Subprocessors
The third parties we use to deliver the service, what each one processes, and where.
Last updated 2026-07-28
RegShield processes your data as described in our data processing agreement. The vendors below are the only third parties that data reaches. Our database, cache and object storage run on our own infrastructure, so uploaded evidence files are not handed to anyone else.
| Subprocessor | Purpose | Data processed | Region |
|---|---|---|---|
| Google Cloud Platform | Infrastructure hosting | All workspace data — evidence files, documents and database contents. | India (asia-south1) |
| OpenAI | Evidence analysis and AI drafting | The text or image content of evidence you submit for analysis, and the prompts behind AI-drafted policies and questionnaire answers. | United States |
| Resend | Transactional email | Recipient name and email address, and the contents of the notification (for example a drift alert or an invitation). | United States |
Data residency
Production data is hosted in India. Two subprocessors process limited data outside India: evidence text sent to OpenAI for the analysis you request, and notification contents sent to Resend. Both are covered by data-processing agreements with appropriate transfer safeguards. Under OpenAI's API terms, data submitted through the API is not used to train their models.
Changes to this list
No changes since this list was first published. We give notice before adding a subprocessor that processes customer data, so you have the opportunity to object. Changes will be recorded here with the date. To be notified directly, email info@regshield.in.
Questions about any vendor on this list, or need a copy for a vendor review? info@regshield.in