Subprocessors
SKIFIN IT SERVICES LLP uses the following third parties to process customer or user personal data in providing Droqify. This list is part of the Data Processing Agreement. Last updated 7 October 2026.
| Subprocessor | Purpose | Data | Location |
|---|---|---|---|
| Microsoft Azure (Microsoft Corporation) | Hosting and platform: Cosmos DB, Blob Storage, Service Bus, Container Apps, Key Vault, Application Insights and Log Analytics; Azure OpenAI (GPT-4.1, gpt-4o-mini, text-embedding-3-small); Azure AI Foundry, including the Mistral document-OCR model deployed there and Foundry agents; Microsoft Entra ID when a tenant uses single sign-on; optional Azure Document Intelligence / Content Understanding (off by default) | Customer Data, account data, audit and telemetry data | Azure region of the deployment (demo: Central India); production regions chosen per customer requirements and stated in the Order Form |
| Postmark (ActiveCampaign, LLC) | Transactional email: user invites, password reset, welcome messages; the droqify.com contact form and verification code | Recipient name and email address, message content; for the contact form, the details submitted and sender IP | United States |
| Razorpay (Razorpay Software Private Limited) | Online payment collection (cards, UPI, net banking), refunds and payment status. Used only when a customer pays an invoice online; it does not receive Customer Data | Billing contact name and email address, invoice number, amount and currency, payment status. Card and UPI details are entered directly on Razorpay's checkout and are never seen or stored by SKIFIN | India (and as set out in Razorpay's terms) |
| Google (Google LLC / Google Ireland Ltd) | Google Sign-In, only when a user chooses to sign in with Google. The sign-in script is loaded from accounts.google.com | Google account identifier, email, name, profile picture URL | As set out in Google's terms |
| Langfuse | Optional AI trace export. Off by default; enabled for a customer only with that customer's written consent and in line with its requirements | AI request and response traces, which may include document text. Hosting (self-hosted in the customer's own cloud, or Langfuse Cloud) and region are agreed per customer and recorded in the Order Form | Per customer agreement |
Not subprocessors
- Customer-directed destinations: webhooks, log sinks and integrations that a customer configures send data to destinations of the customer's choosing. These are not SKIFIN subprocessors.
- GitHub hosts our source code and build pipelines and does not receive customer data.
- For Private deployments, infrastructure in the customer's own Azure subscription is the customer's own arrangement with Microsoft.
Changes, notice and objection
We will give customers at least 30 days' notice before adding or replacing a subprocessor. Notice is sent by email to account administrators and to anyone subscribed to subprocessor updates; to subscribe, email contact@skifin.com with the subject "Subscribe: subprocessor updates". A customer may object on reasonable data-protection grounds within that period. We will then work with the customer in good faith to resolve the concern, and if we cannot, the customer may terminate the affected Service and receive a pro-rata refund of prepaid fees for the remaining term.
The refund terms are in our Cancellation and Refund Policy.