Legal
Sub-processors
The third-party Sub-processors VentureSpin Private Limited engages to deliver the OneFinOps platform, the function each performs and where Personal Data is processed.
Last updated:
This page lists the Sub-processors that VentureSpin Private Limited (CIN: U62099TS2025PTC205120; “VentureSpin”, “we”, “us”) engages to deliver the OneFinOps platform (the “Service”). It supplements the Data Processing Addendum and the Privacy Policy.
1. Definitions
Capitalised terms not defined here have the meanings given in the Terms of Service, the Privacy Policy and the Data Processing Addendum.
- “Sub-processor” means a third party engaged by VentureSpin to process Customer Personal Data on behalf of the Customer in connection with the Service.
2. How we work with Sub-processors
Before engaging any Sub-processor, we carry out documented security, privacy and operational due diligence. Every Sub-processor is bound by a written contract that imposes confidentiality, security and breach-notification obligations no less protective than those in our DPA, and is restricted to processing Customer Personal Data only as needed to perform its specific function.
We re-assess Sub-processors at least annually and remove or replace any Sub-processor that no longer meets our standards.
3. Notice of changes
We will give Customers at least 30 days’ prior written notice of a new Sub-processor or a material change to an existing Sub-processor’s role before that change takes effect. Notice is given by email to the account owner and by updating this page.
If a Customer reasonably objects to a new or changed Sub-processor on data-protection grounds, the Customer may write to privacy@onefinops.com. If the parties cannot reach an acceptable resolution, the Customer’s sole remedy is termination of the affected portion of the Service for cause and a pro-rata refund of unused prepaid Fees, as described in the DPA.
4. Current Sub-processors
The list below covers the Sub-processors used in production at the date shown above. It is illustrative and may be updated; the live list at any given time is what’s published on this page.
Infrastructure and storage
| Sub-processor | Function | Region of processing |
|---|---|---|
| Amazon Web Services (AWS), Inc. | Primary cloud infrastructure - compute, storage, managed databases, networking, KMS, backups | Mumbai (ap-south-1), India |
| Amazon Web Services (AWS), Inc. | Object storage for Customer Data, attachments and document archives (S3) | Mumbai (ap-south-1), India |
| Cloudflare, Inc. | Edge CDN, DNS, DDoS protection and bot management for marketing surfaces | Global edge with Indian POPs |
Communication and notifications
| Sub-processor | Function | Region of processing |
|---|---|---|
| Amazon SES (Amazon Web Services, Inc.) | Transactional email delivery (account, billing, support, security notifications) | Mumbai, India and US (failover) |
| MSG91 / Gupshup (or equivalent Indian provider) | SMS and WhatsApp Business notifications for filing-day alerts and OTPs | India |
| Twilio, Inc. | Voice and SMS for international Customers | US, EU |
Customer support and engagement
| Sub-processor | Function | Region of processing |
|---|---|---|
| Intercom, Inc. (or equivalent) | In-app chat, support ticket management, knowledge base | US, EU |
| HubSpot, Inc. | CRM and lifecycle communication for prospects and Customers | US |
Observability and product analytics
| Sub-processor | Function | Region of processing |
|---|---|---|
| Sentry (Functional Software, Inc.) | Application error monitoring; stack traces and minimal user identifiers | US |
| PostHog, Inc. | Product usage analytics (with Customer consent where required) | US, EU |
| Datadog, Inc. (or equivalent) | Infrastructure monitoring, log management and alerting | US, EU |
Billing and identity
| Sub-processor | Function | Region of processing |
|---|---|---|
| Razorpay Software Private Limited | Domestic billing and payment processing for INR-denominated subscriptions | India |
| Stripe, Inc. | International billing and payment processing for non-INR Customers | US, EU |
| Auth0 (Okta, Inc.) | Identity, authentication and SSO management for the Service | EU, US |
Marketing and content infrastructure
| Sub-processor | Function | Region of processing |
|---|---|---|
| Vercel, Inc. | Hosting of the marketing website (onefinops.com) | Global edge with Indian POPs |
| Sanity.io | Headless CMS for marketing content | EU |
The “marketing and content infrastructure” Sub-processors handle visitor data on the marketing site only and do not process Customer Personal Data submitted to the Service.
5. Affiliates
VentureSpin Affiliates may also process Customer Personal Data on the same terms as VentureSpin under this DPA, where the Affiliate has signed an internal data-protection agreement at least as protective as our DPA. As of the date above, VentureSpin has no Affiliates outside India.
6. Subscribing to updates
To receive email notice when this page changes, write to privacy@onefinops.com from a verified Customer email and ask to be added to the Sub-processor change-notification list. Updates are also captured in our security-status digest and published on the System status page.
7. Contact
For questions about Sub-processors, change-notification preferences or to register an objection:
- Email: privacy@onefinops.com
- Post: Data Protection Officer, VentureSpin Private Limited, B-209, 2nd Floor, The Platina, Kondapur Road, Gachibowli, Hyderabad, Telangana, India - 500032.
Questions?
Email legal@onefinops.com for legal queries, or privacy@onefinops.com for privacy and data-protection requests.