Data processing agreement

This is the structure of the agreement we enter into with every customer under the Digital Personal Data Protection Act 2023, together with the three annexes that are generated from the running system rather than written by hand. It is not legal advice, and it is not itself a signed contract.

Not yet signable — one open item

Our own registered legal name appears in every generated copy as [Provider Legal Name — pending counsel-approved registration details]. Counsel has not yet supplied the registration details, so a downloaded copy is a review draft, not an executable agreement. We would rather say so here than ship a document that looks final.

Clauses

1. Parties and roles: The customer is the Data Fiduciary. We are the Data Processor, acting only on the customer's documented instructions.
2. Subject matter, duration, nature and purpose: Human resources, payroll, recruitment and employee engagement processing, for as long as the customer's subscription runs.
3. Data principals and categories of personal data: Employees, candidates, dependants and agency users; including financial data, leave and health-adjacent data, attendance selfies and government identifiers.
4. Processor obligations: Process only on documented instructions; confidentiality; the security measures in Annex B; the sub-processor list and 30-day change notice in Annex C; assistance with data principal rights; breach notification to the customer within 24 hours; deletion or return at termination, subject to statutory holds; audit and information rights.
5. Data residency and cross-border transfers: Primary application data is held in India, on the cloud hosting provider listed in Annex C. Some processing happens outside India: documents are stored in Cloudflare R2, AI requests go to the active AI provider, and email, WhatsApp and device notifications are delivered by their providers. Annex C lists every sub-processor with where it processes data and its jurisdiction.
6. Retention schedule and automated purge: The per-category schedule in Annex D, enforced by a scheduled purge job that writes to the audit log.
7. Liability and indemnities: To be negotiated per contract.
8. Annexes: A processing details; B technical and organisational measures; C sub-processors; D retention schedule.

Annex B — technical and organisational measures

Postgres Row-Level Security on every tenant table, enforced for the application role, with an automated cross-tenant isolation test suite.
TLS 1.2+ in transit; disk encryption at rest; field-level AES-256-GCM envelope encryption for PAN, Aadhaar, passport, bank account number, UAN, ESI number and date of birth.
Two-factor authentication (TOTP with single-use recovery codes), breached-password checks against the Have I Been Pwned k-anonymity range API, and step-up re-authentication for sensitive administrative actions including role changes, PII unmasking, bank file downloads and bulk exports.
Role-based access control with data scopes (self/reports/unit/location/entity/tenant) and time-bound delegations.
Append-only, hash-chained audit log covering sensitive reads (PII unmask, bank file downloads) and every write to a sensitive resource, independently verifiable (`pnpm audit:verify`).
Upload malware scanning (ClamAV, self-hosted), MIME allowlists and size caps on every file upload.
Continuous WAL archiving and nightly encrypted backups with a monthly restore drill.
AI untrusted-content isolation, tool allowlists narrowed to the acting user, human approval gates, per-tenant budgets and kill switches, with full traces of every model run and every action taken.

Annex C — sub-processors

Version 2026-10-11.1, effective 2026-10-11. The standalone list, with its change history, is at /legal/sub-processors.

