Subprocessor Register Template

Purpose

This register names the third parties that process, store or can access customer data on behalf of Hybrowlabs Technologies Pvt Ltd. It is published so that a customer can see our supply chain without having to ask for it.

Third parties that supply Hybrowlabs without access to customer data are not listed here. The distinction between a vendor and a subprocessor is set out in the Vendor / Subprocessor Management Policy.

How to read this register

Not every entry applies to every engagement. Which subprocessors are involved in your account depends on how your environment is hosted and which integrations are in scope.

Where you host on your own infrastructure or your own Frappe Cloud account, no hosting subprocessor is introduced by us. Our people access your environment under your contracts.

Where Hybrowlabs hosts or manages the environment, the hosting and backup entries apply.

Integration subprocessors apply only where that integration is part of your scope.

If you need the list scoped to your specific engagement, we will provide it in writing.

Standing subprocessors

These apply across engagements unless your contract states otherwise.

Subprocessor	Service provided	Customer data involved	Processing location	Applies to
[Provider name]	Source code hosting	Customer-specific application code and configuration	[Region]	All development engagements
[Provider name]	Email and business productivity	Customer correspondence and attachments	[Region]	All engagements
[Provider name]	Ticketing and support desk	Support requests, screenshots, log files and attachments	[Region]	All support engagements
[Provider name]	Background verification	Personnel data of Hybrowlabs staff, not customer data	[Region]	Internal, personnel only

Hosting and infrastructure

These apply only where Hybrowlabs hosts or manages the environment.

Subprocessor	Service provided	Customer data involved	Processing location	Applies to
[Provider name]	Application and database hosting	Full ERP dataset	[Region]	Hosted engagements
[Provider name]	Backup and disaster recovery	Database backups and file attachments	[Region]	Hosted engagements

Integration subprocessors

These apply only where the integration forms part of your scope and are named in the relevant SOW.

Subprocessor	Service provided	Customer data involved	Processing location	Applies to
[Provider name]	E-invoicing and GST filing	Invoice and tax data	[Region]	Engagements with statutory e-invoicing in scope
[Provider name]	SMS and messaging gateway	Recipient numbers and message content	[Region]	Engagements with messaging in scope
[Provider name]	Payment gateway	Transaction and payer data	[Region]	Engagements with payment integration in scope

Where you nominate the provider for an integration, that provider is your selection and your contractual relationship. We record it here for completeness and note it as customer-directed.

Subcontracted personnel

Where delivery personnel are supplied through a subcontracting organisation, that organisation is a subprocessor and is named to the affected customer before its people are assigned.

Subprocessor	Service provided	Customer data involved	Processing location	Applies to
[Organisation name, or "None currently engaged"]	Supply of delivery personnel	Access equivalent to assigned Hybrowlabs personnel	[Location]	[Named engagements]

Subcontracted personnel are verified, trained and bound under the same terms as employees. The requirements are set out in the Vendor / Subprocessor Management Policy.

Fields maintained internally

The published register above is an extract. The internal register additionally records, for each entry:

• Business owner within Hybrowlabs
• Date of assessment and the assessment outcome
• Approval date and approver
• Contract reference and status
• Security certifications held and their expiry
• Incident notification timeline agreed
• Their own subprocessors, where disclosed
• Access scope and the date of the last access review
• Next scheduled review date
• Offboarding status and deletion confirmation where the relationship has ended

These fields are available for customer due diligence or audit on request.

Adding a subprocessor

• The proposed subprocessor is assessed under the Vendor / Subprocessor Management Policy
• The Director records approval before any customer data is shared
• Affected customers are notified in advance and given a period to object
• The register is updated and the change log entry created
• Where a customer objects on reasonable grounds, we look for an alternative or retain the existing arrangement for that account

No entry is added to this register retrospectively.

Removing a subprocessor

• Access is revoked and integrations disabled
• Data is returned or deleted, with written confirmation obtained
• Credentials the subprocessor could have observed are rotated
• The entry is moved to the change log with its removal date
• Affected customers are informed

Change log

Changes to this register are recorded here and retained. Customers relying on advance notice can verify it against this log.

Date	Change	Subprocessor	Customers notified
[date]	[Added / Removed / Changed]	[Provider name]	[Date notice issued]

Review

The register is reviewed annually in full and immediately on the addition or removal of a subprocessor, a change in service scope or data location, a change in a subprocessor's own subcontracting arrangements, a reported incident, or a customer request.

Related documents

• Vendor / Subprocessor Management Policy
• HR Security Policy
• Acceptable Use Policy
• Background Verification Process
• NDA / Confidentiality Agreement Structure

Need this scoped to your engagement?

If your security or procurement team requires the subprocessor list specific to your account, evidence of an assessment, or confirmation of a data processing location, our team can respond directly.