Document
Sub-processor List
Graine lists every vendor that processes customer personal data for it, with what each one is used for, the data it handles, where it processes that data and when it is used. A location is stated only where Graine's own configuration pins it; otherwise the list says "On request". Graine gives workspace Admins 30 days' notice before it adds or replaces a sub-processor, with a right to object, and says plainly that most vendors include processor terms in the terms Graine accepted, but Graine's copies are not yet on file.
Framework mapping
- SOC 2 CC9.2
- SOC 2 P6.4
- ISO 27001 A.5.19
- ISO 27001 A.5.20
- ISO 27001 A.5.21
- ISO 27001 A.5.22
- ISO 27001 A.5.23
- DPDP s.8(2)
- DPDP Rule 6(1)(f)
- DPDP s.16
- DPDP Rule 15
- GDPR Art. 28(2)
- GDPR Art. 28(4)
- GDPR Art. 46(2)(c)
These show which criteria the document is meant to serve. They are not a statement that an audit has found it effective.
Sub-processor List
| Document control | |
|---|---|
| Document ID | GR-PUB-05 |
| Version | 1.1 |
| Status | Approved |
| Owner | Privacy and Grievance Officer |
| Approved by | Rishabh Bhanot, Founder (top management), 3 Nov 2026 |
| Effective date | 3 Nov 2026 |
| Last updated | 4 Nov 2026 |
| Next review | By 3 Nov 2027 (12 months after approval), or on a significant change |
| Classification | Public |
| Applies to | The Graine AI business platform, and the vendors that process customer personal data on Graine's behalf |
1. What this list is
A sub-processor is a vendor that Graine AI (Mavrix AI Private Limited) engages to process a customer's personal data on Graine's behalf. This list names each one, why Graine uses it, what data it handles, where it processes that data, the basis for any transfer outside India, and when it is used.
Last updated 3 Nov 2026. Every row is true as of that date. The Trust Center at www.graine.ai/trust shows the same vendors. Graine's consumer mobile product is a separate product with its own privacy notice, and its vendors are not listed here.
2. How to read this list
| Column | What it tells you |
|---|---|
| Vendor | The company or service |
| Purpose | What Graine uses it for |
| Data it handles | The data that reaches the vendor |
| Location | Where the vendor processes the data, stated only where Graine's own configuration pins it |
| Transfer basis | The basis for processing outside India, and the status of processor terms with the vendor |
| Used when | Whether the vendor is always used, or only when a customer or a setting calls for it |
How to read "On request". "On request" means Graine has not pinned the location in its own configuration, and does not state a region it has not confirmed. Write to founders@graine.ai to ask where a vendor processes your data. Graine replies with what it has confirmed at that time, and says so where it has confirmed nothing. A location shown in the table is a location Graine has configured; written confirmation from each vendor is Being rolled out.
How to read "Transfer basis". Each row uses these short forms:
| Short form | Meaning |
|---|---|
| In India | The vendor processes the data in India, so there is no transfer outside India |
| DPDP s.16 | DPDP Act s.16: transfers are allowed except to countries the Government restricts; none is notified as of 3 Nov 2026. Rule 15 adds that a transfer is subject to any requirement the Government specifies, from 13 May 2027 |
| DPDP s.16 if outside India | The location is "On request", so Graine cannot yet say whether the processing leaves India. If it does, DPDP s.16 applies as above |
| Processor terms: in the vendor's terms | The vendor's data processing terms are part of, or incorporated in, the terms Graine accepted. Graine does not yet have its own signed or downloaded copy on file (as of 4 Nov 2026) |
| Processor terms: offered | The vendor offers data processing terms on request, in its app, with a cover page or with an order form. None is signed or on file yet |
| Processor terms: none published | The vendor publishes no data processing terms. Obtaining terms, or replacing the vendor, is Planned |
| Processor terms: per provider | It depends on the provider a customer chooses. No copy is on file for any of them yet |
| Own controller | The vendor acts for itself under its own agreement, not as Graine's processor |
| UK adequacy (EU data) | For EU personal data, the United Kingdom has an adequacy decision from the European Union |
| SCCs | Standard Contractual Clauses (offered with the Data Processing Addendum, or DPA), for EU or UK personal data |
3. Hosting and storage
| Vendor | Purpose | Data it handles | Location | Transfer basis | Used when |
|---|---|---|---|---|---|
