Authorized Subprocessors Directory
Transparent public registry of third-party infrastructure and service vendors authorized to process personal data on behalf of omniHR.
LEGAL NOTICE & CUSTOMIZATION ADVISORY
This policy contains baseline provisions tailored for a B2B Human Resource Management System (HRMS) handling payroll, biometric attendance, tax, and employee records under India's Digital Personal Data Protection Act, 2023 (DPDPA) and global privacy frameworks (including GDPR). Bracketed values such as [COMPANY_NAME], [PRIVACY_EMAIL], and statutory grievance officer details must be verified by qualified legal counsel prior to commercial execution.
To deliver our enterprise HRMS SaaS platform, omniHR engages third-party service providers ("Subprocessors") to perform specific data processing functions on our behalf.
Prior to onboarding any new Subprocessor, our security and privacy teams execute a stringent vendor assessment evaluating data security posture, encryption capabilities, regional data residency compliance, and business continuity readiness. All Subprocessors are contractually bound under written DPAs containing privacy protections no less stringent than those set forth in our Data Processing Agreement.
The following entity provides cloud servers, managed databases, and encrypted storage volumes:
| Subprocessor Entity | Role / Service Performed | Data Processed | Hosting Jurisdiction |
|---|---|---|---|
| [CLOUD_HOSTING_PROVIDER_PLACEHOLDER, e.g., AWS / Google Cloud / Azure] | Cloud virtual machine hosting, Kubernetes clusters, and encrypted database volumes. | All Customer Data (encrypted at rest via AES-256). | [India Data Center / APAC / Customer Region] |
| [DATABASE_BACKUP_PROVIDER_PLACEHOLDER] | Encrypted object storage repository for disaster recovery snapshots. | Encrypted database snapshots and transaction log archives. | [India / Primary Region] |
The following vendors deliver transactional communications, authentication OTPs, and error telemetry:
| Subprocessor Entity | Role / Service Performed | Data Processed | Transfer Safeguard |
|---|---|---|---|
| [TRANSACTIONAL_EMAIL_PROVIDER_PLACEHOLDER] | Dispatches password resets, payslip notifications, and manager approval requests. | Employee email address, name, notification subject line. | DPA with Standard Contractual Clauses (SCCs). |
| [SMS_2FA_GATEWAY_PLACEHOLDER] | Relays SMS verification codes for two-factor authentication and urgent punch alerts. | Mobile phone number, one-time passcode (OTP). | Local Telecom Service Provider DPA. |
| [ERROR_DIAGNOSTICS_PROVIDER_PLACEHOLDER] | Monitors client-side front-end crashes and API response latency. | Pseudonymized stack traces, browser user-agent, error line numbers (no salary/tax data). | Data Masking + DPA. |
Before engaging any new subprocessor that accesses or processes customer personal data:
- 30-Day Advance Notice: We will provide at least thirty (30) days prior written notice to registered customer tenant administrators via email or an in-app compliance bulletin.
- Right to Object: If Customer has reasonable data protection or security objections to a proposed subprocessor, Customer must notify us in writing within thirty (30) days.
- Resolution & Termination: If the parties cannot resolve the objection, Customer may terminate the affected service without penalty by providing written notice prior to the subprocessor's operational commencement.
Receive automated email notifications whenever an addition or replacement to this directory is proposed.