Sub-processors, version 2026-10-11.1, effective 2026-10-11
Sub-processor	What we use it for	Data it may process	Where it processes	When it applies
Cloudflare, Inc.Listed since 2026-09-19	Object storage (R2) for generated documents, resumes and exports; CDN, DNS proxy and edge rate-limiting/WAF in front of the application.	Uploaded/generated documents (offer letters, payslips, resumes, exports) HTTP request metadata (IP address, user agent) at the edge	Cloudflare global network / object storage region (no India region guarantee — see caveat)Governed by the law of United States (Cloudflare, Inc.)	Always in use
Open item — Cloudflare, Inc.: D21 verbatim: primary data resides in India (VPS region); Cloudflare R2 has no India jurisdiction guarantee. R2 is used only for documents/resumes/exports, never as the primary datastore — this is disclosed to every tenant, not a silent gap.
Anthropic, PBCListed since 2026-09-25	Large-language-model inference for AI agents (HR helpdesk, drafting assistants, insights/NL-to-SQL, payroll pre-flight review, etc.).	Prompts and tool-call context sent to the model. Before each agent request, identifiers in the text the agent is given — PAN, Aadhaar and Virtual ID, bank account number and IFSC, UAN, passport number, phone number, email address and a labelled date of birth — are replaced with placeholders (D23); the real value is put back only inside our own systems when an action needs it. Names, addresses and other details a person writes in their own words are not removed, and records the agent looks up with the user's permissions are sent as the product returns them (identifiers masked where the product masks them) Tenant policy documents and knowledge-base content used as retrieval/context	United StatesGoverned by the law of United States (Anthropic, PBC)	Always in use
Open item — Anthropic, PBC: D21: default 30-day data retention at the provider for the models in use; Zero Data Retention is to be requested commercially before the first enterprise contract — not yet in place.
Google LLC (Gemini API)Listed since 2026-09-25	Large-language-model inference for AI agents and text embeddings for semantic search — the same work as the Anthropic and Voyage AI entries, when the platform is configured to use Gemini instead of them.	Prompts and tool-call context sent to the model, with the same identifier redaction as the Anthropic entry (the redaction happens before the provider is chosen, so it is identical for both) Tenant policy documents and knowledge-base content used as retrieval/context Resume and document text submitted for embedding (may contain candidate/employee PII depending on document content)	Global (Google infrastructure; no India region is configured)Governed by the law of United States (Google LLC)	Always in use
Open item — Google LLC (Gemini API): One AI provider is active at a time, chosen by the platform operator (AI_PROVIDER): while Anthropic is configured no data reaches Gemini, and while Gemini is configured it receives every tenant's AI requests. Provider-side retention and use terms are Google's paid Gemini API terms; a zero-data-retention arrangement is not in place.
Voyage AI, Inc.Listed since 2026-09-19	Text embeddings for semantic candidate/document search (pgvector-backed).	Resume and document text submitted for embedding (may contain candidate/employee PII depending on document content)	United StatesGoverned by the law of United States (Voyage AI, Inc.)	Always in use
Meta Platforms, Inc. (WhatsApp Business Cloud API)Listed since 2026-09-19	WhatsApp messaging: attendance check-in/out, candidate engagement, employee notifications, conversational agent channel.	Phone numbers Message content Attendance check-in/out timestamps and, where enabled, geo-location	Global (Meta infrastructure)Governed by the law of United States (Meta Platforms, Inc.)	Always in use
Resend (Resend, Inc.)Listed since 2026-10-08	Transactional and bulk outbound email delivery.	Email addresses Email content (notifications, letters, digests)	United StatesGoverned by the law of United States (Resend, Inc.)	Always in use
Open item — Resend (Resend, Inc.): One email provider is active at a time, chosen by the platform operator (EMAIL_PROVIDER): Resend or Brevo. D54 names Brevo for production; Resend remains supported and is still the only path for inbound email (HR inbox, apply-by-email).
Brevo (Sendinblue SAS)Listed since 2026-10-08	Transactional and bulk outbound email delivery — the production email provider named in D54, used when the platform is configured for it instead of Resend.	Email addresses Email content (notifications, letters, digests, sign-in and invitation links) Delivery events (delivered, bounced, complained)	European UnionGoverned by the law of France (Sendinblue SAS)	Always in use
Open item — Brevo (Sendinblue SAS): One email provider is active at a time (EMAIL_PROVIDER). While Resend is configured no data reaches Brevo; while Brevo is configured it receives every outbound email.
MSG91 (Bhutani Infotech Pvt. Ltd.)Listed since 2026-09-19	SMS delivery: OTP fallback and notices for blue/grey-collar employees without WhatsApp.	Phone numbers SMS message content (OTPs, notices)	IndiaGoverned by the law of India (Bhutani Infotech Pvt. Ltd.)	Always in use
Digio (Esignly Digital Signature Solutions / Digio.in)Listed since 2026-09-19	Aadhaar-based e-signature for offer letters and contracts, where a tenant enables it.	Document content being signed Signer name, email/phone Aadhaar e-sign audit trail (UIDAI flow — Digio does not receive the raw Aadhaar number from us)	IndiaGoverned by the law of India	Only if you turn it on
