Trust
Sub-processors
Section A.7 of the Privacy Policy names this page as the current list. Each entity below is bound by a written agreement to process personal data only on our instructions, and to maintain security standards no lower than our own.
Last updated 20 August 2026
| Sub-processor | Purpose | Where processing occurs |
|---|---|---|
| Supabase Inc. | Primary database, authentication, file storageHolds every record in the product: accounts, presence events, consent records and uploaded files. | India (where supported) / United States |
| Vercel Inc. | Application hosting and deliveryServes the Dashboard, marketing site and API. Every request passes through it, so it processes IP addresses and request logs as described in A.4.3. | United States / global edge |
| Cloudflare, Inc. | Authoritative DNS and inbound email routingRoutes mail sent to our published contact addresses — including privacy and grievance correspondence, which carries whatever personal data the sender chooses to include. | United States / global edge |
| Stripe Inc. | International card payments — institutional billingInstitutional billing only. No payment data is collected from parents or students. | United States; India where supported |
| Razorpay Software Pvt. Ltd. | India-domestic payments and UPI — institutional billingInstitutional billing only. | India |
| DigiLocker (NeGD, Government of India) | Parental consent verificationVerifies a parent's identity and the parent–child relationship for the consent workflow in A.6.1. | India |
| MSG91 (Walkover Web Solutions Pvt. Ltd.) | One-time-password SMS to Indian numbersReceives a mobile number and the one-time code, nothing else. | India |
| Twilio Inc. | International SMS and voice fallbackUsed only where an Indian-number route is unavailable. | United States |
| ZeptoMail (Zoho Corporation Pvt. Ltd.) | Transactional emailSends account, notification and digest email. Receives the recipient address and the message content. | India |
| Apple Inc. | App Store distribution, push notification (APNs)Distributes the Apps and carries push notifications to Apple devices. | Apple-operated infrastructure |
Changes to this list
Institutional customers receive at least 30 days’ written notice before any sub-processor is added or replaced, with a right to object as set out in the Data Processing Addendum. To be notified, write to privacy@onetaplabs.com.
Onetap Sentinel
Sentinel is out of scope of this list and of the Privacy Policy. It is governed separately.