Sub-processor List

Effective Date: 7 August 2026 · Version 2.1
We maintain this list current. Changes are notified to account administrators (Section 6); the Effective Date above changes whenever a sub-processor is added or removed.

1. Introduction

To provide the OPS360 services, we engage third-party service providers (“Sub-processors”) to process personal data. This page maintains a current list of these sub-processors, their roles, and their data processing locations. As per our Data Processing Agreement (DPA), we conduct due diligence on the security and compliance of all sub-processors before engagement. OPS360 serves customers operating in the UK, India, and USA.

2. Infrastructure & Core Platform

These providers host the fundamental infrastructure of the OPS360 platform.

Microsoft Azure: Purpose: Cloud hosting, computing, object storage (Blob Storage), monitoring. Processing Location: Region-Pinned: strictly within your selected Operating Region (UK, India, or USA). Data Transfer Mechanism: DPA / SCCs / UK IDTA
MongoDB Atlas, Purpose: Managed database services for application data. Processing Location: Region-Pinned: clusters deployed strictly within your selected Operating Region. Data Transfer Mechanism: DPA / SCCs / UK IDTA

3. Functional Sub-processors

These providers deliver specific features within the application.

WhatsApp Business (Meta), Purpose: Delivery of WhatsApp messages and notifications. Processing Location: Global / USA. Notes: Only if WhatsApp integration is enabled.
Firebase (Google), Purpose: Push notifications and mobile app analytics/crash reporting. Processing Location: Global / USA. Notes: Mobile app functionality; analytics only with consent.
Stripe, Purpose: Payment processing and subscription management. Processing Location: Global / USA. Notes: Card transactions.
PayPal, Purpose: Payment processing. Processing Location: Global / USA. Notes: Optional payment method.
Razorpay, Purpose: Payment processing (India). Processing Location: India. Notes: Primary gateway for Indian tenants.
Azure OpenAI, Purpose: AI features (chatbot, summarization). Processing Location: Region-pinned where the service is available in-region; otherwise the feature is disabled by default or requires your documented instruction. Notes: Data not used to train base models.
Anthropic (Claude), Purpose: AI features (Market Lens SEO & competitor intelligence, content generation). Processing Location: Global / USA. Notes: Only if the relevant AI feature is used; data not used to train base models.
Google (Gemini), Purpose: Generative AI features (Document Intelligence, Social Planner content). Processing Location: Global / USA. Notes: Only if the relevant AI feature is used; data not used to train base models.
Google Vision API, Purpose: OCR / image analysis for documents. Processing Location: Global. Notes: Stateless (images not stored).
Google Analytics, Purpose: Web platform usage analytics. Processing Location: Global / USA. Notes: Loaded only with analytics-cookie consent.
Google Business Profile, Purpose: Read and reply to your Google reviews via the Review Manager (only for locations you connect). Processing Location: Global / USA. Notes: Access granted by your OAuth consent; usage adheres to the Google API Services User Data Policy (Limited Use). Revoke any time by disconnecting the location.

4. Support & Operations

Tools used by our internal teams to support your account.

Microsoft Azure Communication Services (Email), Purpose: Transactional email (password reset, alerts, notifications) and marketing email sent by customers to their own contacts, including engagement tracking (open and click measurement) where the customer has enabled it on their sending domain. Engagement tracking is off by default and is controlled per sending domain by the customer, who is the controller for those messages. Location: Region-aligned with the Operating Region where available
LinkedIn (Microsoft), Purpose: Publishing posts to a customer's own LinkedIn profile or Pages through Social Planner, and returning engagement figures for those posts, where the customer has connected a LinkedIn account. Location: Global
Customer support / ticketing tooling, Purpose: Support case management and helpdesk. Location: Global

5. Regional Deployment & Localization Policy

Source: DPA Annex B

Region-Pinned Infrastructure: core infrastructure (Azure, MongoDB Atlas) is always deployed within the customer’s selected Operating Region (UK, India, or USA).
Feature Availability: if a functional sub-processor cannot offer in-region processing, that feature is disabled by default; enabling it requires your explicit, documented instruction acknowledging the cross-border transfer with appropriate safeguards.

6. Updates & Notifications

Source: DPA Section 6.2

We notify account administrators of any change to this list (addition or removal of a sub-processor). Customers may object to a new sub-processor within 30 days of notification on legitimate data-protection grounds; we will work to provide an alternative or, failing that, the affected feature may be disabled.