Subprocessors

Third-party data processors we engage to deliver the service. This list is published in line with DPDP §5(8) and GDPR Art. 28. · Privacy Policy · Grievance Officer

Subprocessor Purpose Jurisdiction DPA
Anthropic, PBC LLM-assisted features (anomaly explanations, natural-language reporting, forecast narratives, and voice-note transcription where an operator has enabled it). Natural-language reporting is the ONLY surface that sends free text: the admin's typed question is masked FIRST against the caller's own organisation's member roster (name, phone and e-mail, four characters or longer — NaturalLanguagePromptRedactor) and THEN for any well-formed e-mail, Indian mobile, Aadhaar or PAN anywhere in the sentence (PiiEgressRedactor). What is left is sent as typed, so a name the roster does not hold — another organisation's member, a staff member, a nickname, initials, or a name shorter than four characters — is NOT masked. The other surfaces send no free text at all: a report kind plus internal numeric record ids (member, admin login, facility, source entity). Voice-note transcription sends the recording's storage URL and its duration.
Data shared: Admin free-text questions (own-org member names + shaped identifiers masked; other names may remain) + record ids
Security responsibility: SOC 2 Type II and ISO 27001 attested; TLS in transit; API inputs excluded from model training per Anthropic commercial terms.
Assurance: SOC 2 Type II / ISO 27001
United States
Not yet executed
Cashfree Payments India Private Limited Alternate payment gateway + payout rail. Receives member/order identifiers and transaction amounts for payment capture and settlement.
Data shared: Payment data
Security responsibility: PCI DSS Level 1 certified; TLS in transit; RBI-authorised payment aggregator controls.
Assurance: PCI DSS Level 1
India
Not yet executed
CloudPe (infrastructure hosting — bare instances, self-managed) Data-centre infrastructure hosting the application servers, database, blob storage, and disaster-recovery backups. We take bare instances and self-manage the operating system, patching, database hardening, backup execution and DR; the provider supplies the facilities, hardware, power and network.
Data shared: All hosted data (incl. payment data)
Security responsibility: India-region hosting for all stores including payment-classified data (DPDP + RBI localisation). Bare-instance model: the provider is responsible for physical facility security, hardware and network; MealMatrix is responsible for the operating system, patching, database hardening, identity and access management, encryption at rest and in transit, backup execution and disaster recovery. Third-party assurance certifications held by the provider have not yet been evidenced to us and are not claimed here.
Assurance: Provider attestations not yet evidenced to us — vendor assurance review outstanding
India
Not yet executed
Easebuzz Private Limited Alternate payment gateway. Receives member/order identifiers and transaction amounts for payment capture.
Data shared: Payment data
Security responsibility: PCI DSS Level 1 certified; TLS in transit; RBI-authorised payment aggregator controls.
Assurance: PCI DSS Level 1
India
Not yet executed
Google LLC (Cloud Vision API) Server-side validation of profile photos uploaded by members, where enabled. The image is sent only at the moment of validation.
Data shared: Profile image (biometric-adjacent)
Security responsibility: ISO 27001, ISO 27017/27018 and SOC 2 Type II attested; TLS in transit; image processed transiently for the validation call.
Assurance: ISO 27001 / SOC 2 Type II
United States
Not yet executed
Google LLC (Firebase Analytics / Crashlytics) Mobile app stability + usage diagnostics (crash reports, aggregate feature usage). Receives device/app diagnostic data and a pseudonymous installation id.
Data shared: Pseudonymous diagnostics
Security responsibility: ISO 27001 and SOC 2 Type II attested; TLS in transit; identifiers pseudonymous, no direct member identifiers sent.
Assurance: ISO 27001 / SOC 2 Type II
United States
Not yet executed
Google LLC (Firebase Cloud Messaging / FCM) Push-notification delivery. Receives a device installation token, platform, device model, app version, AND the notification's own title and body — which describe account activity (an order becoming ready, a wallet balance changing). Suppressed entirely when the member disables push notifications.
Data shared: Device identifiers + diagnostics + notification content
Security responsibility: ISO 27001 and SOC 2 Type II attested; TLS in transit; payload limited to device token and notification metadata.
Assurance: ISO 27001 / SOC 2 Type II
United States
Not yet executed
