Infrastructure and core service
| Company | What it does for Colabi | Data location |
|---|---|---|
| Amazon Web Services | Hosting, database, file storage, secrets, email sending | Australia (Sydney) |
| Stripe | Payments, subscriptions and payouts | Australia, United States |
| Pusher | Real-time updates in the app | United States |
| Google reCAPTCHA | Protecting sign-in from bots | United States |
| Pipeboard | Reading connected ad account data for AI answers, where enabled | United States |
| Google Firebase, browser push services | Mobile and browser push notifications | United States, other locations |
| Microsoft | Colabi's own email | Australia, United States |
| Xero | Colabi's own accounting and invoices | New Zealand, United States |
| IP location services (ip-api and fallbacks) | Estimating a visitor's country from their IP address | Various |
| Google Maps Platform, OpenStreetMap | Looking up addresses and public business details | United States, other locations |
AI, voice and research
| Company | What it does for Colabi | Data location |
|---|---|---|
| Google (Gemini API, paid tier) | Main AI model, embeddings, image and video generation | United States and other Google locations |
| Anthropic | AI model for selected features and as a backup | United States |
| OpenAI | Speech-to-text, and AI model when selected or as a backup | United States |
| Deepgram | Live speech-to-text for calls and dictation | United States |
| ElevenLabs | Text-to-speech voices for AI agents | United States |
| Twilio | Phone calls, call recordings and text messages | United States |
| Pinecone | Search index of uploaded business documents | United States |
| Browserbase | Cloud browser for guided tasks a user starts | United States |
| Tavily, Serper, DataForSEO, YouTube Data API | Web search for research tasks (search queries only) | United States |
| HeyGen | Avatar videos, where switched on | United States |
If you connect your own AI provider key, your own agreement with that provider applies to those requests.
Services you choose to connect
When you connect one of these accounts, Colabi acts in it on your instructions. The service handles your data under its own terms with you, so it is not a Colabi sub-processor: Google (Gmail, Calendar, Google Ads), Microsoft Outlook, Upwork, Xero, Zapier, Cronofy, Meta (Facebook, Instagram, Meta Ads) and LinkedIn.
Transfers outside Australia
Where these providers process data outside Australia, they commit by contract to protect it. For data covered by the GDPR or UK GDPR we rely on the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, or the EU-US Data Privacy Framework where the provider is certified.
Questions or objections to a new sub-processor: support@colabi.co.
Last updated 11 October 2026.