Stable Baseline
Trust

Subprocessor List

The third parties (subprocessors) Orixian Solutions engages to deliver Stable Baseline: what each does, where it operates, and what data it touches.

Last updated: 23 July 2026

Published by Orixian Solutions Pty Ltd (ABN 40 627 250 186). All persistent customer content is stored in Australia (Sydney). A small number of US-based providers process limited data categories, described below.

Infrastructure & platform

SubprocessorPurposeCustomer data processedLocationAttestations
Supabase, Inc.Core platform: managed PostgreSQL database, authentication, file storage, serverless functionsAccount data; all workspace content (documents, diagrams, boards, plans, uploads); audit logsAWS Asia Pacific (Sydney), AustraliaSOC 2 Type II
Amazon Web Services, Inc.Cloud infrastructure underlying SupabaseSame categories, at the infrastructure layerap-southeast-2 (Sydney), AustraliaISO 27001, SOC 2 Type II
Microsoft Corporation (Azure)Document/slide conversion, design and render workers, meeting transcription workersWorkspace content during processing only: transient state is purged on an hourly cycleAustraliaISO 27001, SOC 2 Type II
Cloudflare, Inc.Application and website hosting, CDN, WAF, DDoS protection, bot challengeTraffic and request metadata; content in transit only (not retained at rest)Global edge networkISO 27001, SOC 2 Type II
Vultr (The Constant Company, LLC)Infrastructure hosting for Orixian's self-managed diagram render serverDiagram source text during rendering (transient)Sydney, AustraliaWorkload managed and hardened by Orixian
Stripe, Inc.Payments and subscription billingBilling contact name/email, billing address, subscription and payment status. Card details are collected and stored by Stripe directly and never reach Orixian systemsUnited States / EUPCI DSS Level 1, SOC 2
Resend, Inc.Transactional email (sign-in, security, billing, notifications)Recipient email address and transactional message contentUnited StatesSOC 2 Type II

AI

SubprocessorPurposeCustomer data processedLocationCommitments
Vercel, Inc. (AI Gateway)AI inference gateway for platform AI features (assistant chat, retrieval, embeddings); the gateway routes each request to the configured model providerThe prompt and the relevant workspace context for each requestUnited StatesSOC 2 Type II; Zero Data Retention enforced (the gateway retains no prompts or outputs; requests route only to providers under Vercel's negotiated ZDR agreements); customer content is never used to train models

Text embeddings for search and the Knowledge Graph are computed inside Orixian's own infrastructure in Sydney and never leave it; no external provider is engaged for embeddings.

Bring your own AI (Enterprise). Enterprise customers may connect their own AI provider accounts (for example OpenAI, Anthropic, or Microsoft Azure AI Foundry). In that configuration, content for AI features flows to the customer's chosen provider under the customer's own agreement with that provider, and platform AI routing is not used. Customer-supplied API keys are stored encrypted in a managed secrets vault and are revocable at any time.

Changes to this list

Material additions or replacements are announced on this page at least 30 days in advance (and by email to customers who request update notifications via [email protected]), giving customers a reasonable opportunity to object before the change takes effect.

Questions

[email protected] · [email protected]