Grafana Labs, Inc. (Grafana Cloud) Application observability — receives OpenTelemetry traces/spans, metrics AND LOG RECORDS over OTLP for performance monitoring and error diagnosis. Spans are PII/secret-scrubbed BEFORE export (URL tokens, key=value secrets, and bare email/phone/PAN/Aadhaar redacted by the in-process PiiScrubbingSpanProcessor). Log records are NOT span-scrubbed — that processor is part of the tracing pipeline — so application log lines are minimised at the point they are written instead; treat any identifier a log statement chooses to include as transmitted.
Data shared: Operational telemetry — traces + metrics (PII-scrubbed) and log records (not span-scrubbed)
Security responsibility: SOC 2 Type II and ISO 27001 attested; TLS in transit; OTLP ingestion authenticated by a signed API key; spans scrubbed of PII/secrets pre-export (M10); log records carry only what the emitting statement includes, so the control for them is LoggerMessagePiiPlaceholderRule at the write site, not a pre-export processor.
Assurance: SOC 2 Type II / ISO 27001
United States
Not yet executed
Gupshup Technology India Private Limited Transactional SMS / WhatsApp message delivery. Receives member phone number and the message body (OTPs, order/wallet notices).
Data shared: Contact data + message content
Security responsibility: ISO 27001 certified ISMS; TLS in transit; messaging restricted to transactional templates.
Assurance: ISO 27001
India
Not yet executed
Meta Platforms, Inc. (WhatsApp Business) WhatsApp Business message delivery. Receives member phone number and templated message content.
Data shared: Contact data + message content
Security responsibility: ISO 27001 and SOC 2 attested; end-to-end encrypted transport; templated transactional messaging only.
Assurance: ISO 27001 / SOC 2 Type II
United States
Not yet executed
Operator-declared report webhook endpoint Scheduled report delivery to an HTTPS endpoint the operator declares for its own reports (for example its finance or HR system). Receives the rendered report FILE — which can carry member-level order, refund and wallet detail — signed by the platform. The recipient is whoever operates the declared endpoint; the platform does not choose it.
Data shared: Report contents (member-level operational and transaction data)
Security responsibility: HTTPS only (plain HTTP refused); every delivery HMAC-SHA256 signed; delivery restricted to hosts declared on the report-egress allow-list (Reports:Egress:AllowedWebhookHosts), enforced when a schedule is saved and on every send; private and internal network addresses refused by the SSRF guard.
Assurance: Operator-declared (assurance per the operator's chosen endpoint)
Wherever the operator's declared endpoint is hosted
Not yet executed
Razorpay Software Private Limited Payment processing (UPI / cards / netbanking). Receives member name, email, phone, and transaction amount to render checkout and process payments. ALSO receives connection metadata (IP address, user-agent, referrer) from page loads that are NOT payment pages: SecurityHeadersMiddleware's CSP allow-lists https://api.razorpay.com and https://lumberjack.razorpay.com (Razorpay's telemetry/analytics beacon) in connect-src for the WHOLE origin, and https://checkout.razorpay.com in script-src/frame-src, so the browser may contact Razorpay from any screen rather than only at checkout. Disclosed because the allowance is origin-wide while the payment purpose above is transaction-scoped (cycle-14 R2-M0771).
Data shared: Payment data + contact identifiers
Security responsibility: PCI DSS Level 1 certified cardholder environment; TLS in transit; tokenised card storage; contractual breach notification.
Assurance: PCI DSS Level 1
India
Not yet executed
SMTP relay provider Outgoing transactional email (welcome, password reset, notices). Receives member email address and the message body. Configured per operator.
Data shared: Contact data + message content
Security responsibility: TLS in transit; transactional email only. Concrete attestation depends on the operator-configured relay vendor.
Assurance: Operator-configured (assurance per chosen relay)
India
Not yet executed
Slack Technologies, LLC (Salesforce) Scheduled report delivery to a workspace channel, where an operator configures one. Receives the rendered report FILE — which carries member-level order, refund and wallet detail — plus the channel identifier and the message text.
Data shared: Report contents (member-level operational and transaction data)
Security responsibility: ISO 27001 and SOC 2 Type II attested; TLS in transit; delivery restricted to channels declared on the report-egress allow-list (Reports:Egress:AllowedSlackChannels), which is enforced on every send.
Assurance: ISO 27001 / SOC 2 Type II
United States
Not yet executed
Twilio Inc. Transactional SMS delivery fallback. Receives member phone number and message body.
Data shared: Contact data + message content
Security responsibility: ISO 27001 and SOC 2 Type II attested; TLS in transit; data-handling per Twilio DPA.
Assurance: ISO 27001 / SOC 2 Type II
United States
Not yet executed

We update this list when we engage a new processor or change the scope of an existing one. For vendor-questionnaire requests, contact our Grievance Officer.