Sub-processors

Under the Digital Personal Data Protection Act 2023, our customers are the Data Fiduciary and we are their Data Processor. The companies below process personal data on our customers’ behalf when they use HCM Suite. This list is the one we maintain against the code that actually calls them, not a marketing summary.

Primary application data is held in India. Documents, resumes and exports are stored in object storage that carries no India jurisdiction guarantee, and one biometric feature sends data outside India with no adequacy assessment behind it. Both are stated in the table rather than left for you to discover.

Sub-processors, version 2026-10-11.1, effective 2026-10-11
Sub-processor	What we use it for	Data it may process	Where it processes	When it applies
Cloudflare, Inc.Listed since 2026-09-19	Object storage (R2) for generated documents, resumes and exports; CDN, DNS proxy and edge rate-limiting/WAF in front of the application.	Uploaded/generated documents (offer letters, payslips, resumes, exports) HTTP request metadata (IP address, user agent) at the edge	Cloudflare global network / object storage region (no India region guarantee — see caveat)Governed by the law of United States (Cloudflare, Inc.)	Always in use
Open item — Cloudflare, Inc.: D21 verbatim: primary data resides in India (VPS region); Cloudflare R2 has no India jurisdiction guarantee. R2 is used only for documents/resumes/exports, never as the primary datastore — this is disclosed to every tenant, not a silent gap.
Anthropic, PBCListed since 2026-09-25	Large-language-model inference for AI agents (HR helpdesk, drafting assistants, insights/NL-to-SQL, payroll pre-flight review, etc.).	Prompts and tool-call context sent to the model. Before each agent request, identifiers in the text the agent is given — PAN, Aadhaar and Virtual ID, bank account number and IFSC, UAN, passport number, phone number, email address and a labelled date of birth — are replaced with placeholders (D23); the real value is put back only inside our own systems when an action needs it. Names, addresses and other details a person writes in their own words are not removed, and records the agent looks up with the user's permissions are sent as the product returns them (identifiers masked where the product masks them) Tenant policy documents and knowledge-base content used as retrieval/context	United StatesGoverned by the law of United States (Anthropic, PBC)	Always in use
Open item — Anthropic, PBC: D21: default 30-day data retention at the provider for the models in use; Zero Data Retention is to be requested commercially before the first enterprise contract — not yet in place.
Google LLC (Gemini API)Listed since 2026-09-25	Large-language-model inference for AI agents and text embeddings for semantic search — the same work as the Anthropic and Voyage AI entries, when the platform is configured to use Gemini instead of them.	Prompts and tool-call context sent to the model, with the same identifier redaction as the Anthropic entry (the redaction happens before the provider is chosen, so it is identical for both) Tenant policy documents and knowledge-base content used as retrieval/context Resume and document text submitted for embedding (may contain candidate/employee PII depending on document content)	Global (Google infrastructure; no India region is configured)Governed by the law of United States (Google LLC)	Always in use
Open item — Google LLC (Gemini API): One AI provider is active at a time, chosen by the platform operator (AI_PROVIDER): while Anthropic is configured no data reaches Gemini, and while Gemini is configured it receives every tenant's AI requests. Provider-side retention and use terms are Google's paid Gemini API terms; a zero-data-retention arrangement is not in place.
Voyage AI, Inc.Listed since 2026-09-19	Text embeddings for semantic candidate/document search (pgvector-backed).	Resume and document text submitted for embedding (may contain candidate/employee PII depending on document content)	United StatesGoverned by the law of United States (Voyage AI, Inc.)	Always in use
Meta Platforms, Inc. (WhatsApp Business Cloud API)Listed since 2026-09-19	WhatsApp messaging: attendance check-in/out, candidate engagement, employee notifications, conversational agent channel.	Phone numbers Message content Attendance check-in/out timestamps and, where enabled, geo-location	Global (Meta infrastructure)Governed by the law of United States (Meta Platforms, Inc.)	Always in use
Resend (Resend, Inc.)Listed since 2026-10-08	Transactional and bulk outbound email delivery.	Email addresses Email content (notifications, letters, digests)	United StatesGoverned by the law of United States (Resend, Inc.)	Always in use
Open item — Resend (Resend, Inc.): One email provider is active at a time, chosen by the platform operator (EMAIL_PROVIDER): Resend or Brevo. D54 names Brevo for production; Resend remains supported and is still the only path for inbound email (HR inbox, apply-by-email).
Brevo (Sendinblue SAS)Listed since 2026-10-08	Transactional and bulk outbound email delivery — the production email provider named in D54, used when the platform is configured for it instead of Resend.	Email addresses Email content (notifications, letters, digests, sign-in and invitation links) Delivery events (delivered, bounced, complained)	European UnionGoverned by the law of France (Sendinblue SAS)	Always in use
Open item — Brevo (Sendinblue SAS): One email provider is active at a time (EMAIL_PROVIDER). While Resend is configured no data reaches Brevo; while Brevo is configured it receives every outbound email.
