Sub-processors
Last updated: September 2026
Fluxeta is operated by Decipher Consultancy Services. To provide the platform we rely on a small number of vetted third-party sub-processors. This page lists every sub-processor with access to customer data, what they do, where they process, and the legal safeguards in place.
1. Current sub-processors
The following third parties process Fluxeta customer data on our behalf under a written data-processing agreement. This list is exhaustive as of the date above.
Infrastructure & hosting
| Sub-processor | Purpose | Region | Data categories |
|---|---|---|---|
| OVHcloud | Primary application hosting (compute, database) | India (Mumbai) | All platform data (encrypted at rest and in transit) |
| Amazon Web Services — S3, SES, SNS | Object storage, transactional + newsletter email delivery, bounce/complaint webhooks | India (ap-south-1) | Uploaded media, email addresses, email content, bounce metadata |
| Cloudflare | DNS, CDN, DDoS protection, edge TLS termination | Global edge network | IP address, request metadata (anonymised after 30 days) |
Payments
| Sub-processor | Purpose | Region | Data categories |
|---|---|---|---|
| Razorpay Software Pvt. Ltd. | Payment processing for INR transactions (Indian customers) | India | Name, email, billing address, payment token, transaction metadata |
| Dodo Payments (pending activation for non-INR transactions) | Merchant-of-record for international transactions, including global tax remittance | USA / Global | Name, email, billing address, payment token, transaction metadata |
| Zoho Books | Tax-compliant invoice generation for Indian customers | India | Name, email, billing address, GSTIN |
AI & content
| Sub-processor | Purpose | Region | Data categories |
|---|---|---|---|
| Anthropic (Claude API) | AI writing assistant, content analysis, "Ask My Site" | USA | Content you submit to AI features. Prompts and responses are not used to train Anthropic models under their zero-retention API policy. |
Operations
| Sub-processor | Purpose | Region | Data categories |
|---|---|---|---|
| GitHub | Source-code hosting, CI/CD deployment pipeline | USA | No customer data (source code only) |
2. Legal safeguards
Every sub-processor listed above is bound by a written contract that requires them to:
- Process customer data only on documented instructions from Fluxeta
- Ensure personnel authorised to process the data are subject to confidentiality obligations
- Implement appropriate technical and organisational security measures
- Assist us in complying with data-subject rights requests
- Delete or return all customer data at the end of the service term
- Undergo independent audits where applicable (SOC 2, ISO 27001)
For international data transfers (for example, to Anthropic in the USA), we rely on Standard Contractual Clauses (SCCs) approved by the European Commission where GDPR applies, and equivalent contractual mechanisms elsewhere.
3. Change notifications
We update this page whenever we add, replace, or remove a sub-processor. To receive email notification of changes at least 30 days before a new sub-processor starts processing customer data, email [email protected] with the subject "Subscribe to sub-processor updates" from your account email.
4. Right to object
If you have signed a Data Processing Addendum with us and object to a new sub-processor on reasonable grounds (for example, incompatibility with your own compliance obligations), you may terminate the affected service by written notice within 30 days of our change notification. In that case we will refund any pre-paid fees for the unused portion of the current billing period, notwithstanding our general refund policy.
5. Contact
Decipher Consultancy Services
Data protection enquiries: [email protected]
Grievance officer (India): Subesh Kumar — [email protected]
295, Block C, Sushant Lok III, Sector 57, Gurugram, Haryana – 122003, India
For the full data-processing terms applicable to enterprise customers, see our Data Processing Addendum.