Sub-processors
Every company that can touch your data on our behalf, what they receive and where they are. The list is short on purpose.
Last updated: · Applies to SupportCentral Enterprise, operated by Support IT Ventures.
Current sub-processors
That is the entire list. There is no analytics provider, no advertising network, no content delivery network, no external AI provider and no offshore hosting.
| Who | What for | What they receive | Where |
|---|---|---|---|
| Razorpay Software Private Limited | Payment processing | Billing contact name, email, billing address, GSTIN and the payment instrument. No ticket, employee or asset data. | India |
| Our transactional email provider | Delivering email you asked us to send | The recipient address and the message content of mail your desk sends | Disclosed on request; configured per installation |
What is NOT a sub-processor of ours
Services you connect with your own credentials — your mail server, and any directory, licence or endpoint-security system you choose to link — are your providers, under your agreement with them. We move data between your systems on your instruction; we do not appoint them and we cannot speak for them. We keep this distinction sharp rather than blurring it, because blurring it is how a vendor quietly makes its own supply chain look shorter than it is.
Why the list is this short
Most software companies of this size have fifteen to thirty sub-processors: an analytics vendor, a session recorder, an error tracker, a support widget, a marketing automation tool, a CDN, a cloud host, a log aggregator. Each one is a company with access to some slice of customer data, and each one is a separate answer you have to give in your own compliance review.
We build without those. There is no analytics script, no error-reporting service, no chat widget from another vendor, no content delivery network and no external AI provider. The application runs on infrastructure we administer. That is why the table above has two rows rather than twenty, and it is a deliberate design constraint rather than an accident of being small.
Hosting and infrastructure
Our servers are leased from an infrastructure provider in India, as anyone\'s are. That provider supplies compute, storage and network; it does not process your data on our behalf in the sense the Act means, and it has no application-level access to it. We name the provider in our DPA and in any security questionnaire — ask and we will tell you.
Changes to this list
We give 30 days' notice before adding a sub-processor. Write to security@supportcentral.in to be added to the notification list. If you object to a new sub-processor, you may terminate and receive a pro-rata refund of any prepaid, unused period.
Something here unclear or unfair? Tell us at support@supportcentral.in. We would rather fix the wording than argue about it later. See also Terms, Privacy and Grievance redressal.