| Amazon Web Services | Hosting for the call platform: compute, load balancing, an execution store, and stored audio and documents | What the platform processes while it runs (call details, phone numbers, transcripts, agent settings), plus stored audio, invoices and business-verification documents | India (Mumbai) | In India · Processor terms: in the vendor's terms · SCCs | Always |
| Amazon Web Services: Secrets Manager | Stores API keys, and the carrier and push credentials that customers connect | API keys; carrier account credentials; push-notification credentials | United States (N. Virginia) for API keys; India (Mumbai) for carrier and push credentials | DPDP s.16 (API keys) · In India (carrier and push credentials) · Processor terms: in the vendor's terms · SCCs | Always |
| MongoDB Atlas | Primary database | Agent settings; call records, transcripts and their analysis; contacts and campaigns, including phone numbers; the audit trail | On request | DPDP s.16 if outside India · Processor terms: in the vendor's terms · SCCs | Always |
| Wasabi | Object storage for call recordings and voice-clone samples | Call recordings; voice samples | United Kingdom | DPDP s.16 · UK adequacy (EU data) · Processor terms: in the vendor's terms · SCCs | When a call is recorded or a voice is cloned |
| Vercel | Hosts the website and dashboard and the endpoints the in-app SDK and web widget use; page-view analytics and speed measurements, with consent | Dashboard sessions; workspace users' account details; in-app session requests; page views | India (Mumbai) for the dashboard's main API functions; others on request | In India (main API functions) · DPDP s.16 if outside India (others) · Processor terms: in the vendor's terms (paid plans) · SCCs | Always for the dashboard; analytics only with consent |
| Neon | The dashboard's database | Workspace users and organisations; billing and invoices; workflows; consent records; the dashboard activity log; requests sent through the website | On request | DPDP s.16 if outside India · Processor terms: in the vendor's terms · SCCs | Always |
| LanceDB Cloud | Search index for agent knowledge bases | Text chunks and embeddings of the documents a customer uploads | United States (N. Virginia) | DPDP s.16 · Processor terms: none published · SCCs | When an agent uses a knowledge base |
4. AI, speech and voice
| Vendor | Purpose | Data it handles | Location | Transfer basis | Used when |
|---|---|---|---|---|---|
| Microsoft Azure OpenAI | Language model for the agents that use it, and for post-call summaries, translation, analysis and checks | Conversation text and transcripts; prompts, including the variables a customer supplies | On request | DPDP s.16 if outside India · Processor terms: in the vendor's terms · SCCs | For agents that use it, and for post-call processing |
| OpenAI | Language-model fallback, and the dashboard's call evaluations, assistant and voice-studio helper | Transcripts; prompts; evaluation conversations | On request | DPDP s.16 if outside India · Processor terms: in the vendor's terms · SCCs | As a fallback, and when a customer uses evaluations, the assistant or the voice-studio helper |
| Groq | Language model for agents that select it, and a last-resort fallback | Transcripts; prompts | On request | DPDP s.16 if outside India · Processor terms: in the vendor's terms · SCCs | When selected for an agent, and as a last-resort fallback |
| Sarvam AI | Speech-to-text, text-to-speech, language detection, transliteration, a language model when selected, and reading uploaded knowledge-base documents | Call audio; transcripts; text to be spoken; uploaded documents | On request | DPDP s.16 if outside India · Processor terms: in the vendor's terms · SCCs | When selected for an agent, and when a knowledge-base document is read |
| Deepgram | Speech-to-text (the platform's fallback), and text-to-speech when selected | Call audio; text to be spoken | On request | DPDP s.16 if outside India · Processor terms: offered · SCCs | As the speech-to-text fallback, and when selected for an agent |
| Gnani | Speech-to-text when selected for an agent | Call audio | On request | DPDP s.16 if outside India · Processor terms: none published · SCCs | When selected for an agent |
| ElevenLabs | Text-to-speech, and speech-to-text when selected | Text to be spoken; call audio when used for speech-to-text | On request | DPDP s.16 if outside India · Processor terms: in the vendor's terms · SCCs | When selected for an agent |
| Cartesia | Text-to-speech, and voice cloning for the Voice Library | Text to be spoken; recordings submitted for cloning | On request | DPDP s.16 if outside India · Processor terms: in the vendor's terms · SCCs | When selected for an agent, and when a member clones a voice |
