Subprocessors.
We operate our own infrastructure. The subprocessor list is short because almost nothing leaves it — this page is the canonical, versioned inventory.
01 · Operating model
SecurityVault runs on dedicated infrastructure that we operate in India. The only third parties that process personal data on our behalf are at the network edge and in transactional email delivery. This page is the canonical subprocessor inventory referenced by our DPA and privacy notice.
02 · Subprocessor list
| Subprocessor | Purpose | Personal data touched | Region |
|---|---|---|---|
| Cloudflare, Inc. | DNS, TLS termination, DDoS protection and WAF for our public hostnames; cookieless page analytics (Cloudflare Web Analytics), only when a visitor turns it on | Visitor IP addresses and request metadata; page-view and performance data | Global edge |
| Zoho Corporation Pvt. Ltd. | Delivery of website form submissions (demo, access and privacy requests) to our mailboxes and of platform notification email | Name, work email, company, message text and the submitting IP address for website forms; recipient address and notification content for platform email. Held only for delivery. | India |
03 · What we do not use
No hyperscaler holds tenant data. No third-party analytics warehouse, no external observability SaaS, no CRM pixel on the product, no email-marketing platform with access to product data. AI features run on models hosted in our own infrastructure: customer content is never sent to a third-party AI provider, and models are never trained on customer data. If a category is absent from the table in section 02, it is not a gap in the list — it is a deliberate absence in the architecture.
04 · Change notification
Material changes to this list are announced at least 30 days in advance to customer security contacts and recorded on the changelog. Customers may object on reasonable data-protection grounds under the DPA; if we cannot resolve an objection, the affected service can be terminated with a pro-rata refund. Every subprocessor operates under a written data-processing agreement equivalent to our customer DPA, reviewed annually.