Who else touches your data
Last updated: 15 September 2026
Your operational data stays in Australia. Projects, people, timesheets, plant, cost records and the documents you connect are stored and processed in Microsoft Azure’s Australia East region. The one thing that will leave it is a web-search query: once web search is switched on in Studio, the question you type goes to Exa in the United States.
Three things do leave that region, and none of them is your operational data: a notification token for your phone, an error report saying which account hit a fault, and your billing details. A web-search query will leave too, and it is the part you type yourself: once web search is switched on, the question you ask Studio goes to Exa in the United States. Every company we use is listed below.
Current subprocessors
| Company | What it handles | Where | Why |
|---|---|---|---|
| Microsoft Azure | Everything Demiton stores: your projects, people, timesheets, plant and cost records, the documents you connect, and the email address you sign in with. Also the sign-in itself (Entra ID) and the emails Demiton sends you. | Australia East (Sydney) | Hosting, database, file storage, sign-in and transactional email. Demiton itself runs here. |
| Azure OpenAI | The questions you ask Demiton, and the records needed to answer them. Your data is not used to train models. | Australia East (Sydney) | Answers questions in Studio and through the MCP server, and builds the search index over your records. Microsoft, in the same region as everything else. |
| Expo | Your device’s notification token and the one-line text of a notification, such as “Your Monday brief is ready”. Never the underlying records. | United States | Delivers push notifications to the mobile app. |
| Apple | The same notification token and one-line text as Expo, for an iPhone. Never the underlying records. | Apple’s push network, worldwide | Expo hands each iPhone notification to Apple’s Push Notification service, the only way to reach an iPhone. |
| The same notification token and one-line text as Expo, for an Android phone. Never the underlying records. | Google’s push network, worldwide | Expo hands each Android notification to Firebase Cloud Messaging, the only way to reach most Android phones. | |
| Sentry | Technical error reports: what broke, where in the code, and which account was affected. Not the contents of your records. | Germany | Tells us when something breaks, usually before you notice. |
| Stripe | Your billing contact and payment details. Card numbers go to Stripe directly and Demiton never receives them. | United States | Takes subscription payments. |
| Google Analytics | Marketing-site visits only — pages viewed on demiton.io, and only after you accept analytics cookies. Nothing from inside the product. | United States | Tells us which pages people read before getting in touch. |
Announced, not yet in use
Listed here before it starts handling anything, which is how the change process below is meant to work. Nothing in this section is processing data today.
| Company | What it handles | Where | Why |
|---|---|---|---|
| Fireworks AI | Demiton’s own source code. None of your project, people or document data. | Outside Australia | Will serve the model that writes Demiton’s code, inside Azure AI Foundry. A separate company from Microsoft, which is why it is named here rather than folded into the Azure rows. |
| Exa | The questions you ask Studio when you use web search. Nothing from your project, people or document records. | United States | Will answer live web search inside Studio, alongside the fixed datasets Demiton already reads. |
| OpenRouter | The text of an email a user raises from Outlook, for users whose organisation turns auto-classify on. Nothing else from your project, people or document records. | United States | Routes that text to TypeSafe, which classifies it. A separate company from the model provider that serves Demiton today. |
| TypeSafe | The text of that email as one of seven kinds of issue: the subject, the sender domain and up to 4,000 characters of the body. Never an attachment. | United States | Classifies the raised email, so the person raising it does not have to pick the kind by hand. Off unless the user turns it on, and an organisation admin can block it for the whole organisation. |
How this list changes
- We publish a new subprocessor on this page and email account owners before it starts handling anything.
- If you object to a new subprocessor, tell us in writing at privacy@demiton.io. The objection process and your termination right are in the Data Processing Agreement.
- This page is the single list. The Privacy Policy and the Data Processing Agreement point here rather than repeating it, so there is nothing to fall out of date.