# Sub-processor List
Effective from 28 April 2026. Version 1.0.0.
This list is incorporated by reference into the Data Processing Agreement and is binding on both Parties. Acceptance of the DPA constitutes general authorisation for these sub-processors. New sub-processors are notified at least thirty (30) days in advance.
## 1. Hosting and Compute
| Sub-processor | Purpose | Region (primary) | Privacy notice |
| ------------- | ------------------------------------------------------------------------------- | -------------------------------------------------------------------- | --------------------------------------- |
| Vercel Inc. | Edge hosting of the Next.js application; deploy targets; Vercel Cron scheduling | United States; global edges; Indian regional edges where available | https://vercel.com/legal/privacy-policy |
| Neon Inc. | Postgres database; system-of-record for every Customer Data row | Pinned to AWS Mumbai (`ap-south-1`) where data residency requires it | https://neon.tech/privacy-policy |
## 2. Object Storage and CDN
| Sub-processor | Purpose | Region | Privacy notice |
| ---------------- | -------------------------------------------------------------------------------------------------- | ---------------------------------------------- | ----------------------------------------- |
| Cloudflare, Inc. | R2 object storage for documents, brand assets, and signed-receipt artefacts; CDN for static assets | Global edges with regional pin where available | https://www.cloudflare.com/privacypolicy/ |
## 3. Email Delivery
| Sub-processor | Purpose | Region | Privacy notice |
| ------------- | ---------------------------------------------------------------------------------------------------------- | ------------- | --------------------------------------- |
| Resend, Inc. | Transactional email delivery (magic-link, OTP, payment receipts, dunning, data-export-ready notifications) | United States | https://resend.com/legal/privacy-policy |
## 4. Payment Processing
| Sub-processor | Purpose | Region | Privacy notice |
| --------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------- | ------ | ----------------------------- |
| Razorpay Software Private Limited | Payment-gateway processing for the Customer's invoices to ElevateFinance and (under Razorpay Route) for End-User payments to the Customer | India | https://razorpay.com/privacy/ |
## 5. Authentication
| Sub-processor | Purpose | Region | Privacy notice |
| --------------------------------------------------------- | ---------------------------------------------------------------------- | ---------------------------------------------- | ----------------------------------- |
| Auth.js (Open Source, hosted by ElevateFinance on Vercel) | Magic-link authentication and session token issuance | India / global edges | n/a (in-house deployment) |
| Google LLC | OAuth identity provider where the End-User opts to sign in with Google | Global; user-region pinned where Google offers | https://policies.google.com/privacy |
## 6. Monitoring and Observability
| Sub-processor | Purpose | Region | Privacy notice |
| ---------------------------------- | ------------------------------------------------------------------------------------------- | ----------------------------------------------- | -------------------------- |
| Sentry (Functional Software, Inc.) | Error and performance monitoring, with PII scrubbed at the SDK boundary before transmission | United States; EU region pinned where available | https://sentry.io/privacy/ |
## 7. Search and Indexing
ElevateFinance uses Postgres `tsvector` for in-product search. No external search provider is engaged.
## 8. SMS and Push Notification
ElevateFinance does not currently engage an SMS sub-processor. Push notifications are delivered through:
| Sub-processor | Purpose | Region |
| ----------------- | --------------------- | ------ |
| Apple Inc. (APNs) | iOS push delivery | Global |
| Google LLC (FCM) | Android push delivery | Global |
## 9. Analytics
ElevateFinance does not currently engage a third-party analytics
sub-processor. All product analytics are computed in-house from the
audit log.
## 10. Office and Productivity
| Sub-processor | Purpose | Region | Privacy notice |
| ---------------- | ----------------------------------------------------------------------------------------- | ---------------------------------- | --------------------------------------------------------- |
| Google Workspace | Internal email, document storage, and meeting infrastructure for ElevateFinance employees | United States; India region pinned | https://workspace.google.com/intl/en/terms/dpa_terms.html |
## 11. Notification on Change
ElevateFinance updates this list and notifies each Customer in writing at least thirty (30) days before any new sub-processor begins Processing Personal Data, save where a shorter timeline is required by Applicable Law (in which case the notice is as long as is practicable).