Sub Processors
Last updated — 12 August 2026 · v3.6
This page lists the third parties that Triophase Global Services Pvt. Ltd. engages to process personal data on behalf of our customers. It is maintained under section 6 of our Data Processing Addendum and forms Annex III of the Standard Contractual Clauses where those apply.
How we manage sub-processors
Before engaging any sub-processor we assess its security posture, its data protection terms, the locations from which it processes data, and its own sub-processing arrangements. Every sub-processor is bound by a written agreement imposing obligations no less protective than those we owe our customers.
We remain fully liable to our customers for the acts and omissions of our sub-processors.
Where a sub-processor provides AI model inference, we contract on terms that prohibit the use of submitted content for model training.
What we do not use third parties for
Three systems that would ordinarily appear on a list like this are operated by us on our own infrastructure, so no third party receives the data:
- Source control and CI. We run a self-managed GitLab instance. Customer source code is never held by a third-party code hosting service.
- Error tracking and application monitoring. Self-hosted. Stack traces and runtime data, which frequently contain end-user personal data, stay within our own systems.
- The Triophase Studio portal, our automation platform and our encrypted secrets store. All self-operated.
The infrastructure providers hosting those systems are listed below, since they provide the underlying compute and storage.
Notice of changes
We give at least 30 days' notice before a new sub-processor begins processing customer personal data.
To receive notice, email privacy@triophase.com with the subject line Subscribe: sub-processor changes. Customers may object to a new sub-processor on reasonable data protection grounds within 15 days of notice, following the process in section 6.4 of the DPA.
Current sub-processors
Infrastructure and hosting
We operate across several providers so that build compute and storage can be placed in a region a customer nominates. Not every provider is used on every project; the providers used for a specific engagement are recorded in that project's documentation and can be supplied on request.
| Sub-processor | Purpose | Entity location | Processing location |
|---|---|---|---|
| Google Cloud (Google Cloud EMEA Limited / Google LLC) | Build environments, staging servers, application hosting | Ireland / United States | Regions as configured per project |
| Amazon Web Services (AWS EMEA SARL / Amazon Web Services, Inc.) | Build environments, staging servers, application hosting, transactional email via Amazon SES | Luxembourg / United States | Regions as configured per project |
| OVH SAS | Build environments, staging servers, application hosting | France | European Union |
| Contabo GmbH | Build environments, staging servers, application hosting | Germany | Regions as configured per project |
| DigitalOcean LLC | Build environments, staging servers, application hosting | United States | Regions as configured per project |
| Cloudflare, Inc. | Object storage (R2), CDN, DNS, WAF and DDoS mitigation | United States | Global edge network; storage region as configured |
Artificial intelligence
We call model providers directly rather than through a routing intermediary. Both providers below exclude API content from model training under their commercial terms.
| Sub-processor | Purpose | Entity location | Processing location |
|---|---|---|---|
| Anthropic PBC | Model inference for code generation, specification and analysis | United States | United States |
| OpenAI (OpenAI Ireland Ltd / OpenAI, L.L.C.) | Model inference for code generation, specification and analysis | Ireland / United States | United States and European Union |
Business operations
| Sub-processor | Purpose | Entity location | Processing location |
|---|---|---|---|
| Google LLC (Google Workspace) | Business email, calendar, document storage, video conferencing | United States | Global |
| Zoho Corporation Pvt. Ltd. | Invoicing, accounting and bookkeeping | India | India |
| Payoneer Inc. | Payment collection and settlement | United States | United States |
| Skydo Technologies Pvt. Ltd. | Payment collection and settlement | India | India |
Providers we use as a controller
The following handle personal data for our own purposes and do not process customer project data. They are governed by our Privacy Policy rather than by the DPA.
| Provider | Purpose | Entity location |
|---|---|---|
| Google LLC (Google Analytics 4) | Website analytics on triophase.com, set only with your consent | United States |
| LinkedIn Corporation | Professional networking and manual outbound outreach | United States |
We do not purchase prospect databases and we do not operate automated outbound email sequences.
Project-specific sub-processors
Some engagements require a provider specific to that project — a payment gateway, an SMS gateway, a mapping service, or a hosting region nominated by the customer.
Where a provider is engaged at the customer's direction or specified in the accepted specification, it is treated as authorised by the customer for that project and recorded in the project documentation rather than added to this page. Customers may request a project-specific sub-processor register at any time from privacy@triophase.com.