MSG91 (Bhutani Infotech Pvt. Ltd.)Listed since 2026-09-19	SMS delivery: OTP fallback and notices for blue/grey-collar employees without WhatsApp.	Phone numbers SMS message content (OTPs, notices)	IndiaGoverned by the law of India (Bhutani Infotech Pvt. Ltd.)	Always in use
Digio (Esignly Digital Signature Solutions / Digio.in)Listed since 2026-09-19	Aadhaar-based e-signature for offer letters and contracts, where a tenant enables it.	Document content being signed Signer name, email/phone Aadhaar e-sign audit trail (UIDAI flow — Digio does not receive the raw Aadhaar number from us)	IndiaGoverned by the law of India	Only if you turn it on
Sentry (Functional Software, Inc.) — or self-hosted GlitchTipListed since 2026-09-19	Application error/exception monitoring.	Stack traces and request metadata (URLs, non-secret headers) Pino's redact-path fields (D20) are stripped before any log reaches this pipeline, but an unhandled exception's own message/context is not guaranteed free of incidental PII	Depends on deployment choice — Sentry SaaS (region per account settings) or self-hosted GlitchTip on our own India VPSGoverned by the law of United States (Functional Software, Inc.) if SaaS Sentry is used; India if self-hosted GlitchTip is used	Always in use
Open item — Sentry (Functional Software, Inc.) — or self-hosted GlitchTip: D32 leaves the SaaS-vs-self-hosted choice open ('SaaS free tier or self-hosted GlitchTip'). This registry cannot state which one is deployed without checking the live environment configuration — treat the jurisdiction as SaaS/US unless the deployment is confirmed self-hosted.
Face++ (Megvii Technology Limited)Listed since 2026-09-19	Biometric face-match verification of attendance check-in selfies, where a tenant enables face-match attendance.	Facial images submitted for comparison (D21's `biometric_attendance` consent purpose)	Not independently confirmed — Face++'s public API documentation does not commit to a specific processing regionGoverned by the law of China (Megvii Technology Limited)	Only if you turn it on
Open item — Face++ (Megvii Technology Limited): NOT part of D21's original disclosed sub-processor list — added here after verifying packages/integrations/src/face-match/faceplusplus-client.ts (T5.12, D28) actually sends selfie images to this vendor. China has no DPDP adequacy determination and this flow has not had a documented cross-border-transfer risk assessment. Flagged as an open compliance gap (see this file's class doc comment, finding 1) — recommend the owner review before any tenant is allowed to enable face-match attendance, or replace the vendor.
DigiLocker / Meripehchaan (Government of India, NeGD)Listed since 2026-09-19	Fetching a candidate/employee's own government-issued identity documents, at their own instruction, for onboarding/verification.	Government-issued identity documents (Aadhaar, PAN, etc.) the individual chooses to share	IndiaGoverned by the law of India (Government of India)	Only at the person's own request
Google LLC (Calendar API, OAuth)Listed since 2026-09-19	Interviewer's own Google Calendar free/busy lookup and interview event creation, where an interviewer connects their calendar.	Interview participant names/emails Meeting subject/time/location	Global (Google infrastructure)Governed by the law of United States (Google LLC)	Only if you turn it on
Microsoft Corporation (Graph API / Teams / Calendar, OAuth)Listed since 2026-10-11	Interviewer's own Microsoft 365 Calendar/Teams free-busy lookup and meeting creation, optional Teams notification channel, and optional approvals in Teams through the tenant's own Azure Bot, where enabled.	Interview participant names/emails Meeting subject/time/location Notification message content (Teams channel, if connected) Approval request summaries (requester name, leave dates and type, or claim amount) sent to the approver's own Teams chat with the tenant's bot Microsoft Entra object ID of each person who links their Teams account	Global / tenant's chosen Microsoft 365 regionGoverned by the law of United States (Microsoft Corporation)	Only if you turn it on
Slack Technologies, LLC (a Salesforce company)Listed since 2026-10-11	Optional tenant HR notification channel (Incoming Webhook), and optional approvals in Slack: where a tenant connects its own Slack app, approvers who link their Slack account receive approval requests as a direct message and decide them with buttons.	Notification message content (e.g. alerts) posted to the tenant's chosen channel Approval request summaries (requester name, leave dates and type, or claim amount) sent to the approver's own Slack direct messages Slack member ID of each person who links their account	United StatesGoverned by the law of United States (Slack Technologies, LLC)	Only if you turn it on
RazorpayX (Razorpay Software Pvt. Ltd.)Listed since 2026-09-19	Optional automated salary/reimbursement bank payouts, where a tenant enables payout automation instead of a manual bank file.	Bank account number, IFSC Employee name Payout amount and narration	IndiaGoverned by the law of India (Razorpay Software Pvt. Ltd.)	Only if you turn it on
Cashfree Payments (Cashfree Payments India Pvt. Ltd.)Listed since 2026-09-19	Optional automated salary/reimbursement bank payouts — alternative provider to RazorpayX, where a tenant selects it.	Bank account number, IFSC Employee name Payout amount and narration	IndiaGoverned by the law of India (Cashfree Payments India Pvt. Ltd.)	Only if you turn it on
