Legal
Subprocessor List
Last updated: August 15, 2026
This list describes the third-party processors HelpingGeeks engages to operate Creadefy at creadefy.com. They may process personal data on behalf of customers under our Data Processing Agreement. We remain responsible for their performance as set out in the DPA.
1. How we use sub-processors
A sub-processor is a third party we engage to process personal data so we can run the Service. We use them for hosting, CDN and edge security, storage, database, authentication, payments, email, support, analytics, and monitoring. Each vendor is bound by its terms with us. Transfer tools, where required, are described in the DPA.
Optional tools a customer connects on their own (for example a custom webhook) are not our sub-processors. The customer is responsible for those integrations.
2. Current sub-processors
Certifications below are those the vendor publishes for its own services. They are not Creadefy’s certifications. They can change. Use the vendor’s security or privacy page for the current list.
2.1 Vercel Inc.
- Description of Service: Vercel is a cloud platform for hosting websites and serverless functions, with a global CDN and edge network.
- Purpose of Processing: Application hosting, edge delivery, and serverless functions for creadefy.com.
- Location: Vercel Functions execute in us-east-1 (Washington, D.C., USA) and ap-south-1 (Mumbai, India). Edge delivery may use Vercel’s global network. Vercel is headquartered in the United States.
- Data processed: Request logs, account session traffic, and application data in transit as needed to serve the Service.
- Data Security Certifications: SOC 2 Type 2, ISO 27001:2022.
- Contact Information: [email protected]
- More information: Security and Privacy Policy.
2.2 Cloudflare, Inc.
- Description of Service: Cloudflare provides DNS, CDN, DDoS protection, and website security.
- Purpose of Processing: DNS, CDN, DDoS protection, and website security for creadefy.com.
- Location: Global anycast network; Cloudflare is headquartered in the United States.
- Data processed: IP addresses, request metadata, TLS, and security logs.
- Data Security Certifications: SOC 2 Type II, ISO 27001:2022.
- Contact Information: [email protected]
- More information: Security and Privacy Policy.
2.3 Amazon Web Services, Inc. (S3)
- Description of Service: Amazon S3 is object storage for files and media, with encryption, access controls, and regional storage.
- Purpose of Processing: Object storage for templates, issued credential images (PNG), profile images, and other uploads.
- Location: AWS region ap-south-1 (Mumbai, India).
- Data processed: Files you or your organisation upload, plus issued certificate and badge images.
- Data Security Certifications: SOC 2, ISO 27001.
- Contact Information: [email protected]
- More information: Security and Privacy Policy.
2.4 Cockroach Labs, Inc. (CockroachDB Cloud)
- Description of Service: CockroachDB Cloud is a managed distributed SQL database for operational application data.
- Purpose of Processing: Primary application database for accounts, organisations, events, recipients, and credential records.
- Location: Primary region Mumbai (ap-south-1), with additional regions Singapore (ap-southeast-1) and N. Virginia (us-east-1).
- Data processed: Account, organisation, billing metadata, recipient, and credential records (not full card numbers).
- Data Security Certifications: SOC 2 Type II, ISO 27001.
- Contact Information: [email protected]
- More information: Security and Privacy Policy.
2.5 Google LLC
- Description of Service: Google provides identity (OAuth), web analytics, bot protection (reCAPTCHA), and optional Google Wallet passes.
- Purpose of Processing: Google OAuth sign-in; Google Analytics on the marketing site; reCAPTCHA on selected forms; optional Google Wallet save for credentials.
- Location: Primarily United States / global Google infrastructure.
- Data processed: OAuth profile (name, email, image) if you sign in with Google; Analytics identifiers; reCAPTCHA telemetry; wallet pass data if the holder saves a credential.
- Data Security Certifications: SOC 2, ISO 27001.
- Contact Information: [email protected]
- More information: Security and Privacy Policy.
