Sub-Processors
Last updated: April 20, 2026
Skode Technologies Private Limited(CIN: U62011KL2026PTC102406) ("Skode," "we," "us," or "our") engages the following third-party sub-processors to assist in providing our Services. Each sub-processor is bound by a data processing agreement that requires them to process personal data in accordance with applicable data protection laws and our Data Processing Agreement.
This page is maintained in accordance with our obligation to provide transparency about the third parties that process data on behalf of our customers. We update this list when we add or remove sub-processors.
1. Cloud Infrastructure and Hosting
| Sub-Processor | Purpose | Data Processed | Location |
|---|---|---|---|
| Amazon Web Services (AWS) | Cloud infrastructure, database hosting, file storage (S3), transactional backups | All customer data, application data, file uploads | India — Mumbai (ap-south-1). We do not currently offer EU-based hosting. |
| Cloudflare | CDN, DDoS protection, DNS, web application firewall | IP addresses, request metadata, cached content | Global (edge network) |
| Vercel | Website hosting, serverless functions, edge deployment | Website traffic data, server-side request logs | United States, Global (edge) |
2. AI and Machine Learning
| Sub-Processor | Purpose | Data Processed | Location |
|---|---|---|---|
| OpenAI | Voice transcription (Whisper API), AI-powered CRM features (GPT-4o-mini), natural language processing | Voice recordings (transient, not stored), CRM text data for analysis, user prompts | United States |
| Anthropic | AI connector (Claude API) — CRM analysis, content generation, conversation intelligence | CRM text data from user-selected modules, user prompts | United States |
Note: OpenAI and Anthropic each process data under zero-data-retention API agreements. Data sent to these providers is not used for model training and is not retained after processing is complete. The AI Connector is opt-in at the workspace level and only processes data from modules explicitly selected by the connected user. See our AI Connector Terms for details.
Planned:Google LLC (Gemini API, via Google Cloud Vertex AI or the Gemini Developer API) is on our AI-provider roadmap but is not in active use today. When we activate Gemini, Google LLC will be added as an active AI sub-processor on this page with purpose, data categories, and location, and customers will receive the 30 days’ notice described in Section 9 below.
3. Payment Processing
| Sub-Processor | Purpose | Data Processed | Location |
|---|---|---|---|
| Stripe | Payment processing, subscription billing, invoicing, fraud detection (for non-India customers) | Billing name, email, card brand, last-4 digits and expiry, billing address, transaction history | United States |
| Razorpay | Payment processing, subscription billing, invoicing, UPI/NetBanking (for India customers) | Billing name, email, card brand, last-4 digits and expiry, UPI handle, billing address, transaction history | India |
Note: Both gateways are PCI DSS Level 1 certified. Full card numbers are processed and stored directly by the gateway and never touch Skode servers — we retain only the card brand, last-4 digits, and expiry returned by the gateway for display.
4. Email and Communication
| Sub-Processor | Purpose | Data Processed | Location |
|---|---|---|---|
| Zoho Mail (ZeptoMail) | Transactional email delivery (password resets, invoices, system notifications) | Recipient email addresses, email content, delivery metadata | India |
| Twilio | SMS messaging, voice calls, phone-number provisioning, call recording (only when the customer connects Twilio as their telephony provider) | Caller and recipient phone numbers, SMS content, call audio, call metadata | United States |
| Aircall | Cloud telephony, voice calls, call recording (only when the customer connects Aircall as their telephony provider) | Caller and recipient phone numbers, call audio, call metadata | France / European Union and United States |
| RingCentral | Cloud telephony, voice calls, call recording (only when the customer connects RingCentral as their telephony provider) | Caller and recipient phone numbers, call audio, call metadata | United States (with regional data centres) |
| Exotel | Cloud telephony, voice calls, call recording — primarily for India customers (only when the customer connects Exotel as their telephony provider) | Caller and recipient phone numbers, call audio, call metadata | India |
Note: Telephony sub-processors listed above are only engaged when a customer explicitly connects the corresponding provider in their workspace settings. Skode does not route calls through any of these providers by default.
