Current list
These are the services that may hold or process a client's data when WorkArc provides ArcOS. Fergus and Xero are the client's own systems, not sub-processors; WorkArc reads from and writes to them on the client's instruction.
| Provider | Purpose | Data | Location |
|---|---|---|---|
| Supabase | Database, sign-in, file storage, backups | All ArcOS application data for the client, in a project dedicated to that client | Australia (Sydney) |
| Hostinger | Application hosting | Request processing, working state files, server logs, weekly server image backups | United States (Phoenix) |
| Anthropic | AI model API | The text a staff-triggered AI feature needs for that task; see the security page for the list. Not used for training | United States |
| HighLevel (Harper) | Customer messaging and CRM | Customer contacts, opportunities and the SMS and email messages the client sends through it. Contracted by the client directly | United States |
| WorkOS | OAuth for integrations and agents | Client and user identifiers only | United States |
| Google, Apple | Push notifications to staff phones | Notification text (task titles, customer reply notices) | Global |
| GitHub | Source control | No client data | United States |
Changes
WorkArc updates this page and tells clients before a new provider holds their data, as clause 9.8 of the Standard Terms requires. Questions: josh@workarc.io. How each provider is used and protected is on the security page.