Sub-processors
Sub-processors
Last updated: 5 September 2026
The third parties Ektasi Technology (OPC) Private Limited uses to process data on your behalf, what each one receives and where it operates. This page is the list referred to in our Privacy Policy and Data Processing Addendum.
1. What a sub-processor is
A sub-processor is a third party we engage to process personal data on our behalf in order to run the service — hosting, sending email, taking payments, generating AI output. Every sub-processor is bound by a written agreement requiring at least the protections in our Data Processing Addendum, and receives only the data needed for its purpose.
Integrations you connect yourself — a Google Workspace account, a meeting provider, a GST e-invoice portal, a social network — are not our sub-processors. You engage them directly, under their terms, on your own instruction; we act as the conduit.
2. Infrastructure, communications and payments
| Provider | Purpose | Data processed | Location |
|---|---|---|---|
| Ektasi-operated infrastructure | Application servers and the PostgreSQL database. Operated by us, in India, on hardware and containers we control — not a third-party PaaS. | All account and workspace data, encrypted at rest with per-tenant keys. | India |
| Cloudflare, Inc. | DNS, TLS termination, secure tunnel to our servers, CDN and web application firewall. | Request metadata — IP address, headers, URL — in transit. Cloudflare does not store your account or workspace content. | Global edge; US-headquartered |
| Amazon Web Services, Inc. — Amazon SES | Sending transactional email (sign-in, receipts, notifications) and, where a workspace uses the campaign module, marketing email on the workspace’s instruction. | Recipient address, subject and message body; delivery and bounce events. | Asia Pacific (Mumbai), ap-south-1 |
| S3-compatible object storage (AWS S3 or Cloudflare R2) | File and asset storage for workspaces, where file storage is enabled. | Files you upload to your workspace. | Region configured per deployment; India-first |
| Razorpay Software Private Limited | Payment processing for INR billing, UPI, cards and net-banking. | Name, email, billing details and payment instrument — handled by Razorpay directly; we store a token and the transaction reference, never card numbers. | India |
| Stripe, Inc. / Stripe Payments Europe Ltd | Payment processing for non-INR billing. | As for Razorpay — tokenised; card data never touches our servers. | US / Ireland |
| Google LLC — Google Fonts | Serves the typefaces used on the public website. | Your IP address and browser user-agent when the font files are requested. | Global |
| Google LLC — Google Analytics 4 and Tag Manager | Aggregate usage analytics for the public website. Loaded only after you accept analytics in the consent banner; never on the signed-in dashboard by default. | Pseudonymous usage events, truncated IP, device and page data. | Global; US-headquartered |
| Functional Software, Inc. — Sentry | Application error monitoring, where enabled. | Stack traces and request metadata. Auth tokens, keys and payload variables are scrubbed before transmission. | US |
3. AI model providers
AI providers only ever receive data when someone in your workspace uses an AI feature, and only the prompt and content submitted to that feature. We do not train models on your data, and we have no training or fine-tuning pipeline that reads workspace content; where a workspace itself uses the fine-tuning feature, that runs on the workspace’s own data under its own instruction.
Bring your own key: a workspace administrator may store their own API key for any of these providers in the encrypted secrets vault. Requests made with your key are processed under your agreement with that provider, not ours, and are billed by them to you.
| Provider | Purpose | Data processed | Location |
|---|---|---|---|
| OpenAI, L.L.C. | Default provider for text generation, embeddings, image generation and audio transcription. | The prompt and the content you submit to an AI feature, and the model’s response. | US |
| Anthropic, PBC | Text generation for the build-and-design integration features, and as an alternative text provider. | As above. | US |
| Google LLC — Gemini API | Alternative text and multimodal provider, where selected. | As above. | US |
| OpenRouter, Inc. | Model broker routing a request to the downstream provider you select. We cannot guarantee the downstream provider’s terms; choose OpenRouter only if you accept that. | As above, forwarded to the chosen downstream provider. | US; downstream varies |
| Stability AI Ltd | Image generation, where selected instead of OpenAI. | The image prompt and the generated image. | UK / US |
| Self-hosted model endpoint | An OpenAI-compatible endpoint operated by Ektasi, where configured for a deployment. Prompts do not leave our infrastructure in that case. | As above. | India |
4. Changes to this list
We post additions and replacements on this page with a new “last updated” date. Where a change affects tenant workspace data, we also notify workspace administrators by email at least 30 days before it takes effect, so you can object or export and terminate under the DPA before the new provider processes anything.
5. Questions
Ask [email protected] for the current agreement with any provider listed here, or write to [email protected] to exercise a data right that involves one of them.
This policy is published by the operator named above and is binding on the service it describes. It is not legal advice to you; take independent advice where your situation needs it.