5. Messaging Platforms
| Sub-Processor | Purpose | Data Processed | Location |
|---|---|---|---|
| Meta (WhatsApp Business API) | WhatsApp messaging, template messages, media delivery | Phone numbers, message content, media files, delivery status | United States, EU |
| Meta (Instagram Messaging API) | Instagram Direct messaging, automated responses | Instagram user IDs, message content, media files | United States |
| Meta (Facebook Messenger API) | Facebook Page messaging, comment management | Page-scoped user IDs, message content, media files, engagement data | United States |
6. Analytics and Monitoring
| Sub-Processor | Purpose | Data Processed | Location |
|---|---|---|---|
| Google Analytics | Website analytics, traffic analysis, user behavior tracking | IP addresses (anonymized), page views, session data, device information | United States |
| PostHog | Product analytics, session recording, feature flags | User interactions, session recordings, feature usage data | United States, EU |
| Sentry | Error tracking, performance monitoring, application debugging | Error logs, stack traces, user context (anonymized), performance metrics | United States |
7. Authentication and Security
| Sub-Processor | Purpose | Data Processed | Location |
|---|---|---|---|
| Google LLC (OAuth 2.0, Calendar, Gmail) | Optional “Sign in with Google”, and — if the user enables them — Google Calendar event sync and Gmail email tracking. Also applies to future Gemini Extension / Google Agentspace connector sessions initiated by the user. | Email address, name, profile picture, and (only for scopes the user explicitly authorises) calendar events and email metadata. Handled under the Google API Services User Data Policy Limited Use terms. | United States |
| Microsoft (OAuth 2.0) | Optional “Sign in with Microsoft” social login (only when the user chooses this sign-in method) | Email address, name, profile picture (as authorized by the user) | United States (global Microsoft Entra infrastructure) |
8. Customer Support
| Sub-Processor | Purpose | Data Processed | Location |
|---|---|---|---|
| Intercom | In-app messaging, customer support chat, help center | Name, email, conversation content, user attributes | United States |
8A. Browser Extension
The Skode Flow Chrome browser extension introduces no new sub-processors beyond those listed above. The extension is a client of the Skode Flow backend and uses only the same hosting, infrastructure, and ancillary processors already documented on this page. No additional vendors receive data because you install the extension. The extension also does not transmit any data to Skode-operated systems other than your own Skode Flow backend (and, if you opt in, anonymous usage telemetry).
9. Notification of Changes
We will notify customers of any changes to this sub-processor list at least 30 days before engaging a new sub-processor or changing the role of an existing one. Notifications are sent via email to the account administrator.
If you object to a new sub-processor, you may notify us within 30 days of the notification. We will work with you to address your concerns. If we cannot resolve the objection, you may terminate the affected Services in accordance with our Data Processing Agreement.
10. Data Processing Safeguards
All sub-processors are required to:
- Enter into a data processing agreement with Skode that imposes data protection obligations no less protective than those in our DPA.
- Implement appropriate technical and organizational security measures.
- Process personal data only as instructed by Skode and only for the purposes described above.
- Delete or return personal data upon termination of the sub-processing agreement.
- Submit to audits and inspections as required by applicable data protection laws.
11. International Data Transfers
Where sub-processors are located outside the European Economic Area (EEA) or other jurisdictions with data transfer restrictions, we ensure appropriate transfer mechanisms are in place, including EU Standard Contractual Clauses (SCCs) and UK International Data Transfer Agreements. For more information, see our Data Processing Agreement.
12. Contact Us
For questions about our sub-processors or data processing practices:
- Email: privacy@skode.ai
- DPA: View our Data Processing Agreement
- Privacy Policy: View our Privacy Policy