Sub-processors
Effective 6 June 2026 · Updated whenever this list changes
We engage a small number of carefully chosen service providers to operate hisaab.ai. Each is bound by a written Data Processing Agreement requiring confidentiality, security, and processing only on our written instructions. We give at least 30 days' notice before adding a new sub-processor or materially changing how an existing one is used. To subscribe to change notifications, email legal@hisaab.ai with the subject line “subprocessor-updates”.
Current list
| Sub-processor | Purpose | Data shared | Region |
|---|---|---|---|
| OpenAI, L.L.C. | Large-language-model inference for OCR (vision), document classification, extraction, and CA-agent reasoning. | Document content (text + page images), extracted fields, prompt context. No account credentials. | United States |
| Google LLC (Gemini API) | Alternative LLM backend (only when explicitly selected for a workspace). | Document content, extracted fields, prompt context. | United States |
| Google LLC (OAuth & Drive) | Sign-in with Google, and reading files you explicitly select from your Google Drive. | Email, full name, profile picture, OAuth token (transient); files you pick to import. | United States |
| Hostinger International Ltd. | Primary application servers, PostgreSQL, Redis, RabbitMQ, Qdrant vector store, document blob storage. | All Customer Data while at rest within the service. | Europe (current). Migration to AWS ap-south-1 (Mumbai) is in progress; this page will be updated when complete. |
| SMTP transactional email provider | Transactional email (signup confirmation, password reset, notifications, invoices). | Email address, full name, subject line, message body. | Provider-dependent; named in writing on request from legal@hisaab.ai. |
| Twilio Inc. | Onboarding messages and notifications via WhatsApp / SMS, when you opt in. | Phone number, country code, message content. | United States |
| Cloudflare, Inc. | DNS, edge caching, DDoS protection (if enabled). | Request metadata (IP, user-agent, path). | Global edge |
On-premise & in-country options
For firms with strict residency requirements we offer:
- India-region hosting — all primary storage in AWS
ap-south-1(Mumbai) or Azure Central India. - In-country LLM fallback — sensitive document classes (bank statements, Form 26AS) routed to an India-hosted model (e.g. Sarvam) instead of OpenAI/Gemini. Available on the Enterprise plan.
- Customer-managed encryption keys for field-level encryption of PAN, GSTIN, and bank-account columns.
Talk to us at hi@hisaab.ai if you need these.
History of changes
This page tracks the current state. Past versions are kept in our internal compliance register and can be shared on request.