1. OVERVIEW

To deliver Foresight, our crisis simulation platform, we engage a small number of third-party service providers (“sub-processors”) that may process personal data on our behalf. This page lists each of them, what they do, what data they handle and where they are located.

Every sub-processor is engaged under a written agreement that requires it to process data only on our instructions, keep it confidential, protect it with appropriate security measures and delete or return it when the engagement ends. Where data is transferred outside Australia or the European Economic Area, the transfer is covered by an appropriate safeguard such as the EU Standard Contractual Clauses or the EU-US Data Privacy Framework.

This page should be read alongside our Privacy Policy.

2. WHERE YOUR DATA IS HOSTED

Foresight runs as two separate deployments from the same codebase. Each keeps its own data, and a customer is served from one or the other.

Deployment	Application hosting	Database	File storage
Australia	Fly.io, Sydney	Supabase, Sydney	Supabase, Sydney
European Union	Fly.io, Frankfurt	Fly.io, Frankfurt	Tigris, EU

Data at rest for Australian customers is stored in Australia, and for European customers in the EU. The sub-processors below describe the cases in which data is processed elsewhere.

3. SUB-PROCESSORS

Sub-processor	Purpose	Data processed	Location	Deployment
Fly.io	Application hosting; database hosting (EU)	All platform data during processing; platform logs and metrics	Australia or EU; control plane in the United States	Both
Supabase	Database and file storage	All platform data at rest	Australia	Australia
Tigris	File storage	Uploaded files and media	EU	EU
Anthropic	AI models powering simulated characters, scenario authoring and assessment	Scenario content and participant contributions, including messages and call transcripts	United States	Both
Vercel	Routing of requests to Anthropic (AI Gateway)	As for Anthropic, passed through in transit	United States	Both
OpenAI	Text embeddings and image generation	Scenario content; image generation prompts	United States	Both
ElevenLabs	Voice conversations with simulated characters	Participant voice audio during calls; call transcripts; character instructions	United States	Both
Resend	Email delivery	Recipient email addresses; email content	United States	Australia
Plunk	Email delivery	Recipient email addresses; email content	EU (Germany)	EU
Sentry	Error monitoring and diagnostics	Pseudonymous user identifier; error details; performance traces; session recordings with inputs masked	EU	Both
MapTiler	Map styles and map tiles	Participant IP address and the map area being viewed	EU	Both
Esri	Satellite imagery for the satellite map view	Participant IP address and the map area being viewed	United States	Both
Pexels	Stock image search while authoring scenarios	Search terms only	United States	Both

Notes

Maps. Map tiles and satellite imagery are requested directly by the participant’s browser, so MapTiler and Esri receive the participant’s IP address and the area of the map on screen. No scenario or participant content is sent to either.
Error monitoring. Sentry records a sample of sessions to help us diagnose faults. Form inputs are masked, media is blocked, and every area of the platform carrying participant-written content — messages, chat, shared documents and call transcripts — is masked. Other page text is recorded. Recordings are held in Sentry’s EU data region for 90 days.
Email delivery. Resend and Plunk each hand outgoing messages to Amazon Web Services (Amazon SES) for final delivery. Amazon SES is their sub-processor rather than ours. For the EU deployment, Plunk stores email in Germany and messages pass through the United States in transit only.

4. AI PROVIDERS

Foresight uses AI models to bring simulated characters to life, to help author scenarios and to assess exercises. Content from a simulation, including what participants write and say during it, is sent to these providers to generate responses.

Provider	Used to train models	Retention by the provider
Anthropic	No	Up to 30 days
OpenAI	No	Up to 30 days
ElevenLabs	No	Call audio and transcripts are retained under the provider’s data retention policy

None of these providers uses our customers’ data to train its models. Each retains inputs for the period shown above.

5. CHANGES TO THIS LIST

We will notify customers at least 30 days before engaging a new sub-processor or materially changing how an existing one is used. Customers may object to a change in accordance with the terms of their data processing agreement.

6. CONTACT

For questions about our sub-processors, to request a copy of our data processing agreement or to be notified of changes to this list, please contact our Data Protection Officer:

Email: privacy@capitalshield.com.au