Trust Centre
The third-party services First Six relies on to run, what each one does, and where it sits. The system of record stays in Australia; a short list of supporting services sit elsewhere, each scoped to a specific job.
Who we rely on, what they do, and where they sit
You can find our subprocessors live list here:
https://knowledge.firstsix.com.au/institutions/safety-compliance/subprocessors
How we manage subprocessors
A subprocessor earns its place or it's not on the list. This is the discipline behind it.
01
Add only when it earns its place
A third party is added only when it does a job we can't do as well ourselves, and only with access scoped to that job.
02
Scope what it can see
Each subprocessor sees the minimum its function needs, and diagnostics are scrubbed of personal data before they leave the system.
03
Bind it by agreement
The rule is that every subprocessor is covered by a data processing agreement setting out security and handling obligations. We track sign-off per provider and share current status on request.
04
Disclose and review
The list is public, dated, and reviewed. Material changes are notified in advance through your contact rather than slipped in quietly.
Who's on the list
Each active subprocessor, what it does, and where it runs.
AWS Sydney
Managed Supabase Postgres database, authentication, and file storage in AWS Sydney (ap-southeast-2). This is the system of record, isolated per tenant.
Vercel
Application hosting in the Sydney region, with a global CDN for static assets. No student system of record at rest.
SendGrid (US)
Transactional email: sign-in links and notifications. Sees the recipient address and message content.
Sentry & Anthropic (US)
Error monitoring on scrubbed diagnostics, and staff-facing AI features that process only what staff submit and aren't used to train models.
Questions about where your data sits?
We're happy to walk your security and procurement teams through the full list, the regions, and the agreements behind each one.
What we never do
Support means seeing the pattern, not the person. These limits are built into the product, not just promised in a policy.
We never sell or share student data
Student data is used to run First Six for your institution — never sold, rented, or handed to advertisers or data brokers. Full stop.
We never build watchlists
Individual wellbeing answers stay private to the student. Staff see aggregate trends with small groups suppressed — never a named list of who to watch.
We never train external AI on student data
Student records are not used to train third-party models. AI features process only what staff submit, and that content is not retained for training.
We never hide where data lives
The system of record stays in Australia, and every subprocessor and region is listed openly here in the Trust Centre. No surprises.
Frequently asked questions
What security, privacy, and procurement teams ask us most.
The system of record, the database holding enrolment, wellbeing check-ins, and help requests, stays in Australia. Some supporting services sit overseas for a specific job: transactional email, optional Slack crisis alerts, scrubbed error diagnostics (session replay disabled entirely), staff-facing AI, web fonts served by Google, privacy-first analytics on the public knowledge base (EU), independent uptime monitoring for the status page (EU), and an optional lead-capture webhook for marketing demo signups. Rate-limit counters (Upstash) stay in Sydney. One further overseas flow is the daily off-site backup, added in July 2026: a copy of the database is stored with GitHub so that losing our main cloud provider does not lose your data with it. The backup job runs on GitHub's build machines and encrypts the copy in memory before anything is stored, so what GitHub holds is a file it cannot read: the key that opens it is held offline and never goes to the cloud. What reaches each service is limited to that purpose, and personal data is filtered out of diagnostics before they leave.
This page is the source of truth, as well as our Knowledge Base Subprocessors page (https://knowledge.firstsix.com.au/institutions/safety-compliance/subprocessors). Where a change materially affects how your data is handled, we give notice in advance through your onboarding or support contact rather than changing it silently.
No. Your IdP is your own system. First Six links a sign-in to an existing person; it never receives or stores your directory.
We require every subprocessor to be covered by a data processing agreement setting out security and data-handling obligations. Sign-off is tracked per provider, and the current status is shared during procurement discussions.
No. AI features process only what staff submit, and that content isn't used to train models. Student records are never sent for model training.