WorkApproved sub-processors
Last updated: 8 October 2026
WorkApproved is run by Stone Pritchard Limited. These are the providers that handle customers' personal information for us (our "sub-processors"), what they do, and where. This list is referred to in our Terms of Service (Schedule 1) and Privacy Policy.
Changes. We'll give customers at least 30 days' notice before adding a sub-processor or changing what one does, by email to account administrators and by updating this page.
| Provider | What it does for us | What it handles | Where |
|---|---|---|---|
| Laravel Cloud (Laravel) | Runs the application, queue and database | All approval data and account data | Sydney, Australia |
| Amazon Web Services | The infrastructure under Laravel Cloud | As above, in encrypted storage | Sydney, Australia (ap-southeast-2). |
| Cloudflare: delivery and DNS | Sits in front of the app: caching, security, DNS, bot protection (Turnstile) | Traffic to and from the service, including IP addresses | Worldwide network (traffic is handled at the nearest data centre) |
| Cloudflare: R2 storage | Stores attachments, certificates and partner logos in a private bucket | Files from customers' Xero documents, which may contain personal information | Cloudflare doesn't guarantee the location of R2 storage |
| Cloudflare: Pages | Hosts our marketing website | Website visit logs and cookieless visit statistics (Cloudflare Web Analytics); no customer data | Worldwide network |
| Cloudflare: Email Routing | Forwards mail sent to our workapproved.app addresses (hello@, security@) and, once switched on, handles replies to approval emails | Senders' names, email addresses and message content | Worldwide network |
| Resend | Sends our emails: approval requests, invitations, alerts, password resets | Recipient name and email address, and the email content (for example a document's supplier, amount and reference). Open and click tracking are off. | Resend is a US company. It sends via Amazon SES in Tokyo, Japan (ap-northeast-1) |
| Stripe | Card payments, subscriptions, invoicing support, tax calculation (Stripe Tax) | Billing contact, company, address, tax number, card details (held by Stripe, not us), payment history | Stripe processes in several countries, including the United States. Stripe also acts for itself in some cases (fraud prevention, legal duties), under its own privacy policy. |
| Microsoft (Outlook.com) | Receives and stores support emails | Support correspondence | Microsoft's data centres. We don't choose the location. |
| MBIE (Ministry of Business, Innovation & Employment, New Zealand Government) | A source we query, not a processor: public business-register lookups (the Companies Register and the NZBN Register) for organisations in New Zealand | The NZBN or business name we look up, taken from a customer's Xero contact. It holds no customer data for us. | New Zealand |
Not our sub-processor, but part of the picture
Xero (Xero Limited). The customer's own accounting system. The customer connects it, and we read from it and write to it on the customer's instruction. Xero holds that data under the customer's agreement with Xero, not ours.
Not on the list on purpose
We don't send customer data to AI model providers, advertising networks or analytics services. The only analytics on our marketing website is Cloudflare's cookieless visit counting, which holds no customer data.
Questions: [email protected].