Sub-processors
This page lists the third parties that TrueAgent Pty Ltd (ABN 70 636 626 956) as trustee for The TrueAgent Unit Trust, trading as Snap Job Reports, engages to host, operate, monitor and support the Snap Job Reports Service (each, a Sub-processor). It is referenced by clause 14 of our Terms of Service and clause 5.1 of our Privacy Policy.
1How we engage Sub-processors
We engage Sub-processors only where they are necessary to deliver, secure or support the Service. Each Sub-processor is bound by written terms that require it to:
- process personal information only on our documented instructions and for the purpose for which we engaged it;
- implement appropriate technical and organisational security measures, having regard to the nature of the data;
- maintain confidentiality;
- comply with the Australian Privacy Principles or provide substantially equivalent protections;
- not use Customer Data (or any derivative identifiable to a customer or its Authorised Users) to train, fine-tune or evaluate any machine-learning or artificial-intelligence model; and
- cooperate with our security-incident, data-subject-rights and audit processes.
We remain accountable to our customers for the acts and omissions of our Sub-processors in respect of personal information they process on our behalf.
2Current Sub-processors
The following Sub-processors are engaged as at the “Last updated” date above. Connected Platforms (currently ServiceM8) are listed for transparency; the customer authorises and controls those integrations directly and the relevant platform’s own terms and privacy policy govern its handling of the customer’s data.
2.1 Infrastructure and hosting
Provide the underlying compute, database and storage on which the Service runs and on which Customer Data resides.
| Sub-processor | Purpose | Data categories | Processing region |
|---|---|---|---|
| Supabase supabase.com | Primary database (Postgres), authentication, file storage, realtime services and secret vault. | Account & identity data, Customer Data (photographs, schematics, signatures, field notes, generated PDFs), Connected Platform tokens (stored as vault secret IDs). | Sydney, Australia (ap-southeast-2). |
| Vercel vercel.com | Hosting for the marketing website, administrator portal and progressive web application; serverless compute for API route handlers, OAuth callbacks, beta-interest and support form handling, and the scheduled jobs that move photos and PDFs. Processes essentially all personal information in transit as the Service runs. | HTTP request and response data (including form submissions and login flows), authentication callbacks, photo and PDF payloads in transit, server logs. | Global edge network; primary serverless compute region is set in our hosting configuration and is presently outside Australia. We treat all Vercel processing as an overseas disclosure. |
| Railway railway.com | Long-running worker that renders PDF reports (Node.js with Puppeteer and Sharp). Fetches job photographs, schematics and report/job data (which can include client and site details and narrative) to render report PDFs, then writes them back to storage. | A meaningful slice of Customer Data transiently in memory during PDF render (photographs, schematics, site addresses, signatures, defect notes and report narrative); access tokens for Supabase storage; output PDFs written back to Supabase storage. | Singapore (Southeast Asia). |
2.2 Observability, analytics and security monitoring
Receive operational telemetry from the Service for the purposes of monitoring availability, diagnosing errors, understanding usage patterns and investigating incidents.
| Sub-processor | Purpose | Data categories | Processing region |
|---|---|---|---|
| PostHog posthog.com | Product analytics, error monitoring and session replay for both the administrator portal and the progressive web application. | Pseudonymous user identifiers, page views, in-app events, error stack traces, session-replay recordings (form inputs and sensitive fields are masked). | European Union (selected for data residency). |
| Grafana Cloud grafana.com/products/cloud | Aggregation of application logs (Loki) and metrics (Mimir) for operational monitoring, alerting and incident response. | Server logs (request IDs, tenant IDs, error messages), service-health metrics. Logs are scrubbed for personal information before transmission where reasonably practicable. | Australia (primary), with regional failover in the European Union. |
2.3 Communications
Used to deliver transactional and operational messages, and to support internal business operations.
| Sub-processor | Purpose | Data categories | Processing region |
|---|---|---|---|
| Resend resend.com | Transactional email delivery for field-technician sign-in codes, report-delivery emails carrying the report PDF itself, billing notifications and security alerts. | Recipient and sender email addresses, subject lines and bodies of transactional emails, and report PDF attachments — which may contain site photographs (potentially showing individuals), site addresses, signatures and defect notes — where the customer has elected email delivery. | United States (primary). Suppression lists and message logs are retained by Resend in accordance with its data-processing terms. |
| Google (Workspace and Chat webhooks) workspace.google.com | Internal business email and document collaboration; receipt of beta-interest and support-form submissions as Google Chat messages (our working record of those enquiries); and receipt of operational alert webhooks from monitoring (e.g. PDF render failures, queue-depth alerts). | Beta-interest and support-form submissions (name, work email, company, subject and free-text support messages); internal correspondence; operational alert payloads that can incidentally include a customer or site name from an error context. | United States and Australia. |
2.4 Connected Platforms (customer-authorised)
Third-party platforms that customers authorise the Service to connect to. We act as a recipient or sender of data on the customer's behalf; the platform is independently the customer's service provider.
| Sub-processor | Purpose | Data categories | Processing region |
|---|---|---|---|
| ServiceM8 www.servicem8.com | Primary integration platform. With the customer's authorisation, we read job, staff, checklist and photo data, and write generated PDF reports back to job attachments. | Jobs, staff identities, attachments, checklists, materials and similar operational data the customer has authorised us to access. | As determined by ServiceM8 (Australia / global). |
3Objecting to a new Sub-processor
Customers on a paid Plan may object to a proposed new Sub-processor within the 30-day notice period by emailing support@snapjobreports.com with the subject “Sub-processor objection” and a reasonable explanation of the objection. We will work with the customer in good faith to address the objection (for example, by proposing an alternative Sub-processor or workaround). If we cannot reasonably address it and we still proceed with the change, the affected customer may terminate the affected Plan by written notice and we will refund prepaid Fees for the unused portion of the term.
4Change log
Material changes to this page (new Sub-processors, removals, or changes in processing region) are recorded below.
| Date | Change |
|---|---|
| 25 June 2026 | Aligned processing regions and data categories with the revised Privacy Policy: Railway region corrected to Singapore; PostHog region corrected to the European Union; Resend purpose and data categories clarified to reflect report-PDF content; Google (Chat) entry updated to reflect that it receives beta-interest and support-form submissions (enquiry/contact and support free-text); Vercel processing described as an overseas disclosure. |
| 20 May 2026 | Initial publication of the Sub-processor list. |
5Contact
Questions about this list, or to subscribe to change notices, email support@snapjobreports.com.