Who else touches your data
Last updated: 8 September 2026
Your operational data stays in Australia. Projects, people, timesheets, plant, cost records and the documents you connect are stored and processed in Microsoft Azure’s Australia East region, and are not sent anywhere else.
Three things do leave that region, and none of them is your operational data: a notification token for your phone, an error report saying which account hit a fault, and your billing details. Every company we use is listed below.
Current subprocessors
| Company | What it handles | Where | Why |
|---|---|---|---|
| Microsoft Azure | Everything Demiton stores: your projects, people, timesheets, plant and cost records, the documents you connect, and the email address you sign in with. Also the sign-in itself (Entra ID) and the emails Demiton sends you. | Australia East (Sydney) | Hosting, database, file storage, sign-in and transactional email. Demiton itself runs here. |
| Azure OpenAI | The questions you ask Demiton, and the records needed to answer them. Your data is not used to train models. | Australia East (Sydney) | Answers questions in Studio and through the MCP server, and builds the search index over your records. Microsoft, in the same region as everything else. |
| Expo | Your device’s notification token and the one-line text of a notification, such as “Your Monday brief is ready”. Never the underlying records. | United States | Delivers push notifications to the mobile app. |
| Sentry | Technical error reports: what broke, where in the code, and which account was affected. Not the contents of your records. | Germany | Tells us when something breaks, usually before you notice. |
| Stripe | Your billing contact and payment details. Card numbers go to Stripe directly and Demiton never receives them. | United States | Takes subscription payments. |
| Google Analytics | Marketing-site visits only — pages viewed on demiton.io, and only after you accept analytics cookies. Nothing from inside the product. | United States | Tells us which pages people read before getting in touch. |
Announced, not yet in use
Listed here before it starts handling anything, which is how the change process below is meant to work. Nothing in this section is processing data today.
| Company | What it handles | Where | Why |
|---|---|---|---|
| Fireworks AI | Demiton’s own source code. None of your project, people or document data. | Outside Australia | Will serve the model that writes Demiton’s code, inside Azure AI Foundry. A separate company from Microsoft, which is why it is named here rather than folded into the Azure rows. |
How this list changes
- We publish a new subprocessor on this page and email account owners before it starts handling anything.
- If you object to a new subprocessor, tell us in writing at privacy@demiton.io. The objection process and your termination right are in the Data Processing Agreement.
- This page is the single list. The Privacy Policy and the Data Processing Agreement point here rather than repeating it, so there is nothing to fall out of date.