Trust
Subprocessor List
The third parties (subprocessors) Orixian Solutions engages to deliver Stable Baseline: what each does, where it operates, and what data it touches.
- Last updated
- 15 October 2026
Published by Orixian Solutions Pty Ltd (ABN 40 627 250 186). All persistent customer content is stored in Australia (Sydney). A small number of providers outside Australia process limited data categories, described below.
Infrastructure & platform
| Subprocessor | Purpose | Customer data processed | Location | Attestations |
|---|---|---|---|---|
| Supabase, Inc. | Core platform: managed PostgreSQL database, authentication, file storage, serverless functions | Account data; all workspace content (documents, diagrams, boards, plans, uploads); audit logs | AWS Asia Pacific (Sydney), Australia | SOC 2 Type II |
| Amazon Web Services, Inc. | Cloud infrastructure underlying Supabase | Same categories, at the infrastructure layer | ap-southeast-2 (Sydney), Australia | ISO 27001, SOC 2 Type II |
| Microsoft Corporation (Azure) | Document/slide conversion, design and render workers, meeting transcription workers | Workspace content during processing only: transient state is purged on an hourly cycle | Azure Australian region | ISO 27001, SOC 2 Type II |
| Cloudflare, Inc. | Application and website hosting, CDN, WAF, DDoS protection, bot challenge; diagram rendering | Traffic and request metadata, and content passing through the edge network (not retained at rest); diagram source during rendering: rendered in memory, nothing stored, zero data retention | Global edge network; diagram rendering in the Oceania or Asia-Pacific region | ISO 27001, SOC 2 Type II |
| Stripe, Inc. | Payments and subscription billing | Billing contact name/email, billing address, subscription and payment status. Card details are collected and stored by Stripe directly and never reach Orixian systems | United States / EU | PCI DSS Level 1, SOC 2 |
| Resend, Inc. | Transactional email (sign-in, security, billing, notifications) | Recipient email address and transactional message content | Japan (sending region, Tokyo) and United States | SOC 2 Type II |
AI
| Subprocessor | Purpose | Customer data processed | Location | Commitments |
|---|---|---|---|---|
| Amazon Web Services, Inc. (Amazon Bedrock) | AI inferencing for platform AI features | The prompt and the relevant workspace context for each request | Australia | ISO 27001, SOC 2 Type II; zero data retention (no prompts or outputs are stored); customer content is never used to train models |
| Microsoft Corporation (Azure AI Foundry) | Making pictures with AI | The picture request | Any Azure region worldwide | ISO 27001, SOC 2 Type II; customer content is never used to train models |
| Runware | Editing pictures with AI | The picture and the editing request | European Union, and other countries where the provider processes | Data stored on EU-based servers |
Text embeddings for search and the Knowledge Graph are computed inside Orixian's own infrastructure in Sydney and never leave it; no external provider is engaged for embeddings.
Bring your own AI. Any organisation may connect its own AI provider account (on the Free plan, this is the only way to use AI). In that configuration, content for AI features flows to the customer's chosen provider under the customer's own agreement with that provider, and platform AI routing is not used. Customer-supplied API keys are stored encrypted in a managed secrets vault and are revocable at any time.
Changes to this list
Material additions or replacements are announced on this page at least 30 days in advance (and by email to customers who request update notifications via support@stablebaseline.io), giving customers a reasonable opportunity to object before the change takes effect.