Legal
Sub-processors
Effective 29 September 2026 · Last updated 29 September 2026
These are the third parties that process personal data on Attestr's behalf to host, run and deliver its services. Each is vetted before engagement and bound by data-protection and confidentiality obligations equivalent to ours; our infrastructure providers also maintain their own ISO 27001 and/or SOC 2 certifications.
1.Infrastructure and platform providers
| Provider | What they do for Attestr | Data location |
|---|---|---|
| Amazon Web Services (AWS) | Cloud infrastructure: API compute, document storage, encryption key management, secrets, logging and backups | India — Asia Pacific (Mumbai) |
| MongoDB Atlas | Managed database and database backups | India — Asia Pacific (Mumbai), hosted on AWS |
| Google Cloud | Cloud infrastructure services | Global |
| Runpod | GPU cloud that runs Attestr's AI model for summarising court orders. Processes only publicly available court orders — no other data — and keeps nothing after processing | Global — outside India |
| Msg91 | SMS delivery — one-time passwords for consent and verification, and account alerts | India |
| Mailgun | Email delivery — one-time passwords, consent requests, reports and account notifications | United States |
All verification data processed for Clients is stored with AWS and MongoDB Atlas in India. Msg91 and Mailgun only deliver messages: they receive the recipient's phone number or email address and the message content (such as an OTP), not verification results. Runpod receives only publicly available court orders, which may name the parties to a case, and retains no data once a summary is produced.
2.Verification data partners
| Category | What they do for Attestr | Data location |
|---|---|---|
| Verification data partners | Licensed intermediaries that connect to government and authoritative sources for specific checks — for example bank account, mobile number and some identity verifications. They receive only the data a check needs and return the result. | India |
Government, statutory and authoritative sources themselves (such as DigiLocker and official registries) are the origin of verification results, not sub-processors. Where Attestr reaches a source through an intermediary, that intermediary is a verification data partner.
Partners are engaged under written agreements with data-protection terms equivalent to ours, and may only use the data to perform the check requested. Because partners are commercially sensitive and change over time, we do not name them here: a current named list is available to Clients on request, under a non-disclosure agreement, at contact@attestr.com.
3.Service providers for our own operations
| Provider | What they do for Attestr | Data location |
|---|---|---|
| Netlify | Hosts the website and dashboard front-ends on a global content-delivery network, and receives website contact-form submissions | Global CDN; contact-form data may be processed outside India |
| Razorpay | Processes payments for Attestr service packs and subscriptions | India |
| Zoho Books | Tax invoice creation and billing records. Processes customers' billing contact name, email, phone, billing address and GSTIN/tax ID | Zoho's global data centres — outside India |
The dashboard front-end only delivers the application to your browser; verification requests and results go directly to Attestr's API in India.
4.Changes to this list
We update this page before engaging a new sub-processor, or a new category of sub-processor, that will process Client personal data. Clients can request the current named list — including verification data partners — or ask to be notified of changes, at contact@attestr.com.