Sub-processors
XBert engages a small number of third-party sub-processors to deliver the platform. Each sub-processor is contracted under a Data Processing Agreement that restricts how customer data may be used and requires appropriate technical and organisational security measures.
This page lists every sub-processor that may process XBert customer data. It is updated whenever the list changes; the date of the most recent change is shown at the bottom of the page.
Critical sub-processors (in the request path for the XBert platform)
Section titled “Critical sub-processors (in the request path for the XBert platform)”| Sub-processor | Purpose | Region | Certifications |
|---|---|---|---|
| Microsoft Azure | Cloud infrastructure — compute, storage, database, networking, identity infrastructure | Australia Southeast (primary), Australia East (DR) | ISO 27001, ISO 27018, SOC 2 Type II, CSA STAR, IRAP |
| Auth0 (Okta) | Customer identity and access management — authentication, MFA, OAuth | Global (geographic configuration applied) | ISO 27001, SOC 2 Type II, ISO 27018, HIPAA BAA, PCI DSS, GDPR |
| OpenAI | Generative AI for product features — ephemeral processing under DPA | United States | SOC 2 Type II |
| Anthropic | Generative AI for product features — ephemeral processing under DPA | United States | SOC 2 Type II |
Both AI sub-processors operate under Data Processing Agreements that prohibit customer data being used for model training or fine-tuning, and that prohibit retention beyond the duration of the API call. See AI Governance & Data Processing for the full handling description.
Billing and payment sub-processors
Section titled “Billing and payment sub-processors”| Sub-processor | Purpose | Certifications |
|---|---|---|
| Chargebee | Subscription billing and recurring invoicing | PCI-DSS Level 1, SOC 2 Type II |
| Stripe | Payment processing | PCI-DSS Level 1, SOC 2 Type II |
XBert does not process, store, or log credit card details. Card data is transmitted directly to Chargebee and Stripe over SSL and never traverses XBert systems.
Accounting and payroll integrations
Section titled “Accounting and payroll integrations”XBert integrates with the customer’s chosen accounting and payroll systems on the customer’s instruction. These are integration partners rather than XBert sub-processors — the customer’s data is exchanged with these systems under the customer’s own contractual relationship with each provider.
| Provider | Purpose |
|---|---|
| Xero | Accounting data |
| QuickBooks (Intuit) | Accounting data |
| MYOB | Accounting data |
| FreeAgent | Accounting data |
| Xero Payroll | Payroll data (Australia, New Zealand) |
| Employment Hero | Payroll and HR data |
| Xero Practice Manager | Practice management data |
Operational and support sub-processors
Section titled “Operational and support sub-processors”| Sub-processor | Purpose | Region |
|---|---|---|
| Intercom | Customer support messaging and knowledge base | Customer-configurable; XBert’s tenant is configured to comply with Australian residency requirements where applicable |
| GitHub | Source code hosting (XBert engineering only — no customer data) | United States |
| Sentry | Application error tracking — XBert engineering only; PII transmission disabled by configuration | United States |
Changes to this list
Section titled “Changes to this list”XBert reviews this sub-processor list quarterly and whenever a material change occurs. Material changes (new sub-processor, removal, change of region) are reflected here on the date of the change.
For Data Processing Agreement copies or to be notified of changes, please contact security@xbert.io.
| Version | Date | Change |
|---|---|---|
| 1.0 | 2026-06-04 | Initial publication |