| TimePay | Text-to-speech when selected for an agent | Text to be spoken | On request | DPDP s.16 if outside India · Processor terms: none published · SCCs | When selected for an agent |
| Amazon Web Services: Polly | Fallback text-to-speech when an agent has no voice set | Text to be spoken | India (Mumbai) | In India · Processor terms: in the vendor's terms · SCCs | When an agent has no voice set |
| mem0 | Agent memory for returning users, only when a customer turns memory on for an agent | Redacted facts from conversations, keyed by a one-way hashed user id | On request | DPDP s.16 if outside India · Processor terms: offered · SCCs | Only when memory is turned on for an agent |
5. Telephony and real-time media
| Vendor | Purpose | Data it handles | Location | Transfer basis | Used when |
|---|---|---|---|---|---|
| jambonz.cloud | Call control and media for workspaces set up on the hosted voice network | Call audio; phone numbers; call events | On request | DPDP s.16 if outside India · Processor terms: none published · SCCs | For workspaces on the hosted voice network |
| Exotel | Telephone carrier, on the customer's Exotel account or Graine's | Call audio; phone numbers; the carrier's own call recordings | On request | DPDP s.16 if outside India · Processor terms: offered · SCCs | When calls use Exotel |
| Twilio | Telephone carrier, where one is set up for a workspace | Call audio; phone numbers | On request | DPDP s.16 if outside India · Processor terms: in the vendor's terms · SCCs | Where set up for a workspace |
| Metered | Relays web and in-app calls when a direct connection isn't possible | Encrypted call media in transit; IP addresses | On request | DPDP s.16 if outside India · Processor terms: in the vendor's terms · SCCs | When a direct connection isn't possible |
6. Business and communications
| Vendor | Purpose | Data it handles | Location | Transfer basis | Used when |
|---|---|---|---|---|---|
| Stytch | Sign-in for workspace users | Names, email addresses, workspace membership and sessions | On request | DPDP s.16 if outside India · Processor terms: in the vendor's terms · SCCs | Always |
| Brevo | Email: invitations, sign-in codes, approval notices, invoices, alerts and the replies to the website's forms | Names; email addresses; invoice details | On request | DPDP s.16 if outside India · Processor terms: in the vendor's terms · SCCs | Whenever Graine sends one of these emails |
| OneSignal | Browser notifications for the approvals inbox, for people who turn them on | The member id, the browser's notification subscription, and the notification's text, which can name a colleague and an agent or campaign | On request | DPDP s.16 if outside India · Processor terms: offered · SCCs | Only for people who turn on browser notifications |
| PayU | Payments for wallet top-ups | Payer name, email address and phone number; the amount | On request | DPDP s.16 if outside India · Own controller · SCCs | When a wallet top-up is paid |
| Surepass | Checks a GSTIN during business verification | GSTIN and registered business details | On request | DPDP s.16 if outside India · Processor terms: none published · SCCs | During business verification |
| Crisp | Support chat on the website and in the dashboard, once the user agrees to it | Name, email address and chat messages | On request | DPDP s.16 if outside India · Processor terms: offered · SCCs | Only after the user agrees |
| Google Analytics | Website analytics, when switched on and once the visitor agrees to it | Page views; IP address; device details | On request | DPDP s.16 if outside India · Processor terms: offered · SCCs | Only when switched on, and after consent |
| ipapi.co | Shows the viewer's approximate location in Call History | The viewer's IP address | On request | DPDP s.16 if outside India · Processor terms: in the vendor's terms · SCCs | When someone views Call History |
| Google Fonts, jsDelivr, Cloudinary, Tencent EdgeOne | Fonts and static files for the website and dashboard | The visitor's IP address | On request | DPDP s.16 if outside India · Processor terms: in the terms of jsDelivr and EdgeOne; offered by Cloudinary; none published by Google Fonts · SCCs | When a page loads |
7. Monitoring and engineering
| Vendor | Purpose | Data it handles | Location | Transfer basis | Used when |
|---|---|---|---|---|---|
| Better Stack | Uptime heartbeats, and log storage when enabled | Service logs, which can contain phone numbers and fragments of transcripts until masked logging is fully rolled out | On request | DPDP s.16 if outside India · Processor terms: in the vendor's terms · SCCs | Heartbeats: always. Log storage: when enabled |
Tools that never handle customer personal data (source hosting, container registries and DNS) are not listed.
