Subprocessor Registry
Third-party service providers that process data on behalf of Quintech LLC
Last updated: April 2026
How We Govern Subprocessors
Quintech applies the following standards to every subprocessor relationship before and during engagement:
Due diligence: All subprocessors are assessed before onboarding for their data protection practices, security certifications, and compliance posture. We do not engage subprocessors who cannot demonstrate adequate protections. Contractual obligations: Every subprocessor is bound by a Data Processing Agreement (DPA) that imposes obligations equivalent to those Quintech holds under GDPR, UK GDPR, and applicable Indian data protection law. Data minimisation: Subprocessors receive only the minimum data necessary to perform their contracted function. They are contractually prohibited from using personal data for any purpose beyond delivering their service to Quintech. Transfer safeguards: Where subprocessors are located outside the EU, EEA, or UK, we ensure appropriate transfer mechanisms are in place -- including Standard Contractual Clauses (SCCs), UK IDTA, or adequacy decisions. Ongoing monitoring: We review subprocessor security postures and compliance annually, and conduct ad-hoc reviews following any significant incident or material change to their service. Client notification: We will notify active clients at least 14 days before adding or materially changing a subprocessor. Clients may object to new subprocessors in accordance with their Data Processing Agreement.
AI and LLM Providers
These providers power the AI features within the Quintech Software Factory.
All personal data passed to LLM providers is subject to PII obfuscation at Quintech's LLM gateway layer before transmission -- meaning identifiable personal data is redacted or anonymised prior to reaching any model provider. PII obfuscation is a structural control that applies to all LLM API calls regardless of which provider is used.
| Provider | Purpose | Location | Transfer Basis | Data Shared |
|---|---|---|---|---|
| Anthropic | Claude model API for AI feature inference, agent orchestration, and content processing | United States | SCCs (EU) / IDTA (UK) | Obfuscated prompts & outputs |
| OpenAI | GPT model API -- optional routing for specific agent tasks where client-configured | United States | SCCs (EU) / IDTA (UK) | Obfuscated prompts & outputs |
| Google (Vertex AI / Gemini) | Gemini model API and Vertex AI infrastructure for multi-model routing | United States / EU | SCCs (EU) / IDTA (UK) / Adequacy (EU region) | Obfuscated prompts & outputs |
Cloud Infrastructure and Hosting
These providers host the Quintech platform infrastructure, databases, and application services. They process personal data as part of storing and transmitting platform data on our behalf.
| Provider | Purpose | Location | Transfer Basis | Data Shared |
|---|---|---|---|---|
| DigitalOcean | Primary cloud hosting for platform application servers, databases, and storage | United States / EU / UK | SCCs (EU) / IDTA (UK) | All platform data |
| Google Cloud Platform | Supplementary compute, managed Kubernetes (GKE), and cloud storage for specific workloads | United States / EU | SCCs (EU) / IDTA (UK) | Application & pipeline data |
| Bunny CDN | Content delivery network for static assets, media, and platform performance optimisation | Global (EU primary) | SCCs (EU) / IDTA (UK) | Static assets only -- no personal data |
| Cloudflare | DDoS protection, WAF, and DNS management | Global (EU primary) | SCCs (EU) / IDTA (UK) | IP addresses, request metadata |
Data Storage and Database Services
These providers supply the database and data storage infrastructure that underpins the Quintech platform and client workloads.
| Provider | Purpose | Location | Transfer Basis | Data Shared |
|---|---|---|---|---|
| MongoDB Atlas | Primary document database for platform application data, client workspaces, and agent state | United States / EU | SCCs (EU) / IDTA (UK) | Application & user data |
Observability, Monitoring, and Security
These providers supply the monitoring, alerting, and security tooling used by Quintech's Product & Engineering team to meet its managed services SLA commitments.
| Provider | Purpose | Location | Transfer Basis | Data Shared |
|---|---|---|---|---|
| Datadog | Full-stack monitoring, APM, real user monitoring (RUM), log management, and alerting | United States | SCCs (EU) / IDTA (UK) | Logs, metrics, traces -- no end-user PII |
| Zabbix | Network and server infrastructure monitoring and threshold alerting | Self-hosted / On-premise | N/A -- self-hosted | Infrastructure metrics only |
| PRTG / Paessler | Network performance monitoring and bandwidth telemetry | Germany / EU | Adequacy (EU) | Network metadata only |
| Sentry | Application error tracking and crash reporting for platform stability management | United States | SCCs (EU) / IDTA (UK) | Error logs, stack traces -- PII scrubbed |
Payment Processing
These providers handle billing, subscription management, and payment processing on behalf of Quintech. Quintech does not store payment card data -- all card processing is handled directly by our payment processors.
