Sub-processors
This page lists the third parties that TrueAgent Pty Ltd (ABN 70 636 626 956) as trustee for The TrueAgent Unit Trust, trading as Snap Job Reports, engages to host, operate, monitor and support the Snap Job Reports Service (each, a Sub-processor). It is referenced by clause 14 of our Terms of Service and clause 5.1 of our Privacy Policy.
1How we engage Sub-processors
We engage Sub-processors only where they are necessary to deliver, secure or support the Service. Each Sub-processor is bound by written terms that require it to:
- process personal information only on our documented instructions and for the purpose for which we engaged it;
- implement appropriate technical and organisational security measures, having regard to the nature of the data;
- maintain confidentiality;
- comply with the Australian Privacy Principles or provide substantially equivalent protections;
- not use Customer Data (or any derivative identifiable to a customer or its Authorised Users) to train, fine-tune or evaluate any machine-learning or artificial-intelligence model; and
- cooperate with our security-incident, data-subject-rights and audit processes.
We remain accountable to our customers for the acts and omissions of our Sub-processors in respect of personal information they process on our behalf.
2Current Sub-processors
The following Sub-processors are engaged as at the “Last updated” date above. Connected Platforms (currently ServiceM8) are listed for transparency; the customer authorises and controls those integrations directly and the relevant platform’s own terms and privacy policy govern its handling of the customer’s data.
2.1 Infrastructure and hosting
Provide the underlying compute, database and storage on which the Service runs and on which Customer Data resides.
| Sub-processor | Purpose | Data categories | Processing region |
|---|---|---|---|
| Supabase supabase.com | Primary database (Postgres), authentication, file storage, realtime services and secret vault. | Account & identity data, Customer Data (photographs, schematics, signatures, field notes, generated PDFs), Connected Platform tokens (stored as vault secret IDs). | Sydney, Australia (ap-southeast-2). |
| Vercel vercel.com | Hosting for the marketing website, administrator portal and progressive web application; serverless compute for API route handlers and OAuth callbacks. | HTTP request and response data, authentication callbacks, server logs. | Global edge network; primary serverless compute region: United States (with EU regional rollout planned). |
| Railway railway.com | Long-running worker that renders PDF reports (Node.js with Puppeteer and Sharp). | Customer Data transiently in memory during PDF render; access tokens for Supabase storage; output PDFs written back to Supabase storage. | Matched to the customer's primary data region. |
2.2 Observability, analytics and security monitoring
Receive operational telemetry from the Service for the purposes of monitoring availability, diagnosing errors, understanding usage patterns and investigating incidents.
| Sub-processor | Purpose | Data categories | Processing region |
|---|---|---|---|
| PostHog posthog.com | Product analytics, error monitoring and session replay for both the administrator portal and the progressive web application. | Pseudonymous user identifiers, page views, in-app events, error stack traces, session-replay recordings (form inputs and sensitive fields are masked). | United States (us.i.posthog.com). |
| Grafana Cloud grafana.com/products/cloud | Aggregation of application logs (Loki) and metrics (Mimir) for operational monitoring, alerting and incident response. | Server logs (request IDs, tenant IDs, error messages), service-health metrics. Logs are scrubbed for personal information before transmission where reasonably practicable. | Australia (primary), with regional failover in the European Union. |
2.3 Communications
Used to deliver transactional and operational messages, and to support internal business operations.
| Sub-processor | Purpose | Data categories | Processing region |
|---|---|---|---|
| Resend resend.com | Transactional email delivery for field-technician sign-in codes, report delivery to customer-designated recipients, billing notifications and security alerts. | Recipient and sender email addresses, subject lines and bodies of transactional emails (including generated PDF report attachments where the customer has elected email delivery). | United States (primary). Suppression lists and message logs are retained by Resend in accordance with its data-processing terms. |
| Google (Workspace and Chat webhooks) workspace.google.com | Internal business email and document collaboration; receipt of alert webhooks from operational monitoring (e.g. PDF render failures, queue-depth alerts). | Internal correspondence; operational alert payloads containing service identifiers (not Customer Data). | United States and Australia. |
2.4 Connected Platforms (customer-authorised)
Third-party platforms that customers authorise the Service to connect to. We act as a recipient or sender of data on the customer's behalf; the platform is independently the customer's service provider.
| Sub-processor | Purpose | Data categories | Processing region |
|---|---|---|---|
| ServiceM8 www.servicem8.com | Primary integration platform. With the customer's authorisation, we read job, staff, checklist and photo data, and write generated PDF reports back to job attachments. | Jobs, staff identities, attachments, checklists, materials and similar operational data the customer has authorised us to access. | As determined by ServiceM8 (Australia / global). |
3Objecting to a new Sub-processor
Customers on a paid Plan may object to a proposed new Sub-processor within the 30-day notice period by emailing support@snapjobreports.com with the subject “Sub-processor objection” and a reasonable explanation of the objection. We will work with the customer in good faith to address the objection (for example, by proposing an alternative Sub-processor or workaround). If we cannot reasonably address it and we still proceed with the change, the affected customer may terminate the affected Plan by written notice and we will refund prepaid Fees for the unused portion of the term.
4Change log
Material changes to this page (new Sub-processors, removals, or changes in processing region) are recorded below.
| Date | Change |
|---|---|
| 20 May 2026 | Initial publication of the Sub-processor list. |
5Contact
Questions about this list, or to subscribe to change notices, email support@snapjobreports.com.