Subprocessors

Last reviewed 31 July 2026

Our Privacy Policy says we will give you a current list of the service providers that handle personal information collected through Banksia. This is that list. For each one it sets out what they do for us, what they receive, where they process it, on what basis they hold it, and what happens to the service if they are unavailable.

Yuma IT Pty Ltd remains responsible for this information. These providers act on our instructions and may not use it for their own purposes.

Cloudflare — Turnstile (bot protection)

What they do for us: Tells a genuine submission on our public assessment, booking and opt-out forms apart from an automated one.
What they see: The IP address, browser user agent and browser signals of the device submitting the form, collected by the Turnstile widget the page loads, plus the challenge token we send back to Cloudflare to verify. It does not receive your name, your email address, or anything from an assessment.
Where they process it: Cloudflare's global network. A request is answered by whichever Cloudflare location is nearest the device, so processing may occur in any country where Cloudflare operates. Cloudflare is a United States company.
On what basis: Cloudflare's standard subscription terms, which incorporate its data processing addendum. We have not negotiated separate terms.
If they are unavailable: The form submission is refused and the visitor is asked to try again. A submission that fails or skips the check is never accepted in production.

Cloudflare — Workers (website scanning)

What they do for us: Fetches the public pages of the website being assessed and runs the readiness checks. Our application never fetches a third-party site itself.
What they see: The website address to assess, the identifiers of the assessment request and the scan, the address to return the result to, and the scan budget. It returns the check outcomes together with the evidence behind them: the addresses fetched, a filtered subset of the site's response headers, and an extract of up to 2,000 bytes from each page. It does not receive the requester's name or email address, any account information, or any credentials for our database.
Where they process it: Cloudflare's global network, as above. The Worker holds no database and no file storage, so a scan exists only for as long as it is running. Its request logs — the event, the scan and assessment identifiers, the site's hostname, the outcome and the timings — are retained by Cloudflare's logging service.
On what basis: Cloudflare's standard subscription terms, which incorporate its data processing addendum. We have not negotiated separate terms.
If they are unavailable: The scan cannot be dispatched, or its result never arrives. The assessment is marked as timed out and the requester is emailed to say the scan did not complete.

Resend — Email delivery

What they do for us: Sends every message the service sends: address verification, the report email, the email explaining a scan we could not complete, booking correspondence, site-ownership and opt-out confirmations, invitations to join an organisation, and account emails such as a password reset.
What they see: The recipient's email address, the subject line, the full text of the message, its headers including the unsubscribe address, the chart images attached to a report, and any single-use link the message carries — a verification, invitation, password-reset or report link. A report email carries the assessed site's address, its scores, and up to five findings; finding text is written by our checks and can quote short extracts of what that site publishes. The evidence trail behind the findings is not in the email — it stays in the application behind a single-use link. Delivery events such as bounces, complaints and unsubscribes are returned to us over a webhook Resend signs through Svix, its own subprocessor.
Where they process it: The United States. Resend is a United States company and we do not select an alternative sending region.
On what basis: Resend's standard terms of service, which incorporate its data processing addendum. We have not negotiated separate terms.
If they are unavailable: Sending is retried three times with increasing delays and then recorded as failed. The assessment itself still completes, and the report stays available on its link.

Slack Technologies — Incoming webhook (staff notifications)

What they do for us: When enabled, tells our team in a private channel that a public form has been submitted — an assessment request, a booking request or a request to stop assessing a website — so someone picks it up. It is a prompt to go and look at the record, not a copy of it. This is switched on by configuring a webhook address; where no address is configured nothing is sent to Slack at all, and the service works the same way without it.
What they see: When enabled: which of the three forms was used, the website's hostname or the business name given, the preferred times and timezone on a booking request, and a link into our own staff area. The email address of the person submitting is included, because the notification exists so the team knows a lead has arrived; it can be held back with a setting. Slack never receives an assessment, a report, an account, or anything from a signed-in customer.
Where they process it: The United States. Slack Technologies is a United States company and we do not select an alternative processing region.
On what basis: Slack's standard customer terms of service, which incorporate its data processing addendum. We have not negotiated separate terms.
If they are unavailable: Nothing. Notifications are best-effort and are never retried, so a submission is recorded, acknowledged and worked exactly as it would be if Slack had never been configured.

Attio — Customer relationship management (lead records)

What they do for us: When enabled, records the enquiry in the system our team works leads in when a public form is submitted — an assessment request, a booking request or a request to stop assessing a website — so that it is followed up rather than forgotten, and so the history of an enquiry sits in one place. This is switched on by configuring an API key; where no key is configured nothing is sent to Attio at all, and the service works the same way without it.
What they see: When enabled: the email address of the person submitting, the website's hostname, the business name given, which of the three forms was used, the date it arrived, the preferred times and timezone on a booking request, and a link into our own staff area. The address is the value the record is matched on, so unlike our staff notifications it cannot be held back and the service turned on regardless. Attio never receives an assessment, a report, a score, an account, an IP address, a browser user agent, or anything from a signed-in customer.
Where they process it: Not established. We send to Attio's own service at api.attio.com rather than to infrastructure we operate, and we select no processing region, so this processing may occur outside Australia. We have not confirmed a processing country and do not assert one. We will confirm the current position in writing on request.
On what basis: Attio's standard terms of service, which incorporate its data processing addendum. We have not negotiated separate terms.
If they are unavailable: Nothing. The record is written on a best-effort basis and is never retried, so a submission is recorded, acknowledged and worked exactly as it would be if Attio had never been configured.

Yuma IT Pty Ltd — Hosting, database and file storage

What they do for us: Runs the application, its database, its queue and its file storage.
What they see: Everything the service holds: assessment requests, accounts, reports, audit records and operational logs.
Where they process it: Infrastructure we operate ourselves. We do not place the application, its database or its file storage with a third-party cloud platform, so no other party handles this data. We will confirm the current hosting location in writing on request.
On what basis: Not applicable. This is us, not a third party, and is listed so the register accounts for every place the data sits.
If they are unavailable: The service is unavailable. Assessments already delivered by email remain in the recipient's inbox.

What we do not use

We do not use an external monitoring, error-reporting or performance-analytics service. The application can emit tracing, but it is switched off and no external collector is configured for it; operational logs are written on the host that runs the application.
We do not use a web analytics or advertising service, and we run no third-party tracking on this site.
We do not take payments through this site, so no payment processor receives anything from it.
We do not load fonts or scripts from a third-party content delivery network at page load, apart from the bot-protection widget described above. Typefaces are downloaded when the site is built and served from our own address.

Keeping this current

We review this list at least every six months, and whenever we add, remove or change what a provider does for us. The date at the top shows when it was last reviewed. If you need this list in writing for a procurement or vendor assessment, or you want the hosting location of your data confirmed, email [email protected].

Our Privacy Policy explains what we collect and why, including the overseas disclosure that follows from this list, and our Security page sets out the controls we hold ourselves to.