Speech-to-text provider — selection pending (no provider engaged yet)Listed since 2026-10-07	Turning a short voice clip, recorded only while a user holds the microphone button, into text in the AI assistant's message box. Not in use yet: the provider will be chosen after an accuracy and data-residency evaluation, and this entry will then name it.	Short voice recordings (up to 30 seconds) a user chooses to make; passed through to the provider and never stored by us The resulting text transcript, returned only to that user's own message box	Not applicable until a provider is selected — voice input is off and no audio leaves our serversGoverned by the law of Not applicable until a provider is selected	Only at the person's own request
Open item — Speech-to-text provider — selection pending (no provider engaged yet): Placeholder: no speech-to-text provider has been selected, voice input is switched off in every deployment, and no audio reaches any vendor. Before voice input is switched on, this entry will name the provider, where it processes audio and its jurisdiction, with the usual change notice.
Cloud hosting provider — Amazon Web Services, Inc. or Oracle Corporation (Oracle Cloud Infrastructure), per deploymentListed since 2026-10-08	The virtual machine the application runs on: the primary database, cache, background jobs, malware scanning and backup working copies, in an Indian region.	All application data held in the primary database (employee, candidate, payroll and HR records) Server logs and request metadata	India (AWS Mumbai or Hyderabad region, or Oracle Cloud Mumbai or Hyderabad region)Governed by the law of United States (Amazon Web Services, Inc. or Oracle Corporation)	Always in use
Open item — Cloud hosting provider — Amazon Web Services, Inc. or Oracle Corporation (Oracle Cloud Infrastructure), per deployment: D54 allows either cloud. This entry will name the one in use, with the usual change notice, before the first customer goes live. Data stays in the Indian region either way.
Browser push services — Google LLC (Firebase Cloud Messaging), Mozilla Corporation, Apple Inc., Microsoft Corporation (Windows Push Notification Services)Listed since 2026-10-08	Delivering notifications to a device where a person has turned notifications on. The service used is the one the person's own browser chose (Chrome/Edge on Android: Google; Firefox: Mozilla; Safari: Apple; Edge on Windows: Microsoft).	The device's push address (subscription endpoint) and delivery timing The notification itself, end-to-end encrypted to the device (RFC 8291) — the push service cannot read it	Global (each vendor's infrastructure)Governed by the law of United States (Google LLC, Mozilla Corporation, Apple Inc., Microsoft Corporation)	Only at the person's own request
Zoho Corporation Pvt. Ltd. (Zoho Books)Listed since 2026-10-08	Posting payroll and expense journals to the tenant's own Zoho Books organisation, where a tenant turns the accounting sync on.	Journal entries for finalised payroll runs and settled expense claims: ledger totals and narrations An expense claim's narration can include the employee's name or code	The Zoho data centre the tenant's Zoho Books organisation uses (India, US, EU and others)Governed by the law of India (Zoho Corporation Pvt. Ltd.)	Only if you turn it on
Open item — Zoho Corporation Pvt. Ltd. (Zoho Books): A Tally sync, the other accounting option, posts only to the tenant's own Tally installation; Tally Solutions does not receive the data, so it is not a sub-processor.
Leegality (Grey Swift Pvt. Ltd.)Listed since 2026-10-08	Digital-signature-certificate signing of Form 16 and, as an alternative to Digio, Aadhaar e-signature, where a tenant connects its own Leegality account.	Document content being signed (Form 16 tax certificates, letters) Signer name, email/phone	IndiaGoverned by the law of India (Grey Swift Pvt. Ltd.)	Only if you turn it on
Open item — Leegality (Grey Swift Pvt. Ltd.): Integrated but not yet run against a live Leegality account; no data reaches Leegality until a tenant connects its own account.
SpringVerify (legal entity to be confirmed from the customer's contract)Listed since 2026-10-08	Background verification checks on a candidate or new joiner, where a tenant connects its own SpringVerify account.	Identity details and identity documents of the person being verified Contact details, address, education and employment history submitted for checks Check results	IndiaGoverned by the law of India	Only if you turn it on
Open item — SpringVerify (legal entity to be confirmed from the customer's contract): The connector has not been run against a live account; no data reaches the provider until a tenant connects its own account.
AuthBridge Research Services Pvt. Ltd.Listed since 2026-10-08	Background verification checks on a candidate or new joiner, where a tenant connects its own AuthBridge account.	Identity details and identity documents of the person being verified Contact details, address, education and employment history submitted for checks Check results	IndiaGoverned by the law of India (AuthBridge Research Services Pvt. Ltd.)	Only if you turn it on
Open item — AuthBridge Research Services Pvt. Ltd.: The connector has not been run against a live account; no data reaches the provider until a tenant connects its own account.
OnGrid (legal entity to be confirmed from the customer's contract)Listed since 2026-10-08	Background verification checks on a candidate or new joiner, where a tenant connects its own OnGrid account.	Identity details and identity documents of the person being verified Contact details, address, education and employment history submitted for checks Check results	IndiaGoverned by the law of India	Only if you turn it on
Open item — OnGrid (legal entity to be confirmed from the customer's contract): The connector has not been run against a live account; no data reaches the provider until a tenant connects its own account.

