OnePlanner Subprocessors
This list is referenced by our Privacy Policy. We will give at least 14 days' notice before adding or replacing a subprocessor that will handle personal data, so Firms can raise any objection with us.
Last reviewed: October 7, 2026
| Subprocessor | Purpose | Data involved | Location |
|---|---|---|---|
| Microsoft Azure | Database hosting, authentication, AI-generated insights, AI-assisted search, report drafting | All account and client financial data stored in the platform; anonymised financial data submitted to AI features (fact-find, reports); search queries issued by AI features, not intended to include raw client PII | Malaysia |
| PostHog | Product analytics | No account or client financial data; usage/event data, page views, autocapture | United States |
| Google Sheets (service account) | Waitlist / demo request storage (landing page) | Name, email, phone submitted via the "Join Waitlist" form | United States |
| Google Analytics (GA4) | Web analytics (landing page only, separate from the CRM app) | No account or client financial data; website analytics data only (page views, events, device/browser info) on the marketing site | United States |
| Render | Application hosting | N/A (Application hosting only, no client data stored) | Singapore |
| Curlec (Razorpay Malaysia) | Billing Firms for subscriptions — FPX and card payments | Firm billing contact and payment details | Malaysia |
Curlec integration is in progress as of this writing — credentials and plan configuration exist but the checkout/webhook flow is not yet live in production. This table reflects the intended end state. See our Refund and Billing Policy for how billing is handled until then.
Every subprocessor that receives personal data transferred outside Malaysia needs a PDPA-compliant transfer basis (PDPA Section 129 — the destination country must have a comparable level of protection, or an exception applies, such as consent). PostHog and GA4 process analytics data only (not account or client financial data) on US infrastructure, and our waitlist storage (Google Sheets) is also US-based. Our hosting provider (Render) operates from Singapore and does not store client data. Microsoft Azure, which hosts our database and processes data submitted to AI features, is hosted in Malaysia.
Our key subprocessors maintain independent third-party security certifications (for example, SOC 2 Type II) as part of their own compliance programs. Documentation of a subprocessor's certifications can be requested at support@oneplannerapp.com.
See also our Security Policy.