Subprocessors
The third-party providers Sammati engages to help operate the platform, what each one processes, and where. Published under our Data Processing Agreement.
Last updated: 19 July 2026
This list applies to the managed (SaaS) deployment, where Sammati operates the infrastructure on your behalf. In a BYOC deployment, Sammati is deployed inside your own cloud account - your data store, cache and object storage stay in your tenancy, and the infrastructure subprocessors below do not apply to you. AI, email and billing subprocessors may still apply depending on the features you enable.
Amazon Web Services (AWS)
India, Asia Pacific (Mumbai), ap-south-1Amazon Web Services, Inc. / Amazon Web Services India Pvt. Ltd.
Core cloud infrastructure, compute, managed PostgreSQL (primary data store), object storage, message queues, key management (KMS envelope encryption) and secrets.
Data processed: All hosted personal data and consent artifacts (encrypted at rest and in transit).
Cloudflare
Global edge network (anycast); no primary storage of personal data.Cloudflare, Inc.
Edge network, CDN, DNS, WAF and DDoS mitigation for all inbound traffic to Sammati services.
Data processed: Request metadata and IP addresses processed transiently at the edge.
Redis Cloud
India region; TLS-only, no-eviction.Redis Ltd.
Managed in-memory cache and session store for the hosted SaaS deployment. (BYOC deployments use an in-account cache instead, see scope note.)
Data processed: Short-lived cache entries, session tokens and rate-limit counters (tenant-scoped keys).
Groq
United States (transient inference; no persistent storage of prompts by Sammati).Groq, Inc.
AI inference for notice translation and data-category classification. Accessed via an OpenAI-compatible API endpoint, inference is served by Groq, not OpenAI.
Data processed: Notice text submitted for translation and field/label text submitted for classification. Not used to train third-party models.
Resend
United States.Resend (Plutonic, Inc.)
Delivery of platform-origin transactional and notification email (OTP, consent receipts, system notices) from Sammati-verified domains.
Data processed: Recipient email address and the contents of the transactional message.
Razorpay
India.Razorpay Software Private Limited
Billing and invoicing of Sammati’s own customers (the Data Fiduciary account holder). Does not process Data Principal personal data.
Data processed: Account holder billing contact and payment details only.
The following are connected under your own contract and credentials. For these you are the controller of the vendor relationship; they are your subprocessors, not Sammati’s. Listed here for completeness.
SMS / OTP delivery
Twilio, MSG91, Kaleyra (or any provider the tenant configures)
Bring-your-own SMS provider (SP-18). The tenant supplies its own credentials and sender; the tenant governs that vendor directly.
Email delivery (bring-your-own)
SMTP, Amazon SES, SendGrid (or any provider the tenant configures)
Optional per-tenant email provider (0143) sending from the tenant’s own verified domain. Where not configured, platform email uses Resend (above).
Bring-your-own key (BYOK)
Tenant-owned AWS KMS key
A tenant may bind its own KMS key for envelope encryption. Key custody stays with the tenant.
Before we add or replace a subprocessor that processes personal data, we update this page and its Last updated date. Customers with an active agreement may subscribe to advance notice of changes and, where our Data Processing Agreement provides, object to a new subprocessor on reasonable data-protection grounds.
To subscribe to subprocessor-change notifications, email [email protected].
Need our DPA to sign?
Our Data Processing Agreement incorporates this subprocessor list by reference. Read it online or request a countersigned copy for your records.