Sentry (Functional Software, Inc.) — or self-hosted GlitchTipListed since 2026-09-19	Application error/exception monitoring.	Stack traces and request metadata (URLs, non-secret headers) Pino's redact-path fields (D20) are stripped before any log reaches this pipeline, but an unhandled exception's own message/context is not guaranteed free of incidental PII	Depends on deployment choice — Sentry SaaS (region per account settings) or self-hosted GlitchTip on our own India VPSGoverned by the law of United States (Functional Software, Inc.) if SaaS Sentry is used; India if self-hosted GlitchTip is used	Always in use
Open item — Sentry (Functional Software, Inc.) — or self-hosted GlitchTip: D32 leaves the SaaS-vs-self-hosted choice open ('SaaS free tier or self-hosted GlitchTip'). This registry cannot state which one is deployed without checking the live environment configuration — treat the jurisdiction as SaaS/US unless the deployment is confirmed self-hosted.
Face++ (Megvii Technology Limited)Listed since 2026-09-19	Biometric face-match verification of attendance check-in selfies, where a tenant enables face-match attendance.	Facial images submitted for comparison (D21's `biometric_attendance` consent purpose)	Not independently confirmed — Face++'s public API documentation does not commit to a specific processing regionGoverned by the law of China (Megvii Technology Limited)	Only if you turn it on
Open item — Face++ (Megvii Technology Limited): NOT part of D21's original disclosed sub-processor list — added here after verifying packages/integrations/src/face-match/faceplusplus-client.ts (T5.12, D28) actually sends selfie images to this vendor. China has no DPDP adequacy determination and this flow has not had a documented cross-border-transfer risk assessment. Flagged as an open compliance gap (see this file's class doc comment, finding 1) — recommend the owner review before any tenant is allowed to enable face-match attendance, or replace the vendor.
DigiLocker / Meripehchaan (Government of India, NeGD)Listed since 2026-09-19	Fetching a candidate/employee's own government-issued identity documents, at their own instruction, for onboarding/verification.	Government-issued identity documents (Aadhaar, PAN, etc.) the individual chooses to share	IndiaGoverned by the law of India (Government of India)	Only at the person's own request
Google LLC (Calendar API, OAuth)Listed since 2026-09-19	Interviewer's own Google Calendar free/busy lookup and interview event creation, where an interviewer connects their calendar.	Interview participant names/emails Meeting subject/time/location	Global (Google infrastructure)Governed by the law of United States (Google LLC)	Only if you turn it on
Microsoft Corporation (Graph API / Teams / Calendar, OAuth)Listed since 2026-10-11	Interviewer's own Microsoft 365 Calendar/Teams free-busy lookup and meeting creation, optional Teams notification channel, and optional approvals in Teams through the tenant's own Azure Bot, where enabled.	Interview participant names/emails Meeting subject/time/location Notification message content (Teams channel, if connected) Approval request summaries (requester name, leave dates and type, or claim amount) sent to the approver's own Teams chat with the tenant's bot Microsoft Entra object ID of each person who links their Teams account	Global / tenant's chosen Microsoft 365 regionGoverned by the law of United States (Microsoft Corporation)	Only if you turn it on
Slack Technologies, LLC (a Salesforce company)Listed since 2026-10-11	Optional tenant HR notification channel (Incoming Webhook), and optional approvals in Slack: where a tenant connects its own Slack app, approvers who link their Slack account receive approval requests as a direct message and decide them with buttons.	Notification message content (e.g. alerts) posted to the tenant's chosen channel Approval request summaries (requester name, leave dates and type, or claim amount) sent to the approver's own Slack direct messages Slack member ID of each person who links their account	United StatesGoverned by the law of United States (Slack Technologies, LLC)	Only if you turn it on
RazorpayX (Razorpay Software Pvt. Ltd.)Listed since 2026-09-19	Optional automated salary/reimbursement bank payouts, where a tenant enables payout automation instead of a manual bank file.	Bank account number, IFSC Employee name Payout amount and narration	IndiaGoverned by the law of India (Razorpay Software Pvt. Ltd.)	Only if you turn it on
Cashfree Payments (Cashfree Payments India Pvt. Ltd.)Listed since 2026-09-19	Optional automated salary/reimbursement bank payouts — alternative provider to RazorpayX, where a tenant selects it.	Bank account number, IFSC Employee name Payout amount and narration	IndiaGoverned by the law of India (Cashfree Payments India Pvt. Ltd.)	Only if you turn it on
Speech-to-text provider — selection pending (no provider engaged yet)Listed since 2026-10-07	Turning a short voice clip, recorded only while a user holds the microphone button, into text in the AI assistant's message box. Not in use yet: the provider will be chosen after an accuracy and data-residency evaluation, and this entry will then name it.	Short voice recordings (up to 30 seconds) a user chooses to make; passed through to the provider and never stored by us The resulting text transcript, returned only to that user's own message box	Not applicable until a provider is selected — voice input is off and no audio leaves our serversGoverned by the law of Not applicable until a provider is selected	Only at the person's own request
