Sub-processors
Last updated: 25 October 2026 · Reviewed on each addition and at least annually thereafter · changes notified 14 days in advance
We maintain a current list of sub-processors on this page. New additions are published here at least 14 days before engagement, and enterprise customers under a signed Data Processing Agreement have a right to object and terminate the affected service within that window on reasonable data-protection grounds. To subscribe to change notifications by email, add subprocessor-changes@digitaliiisla.co.in or write to legal@digitaliiisla.co.in.
Current sub-processors
| Sub-processor | Role | Processing location | Certifications | Added on |
|---|---|---|---|---|
| Supabase, Inc. | Primary database (Postgres), authentication, object storage, Row-Level Security engine. | India — ap-south-1 (Mumbai) | SOC 2 Type II, HIPAA, ISO 27001 (platform) | 30 September 2026 |
| Cloudflare, Inc. | CDN, DNS, DDoS protection, Workers (edge routing), Web Application Firewall, bot management. | Global edge; traffic from India served from Indian POPs | SOC 2 Type II, ISO 27001, ISO 27018, PCI DSS Level 1, FedRAMP Moderate | 30 September 2026 |
| Google LLC (Gemini AI, Google Cloud) | OCR & vision inference on uploaded photos only (number plate, RC, DL, invoice). Transient — not retained beyond the inference call under the Enterprise Gemini DPA. | Google India & US data centres under Google’s DPA with Standard Contractual Clauses | SOC 1/2/3, ISO 27001, ISO 27017, ISO 27018, ISO 27701, PCI DSS, HIPAA | 30 September 2026 |
| Resend (Drizzle Team, Inc.) | Transactional email delivery (sign-up, password reset, invoice). Marketing email is handled by Zoho — Resend never carries survey content. | EU & US (DPA with Standard Contractual Clauses) | SOC 2 Type II | 30 September 2026 |
| Zoho Corporation (Zoho Campaigns) | Marketing email (opt-in only; one-click unsubscribe). List of email addresses + first name only. | India datacentre (Chennai) | SOC 2 Type II, ISO 27001, ISO 27701, HIPAA | 30 September 2026 |
| Backblaze, Inc. (B2 Cloud Storage) | Backblaze B2 — ciphertext stored in eu-central and us-west dual-region; decryption passphrase held only by Digitaliiisla, so Backblaze cannot read content. | eu-central & us-west dual-region (ciphertext only) | SOC 2 Type II, ISO 27001 | 30 September 2026 |
| Cloudflare R2 Object Storage | Hot-tier object storage for frequently accessed survey media (photos, PDFs). Egress-free; cached at Cloudflare edge for fast delivery to Indian surveyors and insurer dashboards. | Global object store with APAC location hint; cached at Cloudflare India POPs | SOC 2 Type II, ISO 27001, ISO 27018 | 30 September 2026 |
| Amazon Web Services India Private Limited (AWS S3, Mumbai) | Encrypted archival storage, tier 2 (India-resident copy of long-retention records for IRDAI 7-year audit tail). Server-side encrypted (SSE-S3) + client-side AES-256 before upload. | India — ap-south-1 (Mumbai) | SOC 1/2/3, ISO 27001, ISO 27017, ISO 27018, PCI DSS, HIPAA, STAR, CSA | 25 October 2026 |
| Razorpay Software Private Limited | Payment gateway for card / UPI / net-banking. PCI-DSS tokenised; Digitaliiisla never sees the card number, CVV or UPI PIN. | India | PCI DSS Level 1, ISO 27001, SOC 2 Type II | 30 September 2026 |
Change history
No sub-processors have been removed or replaced since launch. Any future change will be recorded here with the date it was published and the date it took effect.
Annual review
We review each sub-processor’s SOC 2 report / ISO certificate / data-residency commitment at least annually. First Sub-processor review completed on 20 October 2026 at initial pack publication; subsequent cycles complete annually. Findings and remediation items are shared with enterprise customers under NDA on request.
Enterprise objection & termination right
Enterprise customers under a signed DPA may object to a new sub-processor within 14 days of its publication here, on reasonable data-protection grounds. If the Parties cannot agree, the customer may terminate the Services affected by the proposed sub-processor without penalty, consistent with Clause 8.4 of the DPA.
Questions
Legal / commercial: legal@digitaliiisla.co.in
Security / technical: security@digitaliiisla.co.in
Phone: +91 83026 98307