Sub-processors
Last updated: 4 September 2026
A sub-processor is a third party that processes personal data on our behalf so that we can provide Niyora. This page is the complete, current list, and the change log below records every addition or removal.
Your firm authorises these sub-processors under our Data Processing Terms (§4).
1. Always engaged
These are used for every account.
| Provider | What it does | What it receives | Processing location |
|---|---|---|---|
| Supabase | Database, file storage, client-portal authentication | All application data and every uploaded file | India / as configured for our project |
| Vercel | Application hosting | Requests and technical data (IP, user-agent, logs) | Mumbai (bom1) |
| Anthropic | AI: questions, drafting, document verification, form-field mapping, document reading | Your prompt and the records or documents relevant to that task | Outside India |
| OpenAI | Text embeddings that make AI search and chat work | Document and query text | Outside India |
| Resend | Sending email - invitations, password resets, notifications, and email to your clients | Recipient name, email address, message content and attachments | Outside India |
2. Engaged only if you turn them on
| Provider | What it does | What it receives |
|---|---|---|
| Google (Google Drive) | Mirrors uploaded files to your firm's own Google account | Copies of uploaded files and their metadata |
| Microsoft (OneDrive / SharePoint) | Mirrors uploaded files to your firm's own Microsoft account | Copies of uploaded files and their metadata |
| MCA / GST verification provider | Looks up registry data during due diligence | The CIN, GSTIN or PAN being checked |
For the two file mirrors, the copies land in storage you own and control. Once a file is there, your own agreement with that provider governs it, and its access and retention are yours to manage.
3. What is deliberately not on this list
- No payment gateway. Subscriptions are arranged with our sales contact and invoiced directly. We do not collect or store card or other payment-instrument details, and no payment processor is in the data path. If that changes, it will appear here and be notified to you first.
- No advertising, analytics-profiling or data-broking third parties. We do not sell personal data or share it for advertising.
- The MCA Filer browser extension is not a sub-processor. It fills forms inside your own authenticated MCA session, in your browser. We never hold your MCA portal credentials and never submit a filing on your behalf.
4. AI providers and your clients' confidentiality
This is the question CS firms ask first, so it is worth stating plainly.
- Under Anthropic's and OpenAI's standard API terms, the content Niyora sends them through their APIs is not used to train their models.
- Data is sent only when an AI feature is used, and only the material relevant to that task - not your whole client database.
- "Not used for training" is a different commitment from "not stored at all": providers may retain content for a limited period for security and abuse monitoring under their own terms. See Data Retention & Deletion.
If your engagement requires stricter handling, contact sales@niyora.space - tell us what your client requires and we will tell you honestly whether we can meet it.
5. Confidentiality and security obligations
Each sub-processor is engaged under terms that require it to keep data confidential, apply appropriate security measures, and process data only for the purpose we engage it for.
6. Changes and your right to object
We will give notice before a new sub-processor begins processing your data, so that you can object on reasonable grounds as provided in the Data Processing Terms. Notice is given in-app and by email to your firm's administrators - you are not expected to watch this page.
Material changes to this list are also a change to the terms you accepted, so you will be asked to review and accept the updated version when you next sign in.
Change log
| Date | Change |
|---|---|
| 4 September 2026 | First published as a standalone page. Consolidated from the Privacy Policy §4 with no change to the providers used. |
Questions about a sub-processor? Contact privacy@niyora.space.