Under GDPR Article 28(2) (and the equivalent UK GDPR rule), you are entitled to know who processes personal data on our behalf. Business clients authorize the vendors below as part of our Data Processing Addendum; each is bound by written data-protection terms no less protective than our own.
Current Sub-processors
| Vendor | Purpose | Location |
|---|---|---|
| Supabase, Inc. | Primary database, authentication and serverless functions (form submissions, blog content, admin access). | United States (AWS us-east regions); encrypted at rest |
| Google Analytics (Google LLC) | Aggregate website usage analytics. Cookies only load per your consent choices. | United States / Google EU (Ireland) data residency |
| Microsoft Clarity (Microsoft Corporation) | Session replay and heatmaps to improve page usability. | United States; IP truncation enabled |
| Cloudinary Ltd. | Image storage, transformation and CDN delivery for site imagery. | Global CDN (multi-region); encrypted in transit |
| Google Firebase Storage (Google LLC) | Static marketing asset storage (images, videos) served from our own project bucket. | Google Cloud regions; encrypted at rest |
| Cloudflare, Inc. (Workers AI) | Serverless inference powering the DRUPTO CONSULTANTS AI chat assistant. Chat messages you type are sent to Cloudflare Workers AI to generate a reply using Meta's open-source Llama model; prompts and responses are not retained, logged or used to train models. | United States (Cloudflare global network); encrypted in transit |
| Razorpay Software Private Limited | Our only online payment gateway — domestic (India) and international card/UPI/net-banking payments are processed exclusively through Razorpay. We never see or store full card numbers. | India (Razorpay infrastructure); PCI-DSS compliant processing |
| Meta Platforms (WhatsApp) | Optional, user-initiated chat only — clicking a wa.me link sends data to WhatsApp under Meta's terms; never embedded tracking. | Meta global infrastructure |
Infrastructure hosting (the platform our standalone builds run on) is named in your Statement of Work — its region is set per engagement (EU, UK, India, US or Gulf) to match your residency requirements.
Changes to This List
- We notify affected clients at least 30 days before adding or replacing a sub-processor.
- You may object on reasonable data-protection grounds within that 30-day window; if we cannot resolve the objection, your sole remedy is to terminate the affected services without penalty for the unworked balance.
- Notifications go to the billing and technical contacts on file — keep them current.
Legal Basis and Safeguards
Each sub-processor is engaged under GDPR Article 28(4) flow-down terms. Where a vendor processes data outside the EEA/UK, the transfer is covered by Standard Contractual Clauses (and the UK Addendum where applicable) plus the supplementary measures described in our Security page and Privacy Policy Section 9.
Questions or Objections
Email contact@druptoconsultants.com with the vendor name and your engagement reference. We respond to sub-processor questions within 3 business days.