Subprocessor list
Plus Ultra Innovations Pty Ltd
Version: 3.1 Last updated: 4 August 2026
About this list
Plus Ultra Innovations Pty Ltd is the data controller for the personal information entrusted to us. To provide our services we use a small number of third-party service providers ("subprocessors").
This page covers two distinct processing contexts, in two sections:
- Platform subprocessors — providers that support the Wellbeing Dashboard platform, where customer workforce data is processed.
- Website subprocessors — providers that support this marketing website, where enquiries submitted through the contact form are processed.
We describe only what is true today. Where a provider processes no personal information, we say so — "none" is an honest answer, not a gap.
Our commitment. This list is updated before a new subprocessor begins processing customer personal information.
Data processing agreements. We rely on the standard data processing agreement each subprocessor provides under its terms. We do not claim bespoke or separately negotiated contracts.
Certifications. Any certification noted below is the provider's own, taken from that provider's public security or trust page. It is not a certification held by Plus Ultra.
Section 1 — Platform subprocessors
Subprocessors that support the Wellbeing Dashboard platform, where customer workforce data is processed. Supabase is our primary processor — it stores the personal information.
| Legal entity | Purpose | Categories of data processed | Country of processing |
|---|---|---|---|
| Supabase Inc. | PostgreSQL database, authentication and hosting (primary processor) | Account details, assessment responses, authentication credentials | Sydney, Australia (ap-southeast-2) |
| Resend, Inc. | Transactional email delivery | Recipient names, email addresses, email content | United States |
| Vercel Inc. | Application hosting and edge network | Request routing and access logs, including IP addresses; no personal information at rest | United States / global edge |
| Upstash, Inc. | Redis caching and rate limiting | Cache keys and rate-limit counters; no personal information at rest | Sydney, Australia (ap-southeast-2) |
Certifications (each provider's own): Supabase — SOC 2 Type 2, ISO 27001; Resend — SOC 2; Vercel — SOC 2 Type 2, ISO 27001; Upstash — none applies to our plan (Upstash's SOC 2 covers its Pro and Enterprise plans only; we are on the free plan).
Section 2 — Website subprocessors
Subprocessors that support this marketing website, processing enquiries submitted through the contact form. No customer workforce data passes through these services; they process website enquiries only. Website hosting and rate limiting are processed in Australia; enquiry emails are delivered and stored in the United States via Resend and Google.
| Legal entity | Purpose | Categories of data processed | Country of processing |
|---|---|---|---|
| Vercel Inc. | Hosting and server-side execution of the contact form | Contact-form submission in transit (name, email address, organisation, enquiry message) and request metadata, including IP address | Sydney, Australia (ap-southeast-2) |
| Resend, Inc. (San Francisco, CA, USA) | Delivery of contact-form enquiry emails | Enquirer's name, email address, organisation and enquiry message | United States |
| Google LLC | Receipt and storage of contact-form enquiry emails | Enquiry content and contact details | United States |
| Upstash, Inc. | Rate limiting on the contact form | IP addresses (and derived rate-limit counters) | Sydney, Australia |
Resend's own subprocessors are listed at resend.com/legal/subprocessors and are governed by their data processing agreement.
Contact
Questions about our subprocessors can be raised through the contact form on our website.
This list reflects our subprocessors as of 4 August 2026 and describes only providers in use today.