Subprocessors and Infrastructure Statement
SignAndGo
Owned by Fintech Development Pty Ltd
ACN 655 608 969
Address: Level 1, 18-20 Knuckey Street Darwin NT 0800
Contact: sign@signandgo.com.au
Effective date: 12 October 2026
1. Purpose
This statement describes third party service providers that may process customer data to operate SignAndGo, and provides a high level overview of our infrastructure.
2. Subprocessors
A subprocessor is a third party that processes customer data on our behalf to help deliver the Service. Customers may request the current list at sign@signandgo.com.au.
As at the effective date, SignAndGo may use the following subprocessors.
Application hosting and runtime infrastructure
| Provider | Purpose | Data Processed | Location |
|---|---|---|---|
| Google Cloud Platform (Cloud Run) | Application hosting, backend compute, and static site hosting (Firebase Hosting) | Service metadata, operational logs, and data necessary to run the application | australia-southeast1 (Sydney) |
Database and document storage
| Provider | Purpose | Data Processed | Location |
|---|---|---|---|
| Google Cloud Firestore | Primary database and document storage, including file storage via Firebase Storage | Documents, envelopes, audit events, contacts, templates, company records, workspace data, and related metadata | australia-southeast1 (Sydney) |
Email delivery
| Provider | Purpose | Data Processed | Location |
|---|---|---|---|
| Amazon Simple Email Service (Amazon Web Services), via the MyAndGo platform | Delivery of most signing invitations, reminders and service emails | Recipient names, email addresses, email content (including signing links) and delivery metadata | ap-southeast-2 (Sydney) |
| SendGrid (Twilio Inc.) | Delivery of emails that carry an attached signed PDF, and of any email when the primary route is unavailable | Recipient names, email addresses, email content, any attached signed PDF, and delivery metadata | United States |
SMS and mobile notifications
| Provider | Purpose | Data Processed | Location |
|---|---|---|---|
| Twilio | SMS signing notifications and verification codes | Recipient phone numbers and notification content | United States |
| Expo (650 Industries, Inc.) | Push notifications to the SignAndGo mobile app, where the user has allowed them | Device push tokens and notification content | United States |
Payment processing
| Provider | Purpose | Data Processed | Location |
|---|---|---|---|
| Stripe | Subscription billing and payment processing | Billing name, email, payment card details (PCI DSS Level 1 compliant) | United States and European Union |
IP address location
| Provider | Purpose | Data Processed | Location |
|---|---|---|---|
| ip-api.com | Approximate location of the IP address used to create an account, for account security | IP address | Not fixed: the provider answers from one of its servers, which may be outside Australia |
Product analytics
| Provider | Purpose | Data Processed | Location |
|---|---|---|---|
| Google Analytics 4 (Google LLC) | Aggregate traffic measurement on public marketing pages only. Deliberately not loaded on signing, witness or web-form pages. | Pseudonymous identifiers, page URLs and referrers. No document content, no signature data, no field values. | United States and other Google data centre locations |
AI services
| Provider | Purpose | Data Processed | Location |
|---|---|---|---|
| Google Vertex AI (Gemini) | AI assistant ("Sharna"), AI document summary, AI field-placement detection on uploaded documents | User prompts and document text excerpts; Google does not use this data to train its models per the Vertex AI customer data terms | australia-southeast1 (Sydney) |
Optional integrations enabled by customers
| Provider | Purpose | Data Processed |
|---|---|---|
| Monday.com | Optional synchronisation of workflow or status, where configured by the customer | Envelope status metadata and identifiers, as configured |
| Xero | Optional filing of signed PDFs into the customer's Xero organisation, and creating signers as Xero contacts, where configured by the customer | Signed PDFs, signer names and email addresses |
| Procore | Optional sending of Procore contracts for signature and returning the signed PDF, where configured by the customer | Contract documents, signed PDFs, signer names and email addresses |
| Google Gemini AI | Optional AI-powered support chat assistant | Chat messages submitted by the user; no document content is sent |
Authentication providers
| Provider | Purpose | Data Processed |
|---|---|---|
| Google Firebase Authentication (Google LLC), via the MyAndGo platform | Sign-in for MyAndGo accounts, which SignAndGo accounts use | Sign-in details: name, email address, sign-in method and any password hash (United States) |
| Google OAuth | Optional sign in method, where enabled | User identity attributes provided by Google, typically name and email |
| Sign in with Apple | Optional sign in method in the SignAndGo mobile app | User identity attributes provided by Apple, typically name and email |
| Microsoft OAuth | Optional sign in method for Microsoft 365 users | User identity attributes provided by Microsoft, typically name and email |
3. Infrastructure overview
- The Service operates as a web application and API, hosted on Google Cloud Platform in the australia-southeast1 (Sydney) region.
- Documents are stored within Google Cloud Firestore and Firebase Storage, both configured for the Sydney region.
- Your documents, records and files are stored in Sydney, Australia. Some services run elsewhere, as listed above.
- Audit trails record key workflow events and may be verified using tamper evident audit chain verification.
4. Changes
We may update subprocessors from time to time. For paid customers, we will provide notice of material changes where practical.