Subprocessors

Third-party data processors we engage to deliver the service. This list is published in line with DPDP §5(8) and GDPR Art. 28. · Privacy Policy · Grievance Officer

Subprocessor Purpose Jurisdiction DPA
Anthropic, PBC LLM-assisted features (anomaly explanations, natural-language reporting, forecast narratives, and voice-note transcription where an operator has enabled it). Natural-language reporting is the ONLY surface that sends free text: the admin's typed question is masked FIRST against the caller's own organisation's member roster (name, phone and e-mail, four characters or longer — NaturalLanguagePromptRedactor) and THEN for any well-formed e-mail, Indian mobile, Aadhaar or PAN anywhere in the sentence (PiiEgressRedactor). What is left is sent as typed, so a name the roster does not hold — another organisation's member, a staff member, a nickname, initials, or a name shorter than four characters — is NOT masked. The other surfaces send no free text at all: a report kind plus internal numeric record ids (member, admin login, facility, source entity). Voice-note transcription sends the recording's storage URL and its duration.
Data shared: Admin free-text questions (own-org member names + shaped identifiers masked; other names may remain) + record ids
Security responsibility: SOC 2 Type II and ISO 27001 attested; TLS in transit; API inputs excluded from model training per Anthropic commercial terms.
Assurance: SOC 2 Type II / ISO 27001
United States
Not yet executed
Cashfree Payments India Private Limited Alternate payment gateway + payout rail. Receives member/order identifiers and transaction amounts for payment capture and settlement.
Data shared: Payment data
Security responsibility: PCI DSS Level 1 certified; TLS in transit; RBI-authorised payment aggregator controls.
Assurance: PCI DSS Level 1
India
Not yet executed
CloudPe (infrastructure hosting — bare instances, self-managed) Data-centre infrastructure hosting the application servers, database, blob storage, and disaster-recovery backups. We take bare instances and self-manage the operating system, patching, database hardening, backup execution and DR; the provider supplies the facilities, hardware, power and network.
Data shared: All hosted data (incl. payment data)
Security responsibility: India-region hosting for all stores including payment-classified data (DPDP + RBI localisation). Bare-instance model: the provider is responsible for physical facility security, hardware and network; MealMatrix is responsible for the operating system, patching, database hardening, identity and access management, encryption at rest and in transit, backup execution and disaster recovery. Third-party assurance certifications held by the provider have not yet been evidenced to us and are not claimed here.
Assurance: Provider attestations not yet evidenced to us — vendor assurance review outstanding
India
Not yet executed
Easebuzz Private Limited Alternate payment gateway. Receives member/order identifiers and transaction amounts for payment capture.
Data shared: Payment data
Security responsibility: PCI DSS Level 1 certified; TLS in transit; RBI-authorised payment aggregator controls.
Assurance: PCI DSS Level 1
India
Not yet executed
Google LLC (Cloud Vision API) Server-side validation of profile photos uploaded by members, where enabled. The image is sent only at the moment of validation.
Data shared: Profile image (biometric-adjacent)
Security responsibility: ISO 27001, ISO 27017/27018 and SOC 2 Type II attested; TLS in transit; image processed transiently for the validation call.
Assurance: ISO 27001 / SOC 2 Type II
United States
Not yet executed
Google LLC (Firebase Analytics / Crashlytics) Mobile app stability + usage diagnostics (crash reports, aggregate feature usage). Receives device/app diagnostic data and a pseudonymous installation id.
Data shared: Pseudonymous diagnostics
Security responsibility: ISO 27001 and SOC 2 Type II attested; TLS in transit; identifiers pseudonymous, no direct member identifiers sent.
Assurance: ISO 27001 / SOC 2 Type II
United States
Not yet executed
Google LLC (Firebase Cloud Messaging / FCM) Push-notification delivery. Receives a device installation token, platform, device model, app version, AND the notification's own title and body — which describe account activity (an order becoming ready, a wallet balance changing). Suppressed entirely when the member disables push notifications.
Data shared: Device identifiers + diagnostics + notification content
Security responsibility: ISO 27001 and SOC 2 Type II attested; TLS in transit; payload limited to device token and notification metadata.
Assurance: ISO 27001 / SOC 2 Type II
United States
Not yet executed
Grafana Labs, Inc. (Grafana Cloud) Application observability — receives OpenTelemetry traces/spans, metrics AND LOG RECORDS over OTLP for performance monitoring and error diagnosis. Spans are PII/secret-scrubbed BEFORE export (URL tokens, key=value secrets, and bare email/phone/PAN/Aadhaar redacted by the in-process PiiScrubbingSpanProcessor). Log records are NOT span-scrubbed — that processor is part of the tracing pipeline — so application log lines are minimised at the point they are written instead; treat any identifier a log statement chooses to include as transmitted.