2.6 GitHub, Inc.
- Description of Service: GitHub is a software development platform. We use GitHub only for optional account sign-in via OAuth.
- Purpose of Processing: GitHub OAuth sign-in.
- Location: United States.
- Data processed: GitHub account identifiers, name, email, and avatar if you choose GitHub sign-in.
- Data Security Certifications: SOC 2 Type 2, ISO/IEC 27001:2022.
- Contact Information: [email protected]
- More information: Security and Privacy Policy.
2.7 Razorpay Software Private Limited
- Description of Service: Razorpay is an Indian payments and subscription billing platform for cards, UPI, netbanking, and related methods.
- Purpose of Processing: Payment processing and subscription billing for paid Creadefy plans.
- Location: India.
- Data processed: Billing contact details, order and payment identifiers. Full card numbers are handled by Razorpay, not stored on Creadefy.
- Data Security Certifications: PCI DSS, SOC 2, ISO 27001.
- Contact Information: [email protected]
- More information: Security and Privacy Policy.
2.8 Twilio Inc. (SendGrid)
- Description of Service: Twilio SendGrid is an email delivery platform for transactional and application email.
- Purpose of Processing: Transactional email (account verification, issuance notices, invitations, receipts).
- Location: Primarily United States.
- Data processed: Recipient email addresses and message content, which may include credential details the issuer chose to send.
- Data Security Certifications: SOC 2 Type 2, ISO/IEC 27001.
- Contact Information: [email protected]
- More information: Security and Privacy Policy.
2.9 Intercom, Inc.
- Description of Service: Intercom is a customer messaging platform for in-product and website support chat, help content, and related inbox tools.
- Purpose of Processing: In-product and marketing-site support chat (Messenger).
- Location: United States / Intercom infrastructure.
- Data processed: Chat messages, device data, and identity you share in Messenger.
- Data Security Certifications: SOC 2 Type II, ISO 27001:2022.
- Contact Information: [email protected]
- More information: Security and Privacy Policy.
2.10 Functional Software, Inc. (Sentry)
- Description of Service: Sentry is an application monitoring platform for errors, performance, and optional session replay.
- Purpose of Processing: Application error monitoring. Session Replay may run on the dashboard to diagnose product issues.
- Location: United States / Sentry cloud.
- Data processed: Error reports, device/browser data, and limited request context. Replay may capture on-screen product use in the dashboard.
- Data Security Certifications: SOC 2 Type II, ISO 27001.
- Contact Information: [email protected]
- More information: Security and Privacy Policy.
2.11 Sanity AS
- Description of Service: Sanity is a content platform for structured editorial content, used here for the public blog.
- Purpose of Processing: Content management for the public Creadefy blog and related marketing content.
- Location: Primarily EU (Sanity Cloud).
- Data processed: Editorial content for the public blog.
- Data Security Certifications: SOC 2 Type II.
- Contact Information: [email protected]
- More information: Security and Privacy Policy.
2.12 Unsplash (optional)
- Description of Service: Unsplash is a photography library and API. We use it only if a user searches for images in the template builder.
- Purpose of Processing: Optional image search in the template builder.
- Location: United States.
- Data processed: Search terms you type, if you use Unsplash in the template builder.
- Data Security Certifications: See Unsplash’s privacy policy.
- Contact Information: [email protected]
- More information: Security and Privacy Policy.
3. Changes
We may add, replace, or remove sub-processors as the Service changes. Notice and objection rights are in the DPA (at least 30 days’ notice; 14 days to object).
To receive email notice of new sub-processors, write to [email protected] with the subject “Subscribe to New Subprocessors”.
4. Contact
Questions about this list:
Creadefy
Operated by HelpingGeeks, India
Contact: [email protected]
Registered address of HelpingGeeks (not a staffed office; use email for all requests): Sonadih, Ballia, Uttar Pradesh, PIN 221715, India
Questions?
For account issues, verification problems, or general support, use the links below.