data stays within Google’s Sydney region. | au-southeast1 · Sydney | 24 Apr 2026 |
Why this register matters
Under the Privacy Act, we’re accountable for what our vendors do with your information. Naming them publicly is the version of that accountability we think matters: you can see the chain from us to every party that could, in theory, see anything. Today that chain has exactly one link.
We don’t use analytics, ad-tech, session-replay, or any third-party script that touches customer data. If that changes, it appears here first.
How changes work
- Before a new sub-processor is engaged, we publish them here with a date at least 30 days in the future.
- Workspace admins get an email on the day we post, with the purpose and region and a link to this page.
- If a customer objects in good faith, we work with them to find an alternative or, failing that, let them exit without penalty and with full data export.
- When a sub-processor is removed,the row stays in a “previous” section with the end date, so the history stays auditable.
Questions about who touches your data? security@thimblecare.com.