| Provider | Purpose | Location | Transfer Basis | Data Shared |
|---|---|---|---|---|
| Stripe | Subscription billing, invoice generation, payment card processing, and revenue management | United States / EU | SCCs (EU) / IDTA (UK) | Billing contact, payment metadata |
Communications and Notifications
These providers support Quintech's email, notification, and client communication infrastructure.
| Provider | Purpose | Location | Transfer Basis | Data Shared |
|---|---|---|---|---|
| Resend | Transactional email delivery for platform notifications, incident alerts, and account communications | United States | SCCs (EU) / IDTA (UK) | Email address, message content |
Analytics and Marketing
These providers support Quintech's website analytics and marketing operations. They are used on the public-facing quin-tech.ai website only and are subject to cookie consent requirements. They do not process personal data within the platform itself.
| Provider | Purpose | Location | Transfer Basis | Data Shared |
|---|---|---|---|---|
| Google Analytics GA4 | Website traffic analytics and user behaviour measurement on quin-tech.ai | United States | SCCs (EU) / IDTA (UK) | Pseudonymous usage data |
| HubSpot | CRM, lead management, email marketing, and prospect engagement for opted-in contacts | United States | SCCs (EU) / IDTA (UK) | Name, email, engagement data |
| LinkedIn Insight Tag | B2B campaign attribution and conversion tracking on quin-tech.ai | United States | SCCs (EU) / IDTA (UK) | Pseudonymous ad interaction data |
| Google Ads | Campaign conversion tracking and remarketing audience management | United States | SCCs (EU) / IDTA (UK) | Pseudonymous ad conversion data |
Development Tools and Productivity
These providers support Quintech's engineering and delivery operations. They may process limited personal data (such as names and email addresses of platform users or Quintech team members) in the course of software development and project delivery.
| Provider | Purpose | Location | Transfer Basis | Data Shared |
|---|---|---|---|---|
| GitHub / Microsoft | Code repository, version control, and CI/CD pipeline management | United States | SCCs (EU) / IDTA (UK) | Developer identifiers, code metadata |
| Linear | Sprint planning, issue tracking, and engineering backlog management | United States | SCCs (EU) / IDTA (UK) | Team member names, task data |
| Notion | Internal knowledge base, documentation, and SOW/SLA reference library | United States | SCCs (EU) / IDTA (UK) | Team member names, doc content |
| Vercel | Frontend application hosting and edge deployment for platform UI components | United States / EU | SCCs (EU) / IDTA (UK) | Request metadata, edge logs |
| Figma | UI/UX design tooling for platform and client product development | United States | SCCs (EU) / IDTA (UK) | Design files, team identifiers |
Subprocessor Change Process
Quintech reviews and updates its subprocessor list as our services evolve. The following process governs subprocessor changes:
New subprocessor: Quintech will notify active clients at least 14 days before a new subprocessor begins processing personal data. Notification will be sent by email to the designated data protection contact for the engagement.
Material change: Where an existing subprocessor materially changes its role, data location, or transfer mechanism, Quintech will notify clients within 14 days of Quintech becoming aware of the change.
Client objection: Clients who have signed a Data Processing Agreement with Quintech may object to a new or changed subprocessor within 14 days of notification. Quintech will work in good faith to accommodate valid objections; if no alternative can be agreed, the client may terminate the relevant services in accordance with the DPA.
Subprocessor removal: Where a subprocessor is removed or replaced, this registry will be updated within 30 days. Clients will be notified where the removal affects services they actively use.
Emergency changes: Where a subprocessor change is required urgently for security or legal compliance reasons, Quintech will notify clients as soon as practicable and provide a retrospective explanation.
To subscribe to subprocessor change notifications, email quin@quin-tech.ai with the subject line 'Subprocessor Updates'. You can also check the current version of this registry at quin-tech.ai/legal/subprocessors.
Contact Us
For questions about our subprocessors or data processing practices, please contact us at quin@quin-tech.ai.
| Field | Details |
|---|---|
| Company | Quintech LLC |
| quin@quin-tech.ai | |
| Website | quin-tech.ai |