Changes to this list

This list is version 2026-10-11.1, effective 2026-10-11. We give 30 days’ notice before a new sub-processor starts processing your data.

2026-10-11.1 (2026-10-11) — Widened Slack and Microsoft (Teams): where a company connects its own Slack app or Teams bot for approvals, an approver who links their chat account receives approval requests (who asked, leave dates or claim amount) as a direct message, and their Slack member ID or Microsoft account ID is stored to deliver them (AD2145–AD2147).
2026-10-08.1 (2026-10-08) — Added the cloud hosting provider (Amazon Web Services or Oracle Cloud, India region), Brevo (email delivery, the intended production email provider), the browser push services that deliver device notifications (Google, Mozilla, Apple, Microsoft), Zoho (Zoho Books accounting sync, tenant opt-in), Leegality (digital signatures, now integrated, tenant opt-in) and three background-verification providers a tenant can connect (SpringVerify, AuthBridge, OnGrid). Clarified that a Tally sync posts only to the tenant's own Tally installation (audit 26-10-08 A21).
2026-10-07.1 (2026-10-07) — Added a placeholder entry for a speech-to-text provider for optional push-to-talk voice input. No provider has been selected and voice input is off, so no audio reaches any vendor; the entry will name the provider before voice input is switched on (audit 26-10-07 A21).
2026-09-25.1 (2026-09-25) — Added Google (Gemini API) as an AI inference and embeddings provider — used instead of Anthropic and Voyage AI when the platform is configured for Gemini. Corrected the Anthropic entry's description of personal-data minimisation to state exactly what is removed before a request is sent, and what is not (go-live AI A1).
2026-09-19.1 (2026-09-19) — Initial published sub-processor registry (T0.59, PLT-F26), reconciled against the real integration code as of this date.

Questions, or an objection to a sub-processor

Customers can raise either with their account contact. Our data processing agreement, including the sub-processor change-notice term, is summarised at /legal/dpa; workspace administrators can download a copy from Settings → Privacy.