Kanbrio Sub-processor List

Version 1.0 · Effective 29 September 2026

Published at: https://kanbrio.com/subprocessors

This list is published by [to be confirmed] (ABN [to be confirmed]), trading as Kanbrio, of [to be confirmed] ("Kanbrio", "we", "us").

1. What this list is

A sub-processor is a company outside Kanbrio that we engage to help provide the Kanbrio service and that may process personal data our customers put into Kanbrio ("Customer Personal Data") on our behalf.

This list is part of, and is referred to by:

• our Data Processing Agreement (https://kanbrio.com/dpa), which gives customers our commitments about sub-processors; and
• our Privacy Policy (https://kanbrio.com/privacy), which explains which overseas recipients may receive personal information and in which countries.

We require each sub-processor, by written contract, to protect personal data to a standard at least as protective as our own commitments to you, including confidentiality, security, and deleting or returning data when the service ends. We remain responsible to you for our sub-processors' handling of Customer Personal Data.

We use each sub-processor only for the purpose stated below.

2. Where your data is kept: our own infrastructure (not sub-processors)

Kanbrio runs on its own servers. The core of the service runs on servers that Kanbrio operates itself, in Australia. These are not third parties, so they are not sub-processors. We describe them here so the list gives you the full picture.

Some of the software we run on our own servers is open source: PostgreSQL, Keycloak for sign-in, MinIO for file storage, Valkey, RabbitMQ, and a small AI model that turns text into search vectors for semantic search. This software runs on our servers, so none of your data goes to the people who make it. In particular, semantic search is computed on our own server. Your text is not sent to any outside AI service for search.

3. Current sub-processors

3.1 Notes on the coding agent

• The coding agent is optional. If your organisation never runs a coding task, no data from your workspace goes to DigitalOcean or Anthropic.
• Kanbrio's AI coding agent proposes changes. A person in your organisation must accept a change before it is used.
• If your organisation adds its own Anthropic API key in Settings, the coding agent uses your key for your tasks. The data still flows through the DigitalOcean server described above. Anthropic then processes that request under your account and your agreement with Anthropic, not ours.
• Kanbrio keeps a record of how many AI tokens each task used and what it cost. That record does not contain the text that was sent or received.

4. Independent controller: PayPal

When you pay through PayPal, PayPal decides for itself how it uses your data, for example for fraud prevention and to meet its own legal duties. That makes PayPal an independent controller, not our sub-processor. You enter your payment details with PayPal directly. Kanbrio never sees or stores your card or bank account numbers.

5. Services you choose to connect (not our sub-processors)

Kanbrio lets you send your own data to places you choose. When you do, the receiving service works for you, not for us, and it is not our sub-processor. This covers:

• Webhooks that your automation rules send to addresses you enter;
• External MCP servers that you connect Kanbrio's outbound MCP client to;
• Your own AI agents and tools (for example, an AI coding assistant) that connect to Kanbrio using an agent API key you issue;
• Your code host (for example, a git hosting service) that the coding agent copies your repository from;
• Your own AI provider account, when you add your own API key (see section 3.1); and
• Any service you export or import data from, such as another project-management tool you import from.

You are responsible for choosing these services, for your agreements with them, and for any transfer of personal data to them. Our Terms of Service and Data Processing Agreement say more.

6. What we do not use

To be clear about what is not happening:

• No advertising, analytics, session-recording or tracking services. The Kanbrio app and website do not load third-party analytics or advertising scripts. If we ever add one, we will update this list, our Cookie Policy and, where the law requires, ask for your consent first.
• No AI training on your data, by Kanbrio or by any sub-processor.
• No outside AI service for search. Semantic search runs on our own server in Australia.
• GitHub holds Kanbrio's own source code and build pipeline. It does not receive customer data, so it is not a sub-processor.

7. Changes we expect

We tell you now about changes that are likely, so they are not a surprise. None of these is in use yet. Each will go through the notice process in section 8 before it starts.

• Cryptocurrency payments. We may add cryptocurrency as a payment option through a payment provider. Before we do, we will add that provider here, including whether it acts as our sub-processor or as an independent controller like PayPal.
• Moving hosting. Kanbrio currently runs on its own servers in Australia. We may later move to a hosting provider. If that provider would hold Customer Personal Data, we will add it here with at least 30 days' notice, and tell you in which country your data would be stored.

8. How we tell you about changes, and your right to object

Advance notice. At least 30 days before a new sub-processor starts processing Customer Personal Data (or before we replace one), we will:

1. update this page, including the version number, date and change log below; and
2. email the owners and administrators of every Kanbrio organisation at the addresses on their accounts.

Anyone else who wants these notices, for example your privacy or procurement team, can ask to be added by emailing [email protected].

Emergencies. If we must replace a sub-processor urgently, for example because it has stopped providing its service or because of a security risk, we may have to make the change with less notice. If that happens, we will tell you as soon as we reasonably can and explain why. Your right to object still applies.

Objecting. If you have a reasonable concern about a new sub-processor, related to data protection, tell us at [email protected] within the 30-day notice period. We will talk with you in good faith and try to address the concern, for example by explaining the safeguards or, where practical, by avoiding use of that sub-processor for your data. If we cannot resolve it within 30 days of your objection, you may end the affected Kanbrio service by written notice. We will then refund, pro rata, any fees you prepaid for the period after termination. Our Data Processing Agreement (section 8.5) sets out the full process.

Removals. When we stop using a sub-processor, we update this list. We may do that without advance notice, because removing a sub-processor does not widen who handles your data.

9. Transfers outside Australia

Kanbrio stores Customer Personal Data in Australia. Using the sub-processors above means some personal data is also processed outside Australia:

• United States: Twilio SendGrid (emails) and Anthropic (coding-agent AI requests).
• Worldwide: Cloudflare's network, which handles traffic at the location nearest to each user.
• Australia: DigitalOcean (Sydney).
• [to be confirmed]: [to be confirmed] (email you send us).

Australia does not have an "adequacy" decision from the European Union or the United Kingdom. For personal data covered by the EU or UK GDPR, we rely on the European Commission's Standard Contractual Clauses (Decision 2021/914) and the UK Addendum, both in our agreement with you and in our sub-processors' agreements with us, as described in our Data Processing Agreement.

10. Contact

• Privacy questions, objections, and requests for change notices: [email protected]
• Legal notices: [email protected]
• Post: [to be confirmed], [to be confirmed]

Change log