Sub-processors

To provide the SubhX Nexus platform (the “Service”), Subhx Infotech OPC Pvt Ltd (“Subhx”, “we”, “us” or “our”) engages a small number of trusted third parties as sub-processors. This page describes the categories of sub-processors we use, the purpose of each, the personal data they may process and their location. It supplements our Data Processing Agreement and Privacy Policy.

• We engage a sub-processor only where it is necessary to operate, secure, support or improve the Service.
• Each sub-processor is bound by a written agreement imposing data-protection and confidentiality obligations no less protective than those in our Data Processing Agreement.
• We assess the security and reliability of a sub-processor before engaging it and remain responsible to you for its performance.
• We share with each sub-processor only the data necessary for its specific function, and instruct it to process that data only to provide its service to us.

We describe our sub-processors by category below. The specific named providers within each category are maintained in a current list available on request — see Section 7.

Cloud hosting

Hosts the application servers, databases and networking on which the Service runs. May process all Customer Data as stored and transmitted through the Service. Location: India.

Object storage

Stores files and documents uploaded to the Service, such as onboarding documents and attachments. May process those files and their metadata. Location: India.

Transactional email and SMS

Delivers transactional messages such as one-time passcodes, invitations and notifications. May process recipient contact details and message content. Location: India, with limited onward routing as required to deliver messages.

Push notification

Delivers push notifications to mobile and web clients. May process device tokens and notification content. Location: services may route through provider infrastructure outside India subject to appropriate safeguards.

Error and performance monitoring

Helps us detect, diagnose and fix errors and performance issues. May process limited technical and diagnostic data; configured to minimise the personal data it receives. Location: India where available, otherwise subject to appropriate safeguards.

Where a customer chooses to enable chargeable KYC verification during onboarding, we use a verification provider configured for that purpose to confirm identity details (for example, Aadhaar, PAN or bank verification). These providers process only the identifiers submitted for the specific check, are engaged only when the feature is used, and are based in India. If KYC features are not enabled, no data is shared with these providers.

Some integrations are controlled by the customer rather than engaged by us as sub-processors. For example, when you connect your own email mailbox or an identity provider, you are choosing to share data with that third party under your own arrangement with them. We act on your configuration; those providers are not our sub-processors, and your use of them is governed by your agreement with them.

We may add or replace sub-processors as the Service evolves. We will update this page and the maintained list to reflect material changes, and provide customers a reasonable means to be informed of intended changes and to object on reasonable, data-protection grounds, as described in our Data Processing Agreement. Where appropriate, we will notify the organisation administrator of significant changes.

The specific named providers within each category are maintained internally and kept current. To receive the current named sub-processor list, or to register for notification of changes, please contact us at support@subhx.in. We will provide the list to customers under appropriate confidentiality terms.