4A Migration CloudSubprocessors
Last updated: 13 August 2026
The 4A Migration Cloud application is operated by 4A Consulting Services Pty Ltd (ABN 53 672 296 418). The organisations below may process personal information when a firm using the application enables the relevant feature. Most are user-connected (the firm authorises its own account) or firm-configured (the firm supplies its own key) — so data flows to the firm’s own account with that provider, not a shared 4A account. This page is referenced by our Privacy Policy.
| Subprocessor | Purpose | Data processed | Trigger | Region |
|---|---|---|---|---|
| IBM Cloud | Hosting, compute, database and storage | All application data | Always (infrastructure) | Sydney, Australia (au-syd) |
| OpenAI or Anthropic | AI assistant / text features (the firm chooses one and supplies its own API key) | De-identified free text only — never documents, images or identity data | Firm enables AI + supplies key | United States |
| Stripe | Card payments (consultation / booking) | Payer name, email and card data (handled by Stripe; card numbers are not stored by 4A) | Firm enables payments | United States / global |
| Gmail (send / read-to-file), Drive (matter files), Calendar | Email content and attachments (written to the firm's storage), files created, calendar events, account identity | Firm connects a Google account | Google (global) | |
| Microsoft | Outlook (send / read), OneDrive / SharePoint (files), Calendar | As above, for Microsoft 365 | Firm connects a Microsoft account | Microsoft (global) |
| Dropbox | Matter file storage | Matter documents the app creates | Firm connects Dropbox | United States / global |
| Zoho WorkDrive | Matter file storage | Matter documents the app creates | Firm connects Zoho | Configurable data centre |
| Xero | Accounting — issued-invoice sync | Invoice and contact details | Firm connects Xero | Australia / global |
| Adobe PDF Services | Optional PDF tooling | Document content being processed | Firm enables PDF tools + key | Adobe (global) |
| Ayrshare / Meta / TikTok | Optional social-media marketing posts | Marketing post content (no client personal information) | Firm connects social + key | Provider (global) |
| SMTP provider (firm-configured) | Transactional / client email delivery | Email content and recipient addresses | Firm sets SMTP credentials | Firm's chosen provider |
- AI is opt-in and de-identified. Documents, images and identity documents are never sent to any AI provider (extraction is performed locally). Firms select OpenAI or Anthropic and supply their own key.
- Connected accounts stay in the firm’s control. Email, cloud-storage and calendar data flow to the firm’s own account at the provider; the firm can disconnect at any time, which deletes the stored access token.
- No advertising, no data sale. No subprocessor is used for advertising, and Google/Microsoft data is not sold or used to train AI.
- Where a change to this list is material, we take reasonable steps to notify firms.