Chattriix Colab Sign in to web app

Sub-Processors

Last updated: 9 May 2026

This page lists the third-party service providers ("sub-processors") that Nexa Lucent Technologies Ltd uses to operate Chattriix Colab. Each sub-processor is engaged under a Data Processing Agreement that imposes obligations no less protective than those in our Customer DPA.

We update this list when we add, remove, or change sub-processors. Customers on a paid plan are notified by email at least 14 days before a new sub-processor begins processing their data.

If you have any questions about how we use sub-processors, or if you'd like to object to a new one, contact legal@chattriix.com.

Current sub-processors

Infrastructure

Oracle Cloud Infrastructure (Oracle Corporation)

  • Purpose: Primary cloud hosting — application servers, databases, object storage.
  • Data accessed: All operational data (account records, encrypted message ciphertext, encrypted media, telemetry).
  • Plaintext message content: No — all message content is encrypted before storage.
  • Region: United Kingdom.
  • Transfer mechanism: Within UK (no cross-border transfer).
  • Provider's privacy info: https://www.oracle.com/legal/privacy/

Push notifications

Apple Push Notification Service (Apple Inc.)

  • Purpose: Delivering push notifications to iOS users.
  • Data accessed: Device push token; minimal notification hint payload (does not contain message content — devices fetch and decrypt content over our authenticated WebSocket).
  • Plaintext message content: No.
  • Region: United States.
  • Transfer mechanism: UK → US under appropriate UK GDPR safeguards.
  • Provider's privacy info: https://www.apple.com/legal/privacy/

Firebase Cloud Messaging (Google LLC)

  • Purpose: Delivering push notifications to Android users.
  • Data accessed: Device push token; minimal notification hint payload (no message content).
  • Plaintext message content: No.
  • Region: United States.
  • Transfer mechanism: UK → US under appropriate UK GDPR safeguards.
  • Provider's privacy info: https://policies.google.com/privacy

Observability and reliability

Sentry (Functional Software, Inc.)

  • Purpose: Error reporting and crash analytics. Helps us identify and fix bugs.
  • Data accessed: Stack traces, exception messages, application metadata. We configure Sentry's data scrubbers to strip personal data; we never include message content in error reports.
  • Plaintext message content: No.
  • Region: United States, with EU data residency available on request.
  • Transfer mechanism: UK → US under appropriate UK GDPR safeguards.
  • Provider's privacy info: https://sentry.io/privacy/

Grafana Labs (Grafana Cloud)

  • Purpose: Operational metrics, dashboards, and alerting.
  • Data accessed: Aggregate operational metrics — request rates, latency, error rates, infrastructure utilisation. No personal data, no message content.
  • Plaintext message content: No.
  • Region: EU.
  • Transfer mechanism: Within EU/UK (no cross-border transfer).
  • Provider's privacy info: https://grafana.com/legal/privacy-policy/

Certificates

Let's Encrypt / Internet Security Research Group (ISRG)

  • Purpose: TLS certificate issuance for our public domains.
  • Data accessed: Public domain names only (no user data).
  • Plaintext message content: No.
  • Region: Cross-border (CT log infrastructure is global).
  • Provider's privacy info: https://letsencrypt.org/privacy/
  • Note: Strictly speaking, ISRG is not a "sub-processor" under UK GDPR (they don't process personal data on our behalf), but we list them here for full transparency.

What sub-processors do NOT have access to

Regardless of which sub-processor it is, none of them have access to the plaintext content of your messages, voice notes, calls, or media. End-to-end encryption is performed in our client applications before data leaves your device. The ciphertext that transits or rests on infrastructure (ours or any sub-processor's) cannot be decrypted by us or by them.

Sub-processors we have considered but do NOT currently use

  • Third-party advertising networks: never used.
  • Cross-app analytics SDKs (Mixpanel, Amplitude, etc.): never used.
  • CDN / edge caching for user data: not needed; our caching is at the application tier and serves only public assets.

Notification of changes

We commit to:

  1. 14 days advance notice by email to organisational customers' designated administrators when adding a new sub-processor that will process their data.
  2. 30 days advance notice for any change that materially expands the categories of data a sub-processor accesses.
  3. Right to object: customers may object to a new sub-processor on reasonable grounds related to data protection. If we cannot resolve the objection, the affected portion of the agreement may be terminated by either party with prorated refund of pre-paid fees.

For more detail see the Data Processing Agreement Section 6.

Subscribe to changes

To be notified of changes to this page, email legal@chattriix.com asking to be added to the sub-processor change notification list. Free for everyone, including non-customers conducting due diligence.