Effica sub-processors

Last updated: 20 October 2026

Effica is operated by AI Core CRM Pty Ltd. The suppliers below may process personal information on our behalf to deliver and support the platform. Locations describe the relevant service configuration or provider processing boundary; they are not a claim that every support, log, network, or delivery activity occurs only in that location.

Effica is independent provider-management software for provider operations. It is not the NDIA or the NDIS Quality and Safeguards Commission, is not NDIS approved or endorsed by either agency, and is not a participant-provider marketplace. Effica may process claim and billing records for a provider, but does not hold or process NDIS plan funds as an intermediary. The customer provider remains responsible for its participant relationships, services, authorisations, regulatory and claim decisions, and submissions.

Where limited information is processed outside Australia, Effica uses the service only for the purpose listed below and applies data minimisation, contractual protections, access controls, and security safeguards appropriate to the information and risk.

Platform sub-processors

Supabase Pte. Ltd.

Service and purpose
Primary database, authentication, file storage, and realtime infrastructure.
Main processing boundary
Sydney region for the Effica project; provider support and service metadata may involve other locations
Provider information

Google Cloud

Service and purpose
Web application hosting, regional load balancing, dynamic compute, background job scheduling, task delivery, worker execution, Effica's own document search model for private documents, document text recognition (OCR) for scans and photos of documents, encrypted backup copies, and a standby copy of the platform.
Main processing boundary
Sydney (australia-southeast1) for configured application and background processing and backups. Document search runs on Effica's own search model on our servers in Sydney, with a standby in Melbourne; no outside AI company sees those documents. Melbourne (australia-southeast2) for a live standby copy of the database (continuously copied, about 30 seconds behind), standby services, and hourly copies of the encrypted backups. Provider support and service metadata may involve other locations
Provider information

Temporal Technologies, Inc. (Temporal Cloud)

Service and purpose
Background workflow orchestration. Temporal mainly holds record identifiers and job status; care records, notes and files stay in Effica. Workflow history is stored in Sydney.
Main processing boundary
Sydney (AWS ap-southeast-2)
Provider information

Plus Five Five, Inc. (Resend)

Service and purpose
Transactional email delivery, which may process recipient addresses, generic or service-message content, links or codes, and delivery metadata.
Main processing boundary
United States
Provider information

650 Industries, Inc. (Expo)

Service and purpose
Mobile app builds, over-the-air app updates (EAS Update), and push delivery. For push, Expo receives only a device push token, generic alert, opaque notification ID, and delivery metadata; notification details remain in Effica.
Main processing boundary
United States
Provider information

Apple Inc. (Apple Push Notification service)

Service and purpose
Delivers push alerts to iPhones. Apple receives the device push token and the generic alert only.
Main processing boundary
Global Apple services
Provider information

Google Firebase Cloud Messaging

Service and purpose
Delivers push alerts to Android phones. Google receives the device push token and the generic alert only.
Main processing boundary
Global Google services
Provider information

Google Maps Platform

Service and purpose
Maps, geocoding, location display, and typed address or place suggestions.
Main processing boundary
Global Google Maps services
Provider information

Customer-directed integrations

These services receive information only when a customer connects or uses the integration. The customer authorises the transfer and also has a direct account or relationship with the integration provider.

  • Google Gmail and Google Calendar: A user-selected personal connection. Effica reads Gmail messages and Google Calendar events directly from Google as the user works, and sends requested changes to Google. Effica keeps encrypted access credentials, basic account, label and calendar details, preferences, and limited action records; it does not keep a separate mailbox or event history for ordinary views. This is separate from Google Analytics on public marketing pages.
  • Microsoft 365 Outlook mail and calendar: A user-selected personal connection through Microsoft Graph. Effica reads Outlook mail and calendar events from Microsoft, sends requested changes to Microsoft, and receives Microsoft change alerts so the views stay current. The mailbox and calendar stay in the customer's Microsoft 365 tenant and its region. Effica keeps encrypted access credentials, basic account, folder and calendar details, preferences, and limited action records. To keep Outlook views quick, it also keeps an encrypted working copy of recent message details (such as subject, people and preview), recently opened messages and calendar events. That copy is deleted when the user disconnects.
  • Xero: A customer-enabled accounting and payroll connection that may exchange contacts, invoices, financial reports, worker mappings, timesheets, and encrypted connection credentials.
  • Employment Hero Payroll / KeyPay: A customer-enabled payroll connection that may exchange worker mappings, payroll reference data, and approved timesheet lines.

Sales, billing, and business services

The following services process provider business, enquiry, or subscription information rather than ordinary participant care records:

  • Stripe: Effica provider signup and SaaS subscription billing, including related business contact and transaction metadata. This is Effica's own subscription charging; Stripe does not process NDIS plan funds for Effica.
  • HubSpot: Contact and demo forms, prospect communications, and provider commercial account lifecycle records.

Website tools

These tools run only on the public website at effica.com.au. They never receive information from inside the Effica app.

  • Google Analytics 4: Measures visits to the public website. On by default; a visitor can turn it off in Privacy choices.
  • Storylane: Runs the interactive product tours on the public website. On by default; a visitor can turn it off in Privacy choices.
  • Meta Pixel: Measures visits that come from Meta advertising. On by default; a visitor can turn it off in Privacy choices.
  • Google reCAPTCHA: Loads with the contact form to stop spam. It runs whatever the visitor chooses in Privacy choices. Google services are global.

Australian core, with disclosed exceptions

Effica's primary database, authentication, file storage, and dynamic application compute are configured in Sydney. Core operational records are hosted in Australia, with a live standby copy in Melbourne. Selected email, AI, push, mapping, support, payment, enquiry, website, and background-processing services may process limited information overseas only for their stated functions and under appropriate contractual and security safeguards. Public and static content may be delivered globally.

Transactional email is delivered through Resend in the United States and may process recipient addresses, generic or service-message content, links or codes, and delivery metadata. Effica minimises email content and provides protected records through Effica-controlled secure access.

Changes, questions, or objections

We update this page when the material processing arrangement changes and provide additional notice where a customer agreement requires it. Before activating a new material sub-processor for customer information, Effica will assess the service and update this list. For questions, available data-processing documentation, or an objection to a proposed change, contact info@effica.com.au.

See the Privacy Policy for individual rights, complaints, and further overseas-processing information.