Annex - Sub-Processor Register
This register is reviewed and updated periodically.
Nuclei engages a limited number of trusted third-party sub-processors to support hosting, communication, analytics, and operational delivery of our services.
The table below lists the current categories of sub-processors, the Nuclei entity responsible, processing purpose, location of data centres, and international-transfer safeguards.
Each sub-processor is bound by written Data Processing Agreements and, where applicable, Standard Contractual Clauses (SCCs) or equivalent safeguards.
For European Region Clients :
Nuclei has two entities in picture
- Contracting Entity : CDNA Technologies Pvt Ltd (India)
- Operational Entity : Nuclei Technologies Unipessoal Lda (Portugal)
| Category / Function | Sub-Processor (Name) | Purpose of Processing | Data Location | Transfer Safeguard |
|---|---|---|---|---|
| Cloud Hosting / Infrastructure | Amazon Web Services (AWS EU) | Hosting and operation of SDK and platform services | EU | SCCs, EU Adequacy Decision |
| Payment Processing | PayPal EU (Braintree) | Transaction authorisation and settlement | EU | EU Adequacy Decision |
| Giftcard Purchase | Hurray (EU) | To fulfil gift card orders | EU | EU Adequacy Decision |
| Giftcard Purchase | Cashwave | To fulfil gift card orders | EU | EU Adequacy Decision |
| Email and SMS Delivery | Twilio Inc. | Transactional and system emails and SMS | US/EU | EU-U.S. Data Privacy Framework |
| SMS Delivery | Gupshup | Transactional Messages Delivery | EU / India | SCC |
| AI Support Services | Microsoft Azure OpenAI and Speech Services | Chat and voice AI support processing | EU / US | SCCs, Data Privacy Framework |
| Analytics | CleverTap (IN) | To provide analytics | EU / IN | SCC |
| Customer Support | FreshDesk | Handling Customer Raised Tickets | India | SCC |
Notes:
- All infrastructures listed above are administered and monitored by authorised Nuclei personnel located in India under intra-group Data Processing Agreements and Standard Contractual Clauses (SCCs).
This remote administrative access does not change the physical hosting location indicated for each sub-processor
- When new sub-processors are engaged or replaced, updates will be published here, and affected controllers will be notified in advance as required by their DPA.