Version 2026-10-12, effective 2026-10-12
Sub-processors
DRAFT for legal review. Not final.
ADIS ("the Service") is operated by [TO CONFIRM: legal entity name, e.g. Spurtree Technologies Private Limited] ("Spurtree", "we"). To run the Service we use the third-party companies below. Some of them handle your Customer Content or personal data on our behalf. We call them sub-processors.
Sub-processors
| Sub-processor | What we use it for | Data it handles | Location | Link |
|---|---|---|---|---|
| Amazon Web Services (AWS): S3, KMS, SES, Batch, EC2, CloudWatch Logs | File and export storage (S3); wrapping each workspace's encryption key (KMS); sending account and notification emails (SES); running security scans in isolated jobs (Batch, EC2); service logs (CloudWatch) | Uploaded files and exports, encrypted keys, recipient email addresses and email content, source code during scans, operational logs | Default region ap-south-1 (Mumbai) in the code. [TO CONFIRM: production region for every AWS service, including S3 and SES] | [TO CONFIRM: AWS DPA / privacy link] |
| Amazon Web Services RDS (MySQL) | Main application database | Accounts, workspace data, tickets, requirements, audit logs, billing records | [TO CONFIRM: region; the code does not state it] | [TO CONFIRM: link] |
| WorkOS | Sign-in, single sign-on (SSO), session and identity data | Name, email address, profile picture, sign-in method, SSO connection details | United States [TO CONFIRM: WorkOS data location] | [TO CONFIRM: WorkOS privacy / DPA link] |
| Razorpay | Subscription billing, top-up payments, payment webhooks | Billing contact details, billing name, address, GSTIN, payment identifiers and status. Card and bank details are entered with Razorpay, not stored by us | India [TO CONFIRM] | [TO CONFIRM: Razorpay privacy link] |
| Anthropic | AI model provider (Claude). Produces AI outputs, including coding runs | The prompts we build from your Customer Content: requirements, tickets, code excerpts and project context | [TO CONFIRM: provider processing region] | [TO CONFIRM: Anthropic commercial terms / DPA link] |
| OpenAI | AI model provider (OpenAI / Codex models) | Same as Anthropic, when a workspace or project uses an OpenAI model | [TO CONFIRM: provider processing region] | [TO CONFIRM: OpenAI API terms / DPA link] |
| Pinecone | Vector search over ticket content | Ticket text and its embeddings, kept in a per-workspace area | [TO CONFIRM: Pinecone cloud and region] | [TO CONFIRM: Pinecone privacy / DPA link] |
| Neo4j | Knowledge graph of requirements, code and their links | Names and relationships derived from your repositories and requirements | [TO CONFIRM: Neo4j is self-hosted or Neo4j Aura. The code only reads a connection address from configuration] | [TO CONFIRM: link, if hosted by Neo4j] |
| [TO CONFIRM: email gateway if SES is not the only sender] | Transactional email | Recipient addresses | [TO CONFIRM] | [TO CONFIRM] |
| [TO CONFIRM: hosting / CDN