Sub-processors
Sub-processors
Last updated: 17 October 2026
The third parties Ektasi Technology (OPC) Private Limited uses to process data on your behalf, what each one receives and where it operates. This page is the list referred to in our Privacy Policy and Data Processing Addendum.
1. What a sub-processor is
A sub-processor is a third party we engage to process personal data on our behalf in order to run the service — hosting, sending email, taking payments, generating AI output. Every sub-processor is bound by a written agreement requiring at least the protections in our Data Processing Addendum, and receives only the data needed for its purpose.
Integrations you connect yourself — a Google Workspace account, a meeting provider, a GST e-invoice portal, a social network — are not our sub-processors. You engage them directly, under their terms, on your own instruction; we act as the conduit.
2. Infrastructure, communications and payments
| Provider | Purpose | Data processed | Location |
|---|---|---|---|
| Ektasi-operated infrastructure | Application servers and the PostgreSQL database, in containers we administer on OVHcloud servers in Mumbai, reached through the Cloudflare tunnel below. | All account and workspace data. Stored credentials are encrypted with per-workspace keys; other rows are separated by database row-level isolation. | India |
| OVHcloud | The cloud servers we rent and administer: the application and database servers, and our own AI model server. | Everything stored on the application and database servers; on the AI model server, the prompts and content sent to an AI feature it answers. | India (Mumbai); France (Gravelines) for the AI model server |
| Cloudflare, Inc. | DNS, TLS termination, secure tunnel to our servers, CDN and web application firewall. | Request metadata — IP address, headers, URL — in transit. Cloudflare does not store your account or workspace content. | Global edge; US-headquartered |
| Amazon Web Services, Inc. — Amazon SES | Sending transactional email (sign-in, receipts, notifications) and, where a workspace uses the campaign module, marketing email on the workspace’s instruction. | Recipient address, subject and message body; delivery and bounce events. | Asia Pacific (Mumbai), ap-south-1 |
| S3-compatible object storage (AWS S3 or Cloudflare R2) | File and asset storage for workspaces, where file storage is enabled. | Files you upload to your workspace. | Region configured per deployment; India-first |
| Razorpay Software Private Limited | Payment processing for INR billing, UPI, cards and net-banking. | Name, email, billing details and payment instrument — handled by Razorpay directly; we store a token and the transaction reference, never card numbers. | India |
| Stripe, Inc. / Stripe Payments Europe Ltd | Payment processing for non-INR billing. | As for Razorpay — tokenised; card data never touches our servers. | US / Ireland |
| Upstash, Inc. | Serverless Redis used for rate limiting, anti-abuse throttles and short-lived operational counters. | IP addresses and workspace identifiers used as rate-limit keys, and request counters. No workspace content. | US-headquartered; region per deployment |
| PostHog, Inc. | Product usage events (marketplace licence activations), where a key is configured. | A user identifier and the event’s properties, such as a product id and domain. | US (default host) |
| Dropbox, Inc. | File storage for workspaces where Dropbox is the configured storage provider, and a destination for off-server copies of database backups where that is configured. | Files uploaded to a workspace; where backups are copied there, everything in the backup. | US |
| Google LLC — Google Analytics 4 and Tag Manager | Aggregate usage analytics for the public website. Loaded only after you accept analytics in the consent banner; never on the signed-in dashboard by default. | Pseudonymous usage events, truncated IP, device and page data. | Global; US-headquartered |
| Functional Software, Inc. — Sentry | Application error monitoring, where enabled. | Stack traces and request metadata. Auth tokens, keys and payload variables are scrubbed before transmission. | US |
3. Loaded by your browser
These third parties are not processors acting on our instruction, and they never receive your workspace database. They are listed because your browser contacts them directly when you use the feature named, which discloses your IP address to them.
| Provider | Purpose | Data processed | Location |
|---|---|---|---|
| unpkg.com (Cloudflare, Inc.) | Serves the drag-and-drop email builder library when a workspace opens the email builder. | The IP address and user-agent of the browser that opens the builder. | Global CDN |
| api.qrserver.com (goQR.me) | Renders the QR code in the dashboard’s QR tool from the text you type into it. | The text or URL you enter in the QR tool, and the browser’s IP address. | Germany |
| 8x8, Inc. — meet.jit.si (Jitsi Meet) | Hosts the video meeting when a workspace has not pointed the meetings module at its own Jitsi server. | Meeting room name, participant display names, and the audio and video of the meeting. | Global; US-headquartered |
4. AI model providers
AI providers only ever receive data when someone in your workspace uses an AI feature, and only the prompt and content submitted to that feature. We do not train models on your data, and we have no training or fine-tuning pipeline that reads workspace content; where a workspace itself uses the fine-tuning feature, that runs on the workspace’s own data under its own instruction.
Bring your own key: a workspace administrator may store their own API key for any of these providers in the encrypted secrets vault. Requests made with your key are processed under your agreement with that provider, not ours, and are billed by them to you.
| Provider | Purpose | Data processed | Location |
|---|---|---|---|
| Ektasi’s own AI model server | Open models for text, embeddings and speech on a GPU server we administer (hosted by OVHcloud, above), reached only over our private network. Prompts sent to it go to no AI vendor. | The prompt and the content you submit to an AI feature, and the model’s response. | France (Gravelines) |
| Microsoft Corporation — Azure OpenAI Service | Text generation for chat, writing and agents, on OpenAI models deployed in our own Azure resource. | As above. | India (South India); US-headquartered |
| OpenAI, L.L.C. | Text generation, embeddings, image generation and audio transcription, where configured or where a workspace uses its own OpenAI key. | As above. | US |
| Anthropic, PBC | Text generation for the build-and-design integration features, and as an alternative text provider. | As above. | US |
| Google LLC — Gemini API | Alternative text and multimodal provider, where selected. | As above. | US |
| OpenRouter, Inc. | Model broker routing a request to the downstream provider you select. We cannot guarantee the downstream provider’s terms; choose OpenRouter only if you accept that. | As above, forwarded to the chosen downstream provider. | US; downstream varies |
| Replicate, Inc. | Specialised image pipelines (faceswap, fashion, avatar) and video generation, where those features are enabled. | The image or prompt submitted to the feature, and the generated output. | US |
| Stability AI Ltd | Image generation, where selected instead of OpenAI. | The image prompt and the generated image. | UK / US |
5. Changes to this list
We post additions and replacements on this page with a new “last updated” date. Where a change affects tenant workspace data, we also notify workspace administrators by email at least 30 days before it takes effect, so you can object or export and terminate under the DPA before the new provider processes anything.
6. Questions
Ask rajan@ektasi.io for the current agreement with any provider listed here, or write to support@ektasi.io to exercise a data right that involves one of them.
This policy is published by the operator named above and is binding on the service it describes. It is not legal advice to you; take independent advice where your situation needs it.