Sub-processors & Cloud Infrastructure
In accordance with GDPR Article 28 and applicable data protection regulations, MintSaaS engages select third-party service providers to deliver hosting, database, payment, and delivery infrastructure.
MintSaaS (Operated by MintSaaS Solutions)
Vaishali Tech District, Jaipur 302021, India
08BZPPV2587L1Z8
Our Vendor Security & Due Diligence Standards
Prior to onboarding any third-party sub-processor, MintSaaS Solutions conducts comprehensive technical and compliance audits. All vendors must provide industry-standard security safeguards (such as SOC 2 Type II or ISO 27001 certifications) and execute enforceable Data Processing Agreements (DPAs) incorporating standard contractual clauses.
Authorized Sub-processors Registry
| Sub-processor | Purpose & Scope | Entity Location | Data Category | Security Baseline |
|---|---|---|---|---|
| Supabase, Inc. | Database hosting, user authentication & Row Level Security | United States / AWS US-East | User email, bcrypt password hash, order timestamps, license hashes | SOC 2 Type II, ISO 27001, HIPAA compliant infrastructure |
| Vercel Inc. | Edge hosting, serverless compute & Next.js frontend deployment | Global Edge Network / United States | IP address (anonymized), HTTP headers, request telemetry | SOC 2 Type II, ISO 27001, PCI-DSS Level 1 |
| Razorpay Software Pvt. Ltd. | Payment processing gateway (UPI, Cards, NetBanking) | India | Order amount, currency, customer email, billing details | PCI-DSS Level 1, ISO 27001, RBI licensed PA |
| Backblaze, Inc. | Encrypted cloud storage for software build artifacts & backups | United States | Software binaries, database backup snapshots (encrypted) | SOC 2 Type II compliant storage infrastructure |
| Resend, Inc. | Transactional email delivery for order receipts and license keys | United States | Recipient email, order confirmation receipt content | SOC 2 Type II compliant infrastructure |
| Google LLC (Google Analytics 4) | Optional aggregated web traffic analytics (STRICTLY opt-in via cookie banner) | United States | Anonymized page views, device type (zero PII, IP masked) | ISO 27001, SOC 2 / SOC 3, EU Standard Contractual Clauses |
Sub-processor Notification Policy
When we engage a new third-party sub-processor that accesses or processes customer personal data, we will update this public directory at least 30 calendar days prior to authorizing the new sub-processor to process data. Customers with enterprise Data Processing Agreements may subscribe to change notifications or object to material changes by writing to privacy@mintsaas.net.