8. Providers a customer selects for an agent
A customer-selected provider is a speech, language or search provider that a customer chooses for an agent. These providers process prompts, text or audio only when a customer selects one. They are named here so that nobody is surprised.
| Purpose | Providers | Data it handles | Location | Transfer basis | Used when |
|---|---|---|---|---|---|
| Alternative language models | Anthropic, Google Gemini, Together AI, OpenRouter, AWS Bedrock, Cohere, DeepInfra, Perplexity, DeepSeek, Fireworks AI | Prompts; conversation text | On request | DPDP s.16 if outside India · Processor terms: per provider · SCCs | Only when selected for an agent |
| Alternative speech-to-text and text-to-speech | AssemblyAI, Gladia, Soniox, Kalpa, Maya, Navana, Gemini, Azure AI Speech, Smallest.ai, Rime | Call audio; text to be spoken | On request | DPDP s.16 if outside India · Processor terms: per provider · SCCs | Only when selected for an agent |
| Language-switch judge for multilingual agents | TypeSafe | Prompts or text | On request | DPDP s.16 if outside India · Processor terms: in the vendor's terms · SCCs | Only when selected for a multilingual agent |
| Web search in workflows and agent tools | Firecrawl, Exa, Parallel, Tavily | Search queries | On request | DPDP s.16 if outside India · Processor terms: per provider · SCCs | Only when a workflow or agent tool searches the web |
Whose processor is it? Most of these providers need the customer's own key and account. Where a customer connects a provider with its own account, the provider is the customer's processor, not Graine's, and the customer's agreement with it applies. Where Graine holds the account, the provider is Graine's sub-processor for that agent, and the notice commitments in section 10 apply to it.
Further speech and language providers may be selected per agent; each is added here before it processes customer data.
9. Customer-connected services
A customer's own carrier or SIP trunk, WhatsApp Business account, push-notification credentials, APIs, MCP servers and workflow integrations (a CRM, a calendar, a ticketing tool) run on the customer's own accounts. Graine acts on the customer's instructions when it uses them. They are the customer's processors, not Graine's sub-processors, and the customer is responsible for its agreements with them.
10. How changes are announced
- Graine gives at least 30 days' written notice before it adds or replaces a sub-processor, or changes where one processes customer personal data.
- The notice goes by email to the Admins of each workspace, and as a dated entry in the Revision history of this page.
- A customer may object on reasonable data-protection grounds by writing to founders@graine.ai within the notice period.
- Graine then works with the customer to meet the objection. The Data Processing Addendum sets out what happens if the two cannot agree. Where no addendum has been signed, the outcome is agreed between the customer and Graine.
The detailed objection terms are in the Data Processing Addendum, which is available on request.
11. Processor terms, vendors' own sub-processors, and training
As of 4 Nov 2026, Graine has no signed or downloaded data processing agreement on file with any vendor on this list. Most of the vendors include data processing terms in the terms Graine accepted, and some offer them on request, in their app or with an order form; a few publish none (see the Transfer basis column). Filing those copies, obtaining terms where a vendor has none, confirming each vendor's region in writing and reviewing the vendor's assurance reports are Planned.
Vendors can use sub-processors of their own. This list does not show them. Obtaining each vendor's own list is part of the same work.
Graine does not use customer data to train or fine-tune AI models. What AI and speech vendors do with data sent to them is set by their own terms. Graine has read each vendor's published terms: several of the vendors above use content to improve their models by default unless the customer opts out, and Twilio's terms, which also govern Stytch, let it use customer content for its own purposes with no opt-out. Graine has decided to opt out wherever a vendor allows it: the setting for Deepgram is built and being switched on (Being rolled out), and the opt-outs in the other vendors' settings are owner actions (Planned).
12. Contact
Questions, objections and requests for the Data Processing Addendum go to founders@graine.ai. The Security Overview describes how Graine protects the data these vendors handle.
Revision history
| Version | Date | Change | Approved by |
|---|---|---|---|
| 1.0 | 2026-11-03 | First issue, approved | Rishabh Bhanot, Founder |
| 1.1 | 2026-11-04 | Recordings' storage location corrected: the United Kingdom (Wasabi eu-west-3), not France; vendor training defaults stated; vendors' processor terms stated (in their terms or offered; Graine's copy not yet on file) | Correction; the approval of 3 Nov 2026 stands |