We engage the following sub-processors to operate the Service. Customers with an executed DPA(Business + Enterprise) receive at least 30 days’ email notice to their billing contact before any addition or material change.
| Sub-processor | Purpose | Jurisdiction | Data categories |
|---|---|---|---|
| Anthropic, PBC | Claude LLM inference for agent + synthesis runtime | United States | Conversation content, Agent context library, User prompts |
| Amazon Web Services, Inc. | S3 storage for memo PDFs, invoice PDFs, file uploads | United States / India (ap-south-1) | File uploads, Generated PDFs |
| Razorpay Software Pvt Ltd | Payment processing for INR-denominated subscriptions | India | Billing email, Tenant name, GST details |
| Stripe Payments Europe, Ltd. | Payment processing for USD-denominated subscriptions | Ireland / United States | Billing email, Tenant name, Card last-4 (tokenised) |
| Microsoft Corporation (Graph) | Transactional email delivery (invites, password reset, dunning, invoice receipts) | United States / European Union | User email, Tenant display name, Email body content |
| Functional Software, Inc. (Sentry) | Error monitoring and platform observability | United States | Tenant ID (UUID), User ID (UUID), Stack traces (PII-redacted) |
| Hostinger International Ltd | VPS hosting and the primary PostgreSQL database (all tenant application data) | India (Mumbai) | All tenant application data, Conversations and memos, Context library, Account and billing records |
| Infisical, Inc. | Secrets management (DB connection strings, API keys, JWT private keys) | United States | Encrypted platform secrets only (no tenant data) |
Change notifications
For Customers with an executed DPA, we will email the billing contact at least 30 days before adding a new sub-processor or materially changing an existing one. Those Customers may object during that window; if we cannot accommodate the objection, the Customer may terminate without penalty for the unused portion of the subscription. This is currently a manual notification process, not an automated one.