Data shared: Operational telemetry — traces + metrics (PII-scrubbed) and log records (not span-scrubbed)
Security responsibility: SOC 2 Type II and ISO 27001 attested; TLS in transit; OTLP ingestion authenticated by a signed API key; spans scrubbed of PII/secrets pre-export (M10); log records carry only what the emitting statement includes, so the control for them is LoggerMessagePiiPlaceholderRule at the write site, not a pre-export processor.
Assurance: SOC 2 Type II / ISO 27001
United States
Not yet executed
Gupshup Technology India Private Limited Transactional SMS / WhatsApp message delivery. Receives member phone number and the message body (OTPs, order/wallet notices).
Data shared: Contact data + message content
Security responsibility: ISO 27001 certified ISMS; TLS in transit; messaging restricted to transactional templates.
Assurance: ISO 27001
India
Not yet executed
Meta Platforms, Inc. (WhatsApp Business) WhatsApp Business message delivery. Receives member phone number and templated message content.
Data shared: Contact data + message content
Security responsibility: ISO 27001 and SOC 2 attested; end-to-end encrypted transport; templated transactional messaging only.
Assurance: ISO 27001 / SOC 2 Type II
United States
Not yet executed
Operator-declared report webhook endpoint Scheduled report delivery to an HTTPS endpoint the operator declares for its own reports (for example its finance or HR system). Receives the rendered report FILE — which can carry member-level order, refund and wallet detail — signed by the platform. The recipient is whoever operates the declared endpoint; the platform does not choose it.
Data shared: Report contents (member-level operational and transaction data)
Security responsibility: HTTPS only (plain HTTP refused); every delivery HMAC-SHA256 signed; delivery restricted to hosts declared on the report-egress allow-list (Reports:Egress:AllowedWebhookHosts), enforced when a schedule is saved and on every send; private and internal network addresses refused by the SSRF guard.
Assurance: Operator-declared (assurance per the operator's chosen endpoint)
Wherever the operator's declared endpoint is hosted
Not yet executed
Razorpay Software Private Limited Payment processing (UPI / cards / netbanking). Receives member name, email, phone, and transaction amount to render checkout and process payments. ALSO receives connection metadata (IP address, user-agent, referrer) from page loads that are NOT payment pages: SecurityHeadersMiddleware's CSP allow-lists https://api.razorpay.com and https://lumberjack.razorpay.com (Razorpay's telemetry/analytics beacon) in connect-src for the WHOLE origin, and https://checkout.razorpay.com in script-src/frame-src, so the browser may contact Razorpay from any screen rather than only at checkout. Disclosed because the allowance is origin-wide while the payment purpose above is transaction-scoped (cycle-14 R2-M0771).
Data shared: Payment data + contact identifiers
Security responsibility: PCI DSS Level 1 certified cardholder environment; TLS in transit; tokenised card storage; contractual breach notification.
Assurance: PCI DSS Level 1
India
Not yet executed
SMTP relay provider Outgoing transactional email (welcome, password reset, OTPs, notices). Receives member email address and the message body. The platform relay is Amazon Simple Email Service (Amazon Web Services) in its Mumbai region (ap-south-1); if it is unavailable, a message is sent through a backup mail relay in India instead. Configured per operator.
Data shared: Contact data + message content
Security responsibility: TLS in transit; transactional email only. Concrete attestation depends on the operator-configured relay vendor.
Assurance: Operator-configured (assurance per chosen relay)
India
Not yet executed
Slack Technologies, LLC (Salesforce) Scheduled report delivery to a workspace channel, where an operator configures one. Receives the rendered report FILE — which carries member-level order, refund and wallet detail — plus the channel identifier and the message text.
Data shared: Report contents (member-level operational and transaction data)
Security responsibility: ISO 27001 and SOC 2 Type II attested; TLS in transit; delivery restricted to channels declared on the report-egress allow-list (Reports:Egress:AllowedSlackChannels), which is enforced on every send.
Assurance: ISO 27001 / SOC 2 Type II
United States
Not yet executed
Twilio Inc. Transactional SMS delivery fallback. Receives member phone number and message body.
Data shared: Contact data + message content
Security responsibility: ISO 27001 and SOC 2 Type II attested; TLS in transit; data-handling per Twilio DPA.
Assurance: ISO 27001 / SOC 2 Type II
United States
Not yet executed

We update this list when we engage a new processor or change the scope of an existing one. For vendor-questionnaire requests, contact our Grievance Officer.