1.Current subprocessors
Pikorua Security uses the 8 subprocessors below to deliver the service. Each one processes customer data only for the purpose shown and only under a written agreement with data protection terms at least as protective as our Data Processing Addendum. Every subprocessor below stores customer data in the United States.
| Subprocessor | Purpose | Customer data processed | Location |
|---|---|---|---|
 Amazon Web ServicesAmazon Web Services, Inc. | Cloud hosting: compute, database, object storage for COI and endorsement files, AWS KMS key management, backups | All customer data, including uploaded certificates, endorsement pages, contract exhibits and audit logs | United States (us-east-1, N. Virginia; us-west-2, Oregon)Data stays in the US regions listed |
 Google WorkspaceGoogle LLC | Internal email, calendar and documents used by our team when handling support and account correspondence | Customer user names, email addresses and the content of messages you send us | United StatesStandard Contractual Clauses where applicable |
 TwilioTwilio Inc. | SMS delivery for renewal reminders to vendors who opt in and for multi-factor authentication codes | Mobile phone numbers and message content (vendor name, due date, upload link) | United StatesStandard Contractual Clauses where applicable |
 SendGridTwilio Inc. (SendGrid) | Transactional email: deficiency notices to vendors and their brokers, renewal requests, account notifications | Recipient names and email addresses, message content, delivery and bounce events | United StatesStandard Contractual Clauses where applicable |
 DatadogDatadog, Inc. | Infrastructure monitoring, application performance and security alerting | System logs and metrics with personal data scrubbed before ingestion; user IDs and IP addresses | United States (US1 site)Standard Contractual Clauses where applicable |
 SentryFunctional Software, Inc. (Sentry) | Application error tracking and crash diagnostics | Stack traces, user IDs, browser and device metadata; request bodies and document content are excluded | United StatesStandard Contractual Clauses where applicable |
 StripeStripe, Inc. | Subscription billing, invoicing and card payment processing | Billing contact, company name, billing address, payment card data (held by Stripe, never by Pikorua Security) | United StatesStandard Contractual Clauses where applicable |
 ZendeskZendesk, Inc. | Customer support ticketing, help center and in-app support chat | Support requester names, email addresses, ticket content and any attachments you choose to send | United StatesStandard Contractual Clauses where applicable |
2.What is not on this list
Document AI is not outsourced. The models that read certificates and endorsement pages run inside our own AWS account, so no third-party AI provider receives your COIs, endorsements or contracts, and none is listed here. We never use customer documents to train models.
Integrations you connect yourself, such as Procore, Yardi Voyager, AppFolio, CMiC or an access-control platform, are not our subprocessors. You choose to send data to them under your own agreement with that provider, and you can disconnect them at any time.
Tools we use only for internal purposes, such as accounting, recruiting and our marketing website, do not receive customer data and are covered by our Privacy Policy instead.
3.How we choose and oversee subprocessors
Before a vendor can process customer data, our security team reviews its SOC 2 Type II or ISO/IEC 27001 report, its answers to our security questionnaire, its breach history and its contract terms. We give each subprocessor access only to the data its purpose needs: Sentry never receives request bodies or document content, and Datadog logs are scrubbed of personal data before ingestion.
We review every subprocessor again each year and whenever its service, ownership or data handling changes. Pikorua Security remains responsible for each subprocessor's performance of its obligations.
4.Staff access from India
Our engineering and support teams in Delhi, India, are Pikorua Security staff, not subprocessors. They can reach customer data only through approved, time-limited, logged sessions when needed to support or secure the service, as described in our Security Policy. Transfers of EU, UK and Swiss personal data are covered by the Standard Contractual Clauses in our DPA.
5.Notice of changes
We give at least 30 days' notice before a new subprocessor processes customer data. We update this page and email every subscriber. Customers may object on reasonable data protection grounds during the notice period by writing to dpo@pikoruasecurity.com, and the DPA sets out what happens next.
6.Change history
Annual review of all eight subprocessors. No additions or removals; Datadog log scrubbing rules extended to vendor taxpayer ID patterns.
Added Zendesk for support ticketing and in-app chat, replacing support handled through shared email inboxes.
First published list: Amazon Web Services, Google Workspace, Twilio, SendGrid, Datadog, Sentry and Stripe.