Third-party and sub-processor list
Core service providers
| Provider | Purpose | Data categories potentially processed |
|---|---|---|
| Cloudflare | Web build, deployment, edge delivery, and security services | Release artefacts, request metadata, deployment metadata, and logs |
| Supabase | Database, identity, APIs, storage, realtime, serverless workflows, backups, and logs | Application identities, customer and policy records, workflow and finance records, documents, and service metadata |
| Sentry | Error, performance, replay, log, and release diagnostics | Diagnostic context, device/request metadata, selected replay data, release metadata, and source maps |
Business and communications providers
| Provider | Purpose | Data categories potentially processed |
|---|---|---|
| Gallabox / WhatsApp | Customer messaging and delivery events | Contact number, message fields, provider references, and delivery or response status |
| VoiceIQ | Assisted calling and call analysis | Contact number, approved customer or vehicle context, recording, transcript, and analysis |
| GOOD / Coverstack | Insurance quote handoff | Contact number and vehicle-registration information required for the quote flow |
| Razorpay | Payment links and payment events | Customer or transaction reference, amount, payment metadata, method, status, and time |
| Credit Mantri | Credit-product enrolment and partner workflow | Customer and product details, payment context, and encrypted partner payloads |
| Brevo | Operational email delivery | Approved recipient, message content, and report attachment |
Browser-direct services
QuickChart, jsDelivr, WhatsApp links, and Unsplash receive normal request metadata and, for some flows, user-approved payload content. Browser-direct use is reviewed for minimisation because URL data is recorded by the browser, network intermediaries, or provider according to the active integration.
Governance requirements
Before relying on this as a contractual register, confirm the legal entity, service owner, purpose, data categories, hosting region, retention, security terms, incident contact, sub-processors, transfer mechanism, deletion/return process, and contract status for every provider. Review at least annually and before adding or materially changing a provider.
Supplier assurance record
| Domain | Required evidence |
|---|---|
| Ownership and contract | Service owner, contracting entity, agreement status, renewal, spend owner, and termination authority |
| Processing | Purpose, data subjects, field categories, controller/processor role, onward processors, region, transfer mechanism, retention, deletion, and return |
| Security | Independent assurance where available, encryption, access control, vulnerability handling, logging, backup, continuity, and secure-development evidence |
| Integration | Authentication method, credential owner, callback verification, network destinations, rate limits, retry, idempotency, payload schema, and failure behavior |
| Incident | Security contact, notification deadline, cooperation duties, forensic evidence availability, and customer-communication coordination |
| Continuity | Service objectives, status channel, export method, recovery dependency, manual workaround, and data reconciliation process |
| Exit | Credential revocation, integration disablement, data export, deletion confirmation, replacement dependency, and residual-record treatment |
Change control
A new or materially changed provider does not enter production solely because integration code exists. Technical review verifies purpose, payload, credentials, authentication, callback behavior, failure states, logging, and data minimisation. Business and privacy review confirms contract, processing terms, region, retention, incident obligations, and exit. The register records approval before production enablement and records disablement plus deletion or return evidence at exit.
Provider incident and exit procedure
For a provider incident, FinTrack identifies the affected integration, data classes, tenants, transactions, credentials, and time window; disables or restricts the integration when continued use creates unacceptable risk; rotates uncertain credentials; preserves provider and application evidence; reconciles delayed or duplicate events; and communicates under the incident plan. Provider status is not treated as proof that FinTrack data and workflows are complete or correct.
Exit disables outbound and callback paths, revokes credentials, removes provider membership, exports required business evidence, confirms data return or deletion, updates notices and the processor register, removes browser destinations and dependencies, and validates that no scheduled or queued work continues to send data. Historical financial, communication, or audit evidence is retained only under the approved legal and business schedule.