Open item — Speech-to-text provider — selection pending (no provider engaged yet): Placeholder: no speech-to-text provider has been selected, voice input is switched off in every deployment, and no audio reaches any vendor. Before voice input is switched on, this entry will name the provider, where it processes audio and its jurisdiction, with the usual change notice.
Cloud hosting provider — Amazon Web Services, Inc. or Oracle Corporation (Oracle Cloud Infrastructure), per deploymentListed since 2026-10-08	The virtual machine the application runs on: the primary database, cache, background jobs, malware scanning and backup working copies, in an Indian region.	All application data held in the primary database (employee, candidate, payroll and HR records) Server logs and request metadata	India (AWS Mumbai or Hyderabad region, or Oracle Cloud Mumbai or Hyderabad region)Governed by the law of United States (Amazon Web Services, Inc. or Oracle Corporation)	Always in use
Open item — Cloud hosting provider — Amazon Web Services, Inc. or Oracle Corporation (Oracle Cloud Infrastructure), per deployment: D54 allows either cloud. This entry will name the one in use, with the usual change notice, before the first customer goes live. Data stays in the Indian region either way.
Browser push services — Google LLC (Firebase Cloud Messaging), Mozilla Corporation, Apple Inc., Microsoft Corporation (Windows Push Notification Services)Listed since 2026-10-08	Delivering notifications to a device where a person has turned notifications on. The service used is the one the person's own browser chose (Chrome/Edge on Android: Google; Firefox: Mozilla; Safari: Apple; Edge on Windows: Microsoft).	The device's push address (subscription endpoint) and delivery timing The notification itself, end-to-end encrypted to the device (RFC 8291) — the push service cannot read it	Global (each vendor's infrastructure)Governed by the law of United States (Google LLC, Mozilla Corporation, Apple Inc., Microsoft Corporation)	Only at the person's own request
Zoho Corporation Pvt. Ltd. (Zoho Books)Listed since 2026-10-08	Posting payroll and expense journals to the tenant's own Zoho Books organisation, where a tenant turns the accounting sync on.	Journal entries for finalised payroll runs and settled expense claims: ledger totals and narrations An expense claim's narration can include the employee's name or code	The Zoho data centre the tenant's Zoho Books organisation uses (India, US, EU and others)Governed by the law of India (Zoho Corporation Pvt. Ltd.)	Only if you turn it on
Open item — Zoho Corporation Pvt. Ltd. (Zoho Books): A Tally sync, the other accounting option, posts only to the tenant's own Tally installation; Tally Solutions does not receive the data, so it is not a sub-processor.
Leegality (Grey Swift Pvt. Ltd.)Listed since 2026-10-08	Digital-signature-certificate signing of Form 16 and, as an alternative to Digio, Aadhaar e-signature, where a tenant connects its own Leegality account.	Document content being signed (Form 16 tax certificates, letters) Signer name, email/phone	IndiaGoverned by the law of India (Grey Swift Pvt. Ltd.)	Only if you turn it on
Open item — Leegality (Grey Swift Pvt. Ltd.): Integrated but not yet run against a live Leegality account; no data reaches Leegality until a tenant connects its own account.
SpringVerify (legal entity to be confirmed from the customer's contract)Listed since 2026-10-08	Background verification checks on a candidate or new joiner, where a tenant connects its own SpringVerify account.	Identity details and identity documents of the person being verified Contact details, address, education and employment history submitted for checks Check results	IndiaGoverned by the law of India	Only if you turn it on
Open item — SpringVerify (legal entity to be confirmed from the customer's contract): The connector has not been run against a live account; no data reaches the provider until a tenant connects its own account.
AuthBridge Research Services Pvt. Ltd.Listed since 2026-10-08	Background verification checks on a candidate or new joiner, where a tenant connects its own AuthBridge account.	Identity details and identity documents of the person being verified Contact details, address, education and employment history submitted for checks Check results	IndiaGoverned by the law of India (AuthBridge Research Services Pvt. Ltd.)	Only if you turn it on
Open item — AuthBridge Research Services Pvt. Ltd.: The connector has not been run against a live account; no data reaches the provider until a tenant connects its own account.
OnGrid (legal entity to be confirmed from the customer's contract)Listed since 2026-10-08	Background verification checks on a candidate or new joiner, where a tenant connects its own OnGrid account.	Identity details and identity documents of the person being verified Contact details, address, education and employment history submitted for checks Check results	IndiaGoverned by the law of India	Only if you turn it on
Open item — OnGrid (legal entity to be confirmed from the customer's contract): The connector has not been run against a live account; no data reaches the provider until a tenant connects its own account.

Annex D — retention schedule

Platform defaults. A workspace can shorten any of these; statutory categories cannot be shortened below the period the law requires.

Category	Retained for	Then
candidate inactive	365 days	anonymise
candidate rejected	365 days	anonymise
employee exited core	2920 days	delete
employee exited payroll	Not auto-purged	Held — statutory or audit obligation
attendance raw	1095 days	delete
ai conversations	90 days	delete
notifications	365 days	delete
audit	Not auto-purged	Held — statutory or audit obligation
inbound messages	365 days	delete
helpdesk tickets	1095 days	anonymise