# Sub-processors

_Effective 1 September 2026. Last updated 1 September 2026._

This page is the authoritative list of sub-processors engaged by **Yin Yang,
Inc.** (dba Elaichi) to process Customer Personal Data. It is mirrored in our
Trust Center at **[trust.elaichi.ai](https://trust.elaichi.ai)**. It is referenced by the
[Privacy Policy](/privacy/) and forms Annex III of the
[Data Processing Agreement](/dpa/).

## Current sub-processors

| Sub-processor | Purpose | Location |
|---|---|---|
| **Cloudflare, Inc.** | Hosting, compute, storage, queues, email delivery, rate limiting, and access control | Global, with EU/US jurisdiction pinning for organization data |
| **Stripe, Inc.** | Subscription billing and payment processing | USA |
| **OVH SAS** | Hosting of the self-hosted audit-log store | European Union |
| **Yin Yang Technologies Private Limited** | Engineering, operations, and support personnel; wholly owned affiliate of Yin Yang, Inc. | India |

We deliberately keep this list short. Every entry is a vendor we could not
provide the service without.

## Notification of changes

We give **at least 30 days' advance notice** before adding or replacing a
sub-processor. Subscribe to those notices in our Trust Center at
**[trust.elaichi.ai](https://trust.elaichi.ai)**, or email
**[dpa@elaichi.ai](mailto:dpa@elaichi.ai)** to be added to the list.

Customers may object to a new sub-processor on reasonable data protection
grounds within the notice period. If we cannot resolve the objection, the
customer may terminate the affected service without penalty and receive a
pro-rata refund of prepaid fees for the unused remainder of the term. The full
mechanism is in [section 6 of the DPA](/dpa/).

## Not sub-processors

The following are **not** our sub-processors. They are services your
organization elects to connect and configure under your own accounts and
agreements, and your relationship with each is governed by your agreement with
that provider — not by ours:

- **AI model providers** — Anthropic, OpenRouter, Fireworks, or any
  OpenAI-compatible endpoint, accessed with your own API key. See
  [section 6 of the Privacy Policy](/privacy/).
- **Log-forwarding destinations** you configure, such as Datadog.
- **Social login providers** — Google, GitHub, Microsoft.
- **Your identity provider**, for SSO and SCIM.
- **AWS KMS**, where you supply your own customer-managed key for BYOK.
- **Every SaaS product you connect** through a connector.

## Our own vendors, not sub-processors

**Google** (Analytics 4 and Ads measurement on our marketing site) processes
data for which **we are the controller** — website visitors, not customers'
users. It receives no Customer Data and cannot reach the third-party systems you
connect. It is disclosed in
[Privacy Policy §3](/privacy/) rather than listed above, because this page and
Annex III of the DPA cover sub-processors of *your* data.

## Onward obligations

Each sub-processor is bound by written terms no less protective than our
[DPA](/dpa/), and **we remain fully liable to you for their performance**.
Transfers outside the EEA, UK, or Switzerland rely on the Standard Contractual
Clauses as described in [section 7 of the DPA](/dpa/).

Questions: **[dpa@elaichi.ai](mailto:dpa@elaichi.ai)**