1. Subprocessor Policy Overview

To deliver our retrieval-augmented generation (RAG) platform, Saathi Bot engages a strictly limited number of third-party infrastructure providers (“Subprocessors”).

Each subprocessor is selected based on stringent security criteria, including SOC 2 Type II compliance, robust tenant isolation, encryption standards, and a legal commitment not to utilize customer data or visitor queries to train public foundation models.

2. Current Infrastructure & AI Subprocessors

The following table represents our complete, active list of third-party subprocessors as of the last updated date:

Supabase Inc.

Singapore (AWS ap-southeast-1) / Global

Managed PostgreSQL, pgvector Vector Store, Object Storage & Authentication

Stores multi-tenant account records, document text chunks, 768-dim vector embeddings, and visitor chat sessions. Enforces Row-Level Security.

SOC 2 Type II, ISO 27001, HIPAA CompliantVendor Trust Page →

Google LLC (Gemini API)

United States & Global Data Centers

AI Vector Embeddings & LLM Inference Gateway

Generates 768-dimensional text embeddings (text-embedding-004) from ingested document chunks and powers grounded Q&A answering when Gemini provider is selected.

SOC 2/3, ISO 27001, GDPR / DPDP Compliant, Zero-Model-Training on Enterprise APIVendor Trust Page →

Groq Inc.

United States

Ultra-Fast LPU Inference Engine

Executes open-weight model completion (Llama 3.3 70B Versatile) for ultra-low latency streaming chat responses (300+ tokens/second).

SOC 2 Type II, Zero Data Retention for Commercial APIsVendor Trust Page →

Vercel Inc.

Global Edge Network (Anycast)

Web Hosting, Edge Network & Serverless Compute

Serves the marketing site, Next.js dashboard UI, SSRF verification middleware, and static widget JavaScript bundle via global CDN edge nodes.

SOC 2 Type II, ISO 27001, PCI-DSS Level 1Vendor Trust Page →

3. Notification of Subprocessor Changes

We provide customers with prior notice of any intended appointment of new subprocessors. Customers who have executed a formal Data Processing Agreement (DPA) will receive email notification at least thirty (30) calendar days prior to authorizing any new subprocessor to process customer personal data.

If you object to a new subprocessor on reasonable data protection grounds, you may terminate your subscription without penalty prior to the effective date.

4. Bring-Your-Own-Key (BYOK) Providers

If you configure your own custom API keys for providers such as Anthropic (Claude), OpenAI, or DeepSeek directly via your bot settings, those API calls are governed directly by your direct contractual agreement and terms with those respective model vendors.