Trust Centre
The third-party services First Six relies on to run, what each one does, and where it sits. The system of record stays in Australia; a short list of supporting services sit elsewhere, each scoped to a specific job.
Who we rely on, what they do, and where they sit
How we manage subprocessors
A subprocessor earns its place or it's not on the list. This is the discipline behind it.
01
Add only when it earns its place
A third party is added only when it does a job we can't do as well ourselves, and only with access scoped to that job.
02
Scope what it can see
Each subprocessor sees the minimum its function needs, and diagnostics are scrubbed of personal data before they leave the system.
03
Bind it by agreement
The rule is that every subprocessor is covered by a data processing agreement setting out security and handling obligations. We track sign-off per provider and share current status on request.
04
Disclose and review
The list is public, dated, and reviewed. Material changes are notified in advance through your contact rather than slipped in quietly.
Who's on the list
Each active subprocessor, what it does, and where it runs.
Supabase (Australia)
Managed Postgres database, authentication, and file storage in AWS Sydney (ap-southeast-2). This is the system of record, isolated per tenant.
Vercel
Application hosting in the Sydney region, with a global CDN for static assets. No student system of record at rest.
SendGrid (US)
Transactional email: sign-in links and notifications. Sees the recipient address and message content.
Sentry & Anthropic (US)
Error monitoring on scrubbed diagnostics, and staff-facing AI features that process only what staff submit and aren't used to train models.
Twilio (US, optional)
Crisis SMS where an institution enables it; sees only the recipient number and message, for crisis messaging.
Questions about where your data sits?
We're happy to walk your security and procurement teams through the full list, the regions, and the agreements behind each one.
What we never do
Support means seeing the pattern, not the person. These limits are built into the product, not just promised in a policy.
We never sell or share student data
Student data is used to run First Six for your institution — never sold, rented, or handed to advertisers or data brokers. Full stop.
We never build watchlists
Individual wellbeing answers stay private to the student. Staff see aggregate trends with small groups suppressed — never a named list of who to watch.
We never train external AI on student data
Student records are not used to train third-party models. AI features process only what staff submit, and that content is not retained for training.
We never hide where data lives
The system of record stays in Australia, and every subprocessor and region is listed openly here in the Trust Centre. No surprises.
Frequently asked questions
What security, privacy, and procurement teams ask us most.
The system of record, the database holding enrolment, wellbeing check-ins, and help requests, stays in Australia. Some supporting services sit overseas for a specific job: transactional email, optional crisis SMS, scrubbed error diagnostics, and staff-facing AI. What reaches each is limited to that purpose, and personal data is filtered out of diagnostics before they leave.
This page is the source of truth and carries a last-reviewed date. Where a change materially affects how your data is handled, we give notice in advance through your onboarding or support contact rather than changing it silently.
No. Your IdP is your own system. First Six links a sign-in to an existing person; it never receives or stores your directory.
We require every subprocessor to be covered by a data processing agreement setting out security and data-handling obligations. Sign-off is tracked per provider, and the current status is shared during procurement discussions.
No. AI features process only what staff submit, and that content isn't used to train models. Student records are never sent for model training.
See it for your next cohort.
Currently meeting with universities.