Sub-processors — Grace
- Provider: Michael Egan (ABN 37 317 577 102), trading as Strategic Worlds
- Effective date: 6 October 2026
- Last updated: 6 October 2026
- Contact: contact@strategicworlds.com.au
To provide Grace we use a small number of trusted service providers ("sub-processors") that may process personal information contained in Customer Data on our behalf. We impose data-protection obligations on each of them consistent with our Data Processing Addendum.
| Sub-processor | Service provided | Data processed | Primary location |
|---|---|---|---|
| Clerk, Inc. | User authentication and identity management | Account identity, credentials, sign-in metadata | United States |
| Neon, Inc. | Application database (PostgreSQL) | All application data, including Customer Data | Australia — Sydney (ap-southeast-2) |
| Vercel Inc. | Application hosting, edge/serverless compute, and file storage (Blob) | Application traffic, logs, uploaded files/attachments | Australia — Sydney (syd1) for compute and for file storage (Blob). Confirmed in the Vercel console on 2026-09-04 and re-confirmed 2026-09-09; the Blob stores serving Production and Preview are separate stores and both are in syd1 |
| Resend, Inc. — transactional email | Optional — the weekly reminder digest, and read-and-understood reminders (each only when a workspace enables it) | Recipient name + email address, and the titles of the records they own or are expected to have read | A United States company, sending from its Japan — Tokyo (ap-northeast-1) region. This is the only email provider Grace uses. A workspace may require Australian processing, in which case no reminder is sent at all — see the note below. |
| Anthropic, PBC | Optional — the "Ask Grace" AI assistant (only when a workspace enables it) | Prompts + the records a user asks about (may contain personal information) | United States |
Notes:
- Data residency. The primary application database and file storage are hosted in Australia. Authentication (Clerk) is processed in the United States. When a workspace enables the optional AI assistant, the prompts and records it processes are sent to Anthropic in the United States — see the overseas-disclosure sections of the Privacy Policy and DPA.
- Email is cross-border at DELIVERY, whichever provider sends it. Choosing an Australian sending provider narrows the disclosure — Grace's own processor stops being overseas — but a message addressed to a mailbox hosted outside Australia (a Gmail account, or a Microsoft 365 tenancy in another region) reaches that country regardless of who put it on the wire. Grace neither knows nor controls where a recipient's mailbox is hosted. We state this rather than implying a guarantee we cannot make.
- Optional reminder emails. Grace sends two kinds, and both are off by default, each behind its own notice and its own consent: the weekly digest, which runs on a schedule and lists records the recipient owns, and read-and-understood reminders, which a person sends by pressing a button and which list records the recipient is expected to have read. Consent to one is not consent to the other. A workspace may additionally require Australian processing, in which case Grace sends nothing through a provider that processes overseas, rather than making a disclosure the workspace declined.
- Where Resend processes, and what we do not claim. The Resend account sends from its Tokyo region, and Resend, Inc. is an American company, so United States law reaches the company holding the account. Both facts are in the activation notices because they are different questions and a customer is entitled to either. What we do not state is where Resend keeps the recipient addresses and subject lines its own dashboard displays: Resend does not say, we have not been told, and an answer we assumed would be worse than the gap. Treat the disclosure as reaching both countries.
- A workspace's own mail server would remove the email sub-processor entirely — but is not available today. Grace can connect directly to a customer's own SMTP server (Workspace settings → Weekly reminders), in which case no transactional email provider processes that workspace's reminders at all. That option is currently switched off in this deployment: storing an SMTP password requires an encryption key, this deployment has none, and Grace will not store a password it cannot encrypt. The setting says so where it is offered. If it is enabled later, the password is stored encrypted (AES-256-GCM) and is never displayed back, logged, or included in a workspace export, and where those messages are then handled becomes the customer's own arrangement with whoever operates that server — Grace neither selects it nor can certify its location.
- Optional AI features (Anthropic). The AI assistant is off by default and is used only if a workspace enables it. When enabled, the prompts submitted to the assistant and the records it is asked about are processed by Anthropic under its Commercial Terms and Data Processing Addendum; Anthropic does not use the data to train its models and (under its API terms) deletes it within approximately 30 days.
- What the Australian-processing setting does today, which is less than its name suggests. Grace has no Australian email provider configured — Resend is the only email sub-processor, and it is not one. So requiring Australian processing does not reroute a message; it suppresses it. The workspace receives no reminder emails rather than a disclosure it declined, which is the safe direction and is what the setting is for, but it is a different thing from "your email is sent from Australia" and we will not let the name imply otherwise. If an Australian provider is ever configured, this note changes with it.
- We use no analytics, error-monitoring or payment provider. Grace runs no third-party analytics or session-recording of any kind. If a payment provider is added when charging begins, it will appear in the table above before it processes anything.
- Changes. We keep this list current. Material changes to sub-processors are notified as set out in the DPA. The live version will be published at grace.strategicworlds.com.au/sub-processors.