Legal
Last updated: 30 September 2026
Ensurva uses a small number of trusted service providers to run our platform and website. This page lists who they are, what they do for us, what information they handle, where that information is stored, and how long they keep it. Read it together with our Privacy Policy.
We update this page when our providers change. If a change affects how we handle personal information in a meaningful way, we will also update our Privacy Policy and let customers know.
Ensurva's own platform is hosted by Amazon Web Services in Sydney, Australia, including our database and document storage. Some of our providers store or process information in the United States or other countries, as shown below.
When we disclose personal information to a provider outside Australia, we take reasonable steps to ensure it is handled in line with the Australian Privacy Principles. This includes data processing terms with providers that handle personal information.
Our providers may use your information only to provide their services to us. We do not sell your information. Our AI provider, OpenAI, does not use data submitted through its API to train its models.
| Provider | What they do for us | Information they handle | Where it is stored | How long it is kept | Security certifications |
|---|---|---|---|---|---|
| Amazon Web Services | Hosts the Ensurva platform, database and document storage | All customer data held in Ensurva, including supplier records and documents | Sydney, Australia | Deleted in line with our Privacy Policy. Database backups are overwritten within 35 days. | SOC 2, ISO 27001 |
| Auth0 (Okta) | Sign-in and account security | Name, email address, organisation membership | Australia. Auth0 and Okta may access it from other countries, including the United States, to provide support and security. | Inaccessible immediately when deleted. Copies may remain in Auth0's encrypted offline backups for up to 14 months before being overwritten. | SOC 2, ISO 27001 |
| Stripe | Subscription billing and payments | Billing contact details, payment details, subscription and invoice records | United States and other countries | Deleted or returned when our relationship ends, except where Stripe must keep records by law, such as financial records | SOC 2, PCI DSS Level 1 |
| Provider | What they do for us | Information they handle | Where it is stored | How long it is kept | Security certifications |
|---|---|---|---|---|---|
| Sentry | Records errors so we can find and fix faults | Technical error details, which may include a user ID, email address and IP address | United States | Kept for Sentry's standard retention period, then deleted | SOC 2 |
| PostHog | Shows us how the platform is used so we can improve it | Usage events and session recordings, user ID and email address | United States | Kept for PostHog's standard retention period, then deleted | SOC 2 |
| Google Analytics | Measures visits to our website and platform | Pages visited, device and browser details, approximate location | United States | Kept for Google's standard retention period, then deleted | SOC 2, ISO 27001 |
These are services you already use and choose to connect to Ensurva. The information in them stays with that provider under your own agreement with them. Ensurva's copy is handled under our Privacy Policy.
| Provider | What they do for us | Information they handle | Where it is stored | How long it is kept | Security certifications |
|---|---|---|---|---|---|
| Xero | Source of your accounting data, connected read-only by a Xero administrator | Supplier bills and supplier contact details | United States | Held in your Xero organisation under your agreement with Xero | SOC 2, ISO 27001 |
| Source of documents in a folder you choose to share with Ensurva | Contracts, invoices and receipts in the shared folder | Held in your Google account | Held in your Google account under your agreement with Google | SOC 2, ISO 27001 | |
| Composio | Connects a mailbox, only if you choose to connect one, so Ensurva can retrieve vendor documents | Email attachments from vendors you have identified | United States | Deleted when you disconnect the mailbox or your account is deleted | SOC 2, ISO 27001 |
| Provider | What they do for us | Information they handle | Where it is stored | How long it is kept | Security certifications |
|---|---|---|---|---|---|
| OpenAI | Classifies suppliers and extracts details from documents | Supplier records and the content of documents submitted for extraction | United States | Up to 30 days for abuse monitoring, then deleted | SOC 2, ISO 27001 |
| Firecrawl | Builds supplier profiles from public websites | Supplier names and website domains only | United States | May log requests and cache public web pages. Kept until we ask for them to be deleted. | SOC 2 |
| Provider | What they do for us | Information they handle | Where it is stored | How long it is kept | Security certifications |
|---|---|---|---|---|---|
| SendGrid (Twilio) | Sends account, billing and service emails | Email addresses and email content | United States | Message content held only until sent. Recipient data up to 37 days. Delivery records, without message content, up to 1 year for security. | SOC 2, ISO 27001 |
| Vercel | Hosts our website and processes website form submissions | Details entered in website forms, such as name, email address and message | United States | Held only while the form is processed, apart from standard security logs | SOC 2, ISO 27001 |
| Zapier | Passes website enquiries and newsletter sign-ups to our customer records | Name, email address and enquiry details | United States | Kept in Zapier's task history for its standard retention period, then deleted | SOC 2 |
| Attio | Keeps our customer and enquiry records | Business contact details of customer staff and people who contact us or sign up for updates | Outside Australia | Kept while we have a relationship with you, and deleted on request | SOC 2 |
Ensurva's team is based in Australia. One of our development contractors is based overseas and works on our code and test environments. They do not have access to customer data in our live platform.
If you have questions about our service providers or how we handle your information, contact us at privacy@ensurva.com.