Sub-processors
The third parties Regulens engages to process customer data, their purpose and their processing locations.
Last updated
We publish our sub-processor list because our customers' own boards and auditors expect them to know their fourth-party chain. Customers receive 30 days notice of any addition or change, with a right to object.
Infrastructure
| Sub-processor | Purpose | Location |
|---|---|---|
| Amazon Web Services | Primary hosting, storage and compute | Mumbai (ap-south-1), Hyderabad (ap-south-2) |
| Cloudflare | Content delivery, DDoS protection, WAF | Global edge, India PoPs prioritised |
| MongoDB Atlas | Managed document storage | India region, matching customer selection |
Platform services
| Sub-processor | Purpose | Location |
|---|---|---|
| Anthropic | Language model inference under zero-retention terms | US, EU (contractually restricted from retention) |
| Elastic Cloud | Search and retrieval indexing | India region, matching customer selection |
| MSG91 / Twilio | Transactional email and WhatsApp Business alerting | India |
Business operations
| Sub-processor | Purpose | Location |
|---|---|---|
| Zoho CRM | Customer relationship management | India |
| Freshdesk | Support ticketing | India |
| Atlassian | Internal issue tracking (no customer content) | Singapore |
Notes on AI sub-processors
Model providers are engaged under zero-retention terms: prompts and completions are not stored by the provider and are not used to train their models. Because current frontier model inference is not available from an India-only provider, this is the one category of sub-processing that routes outside India by necessity, under strict contractual retention and use restrictions. Where a customer's data classification policy prohibits any inference outside India, the Enterprise customer-hosted deployment supports self-hosted inference within the customer's own boundary.
Notification and objection
To receive change notifications, email legal@regulens.in and ask to be added to the sub-processor notification list. If you object to a proposed sub-processor on reasonable data protection grounds, we will work to provide an alternative; if we cannot, you may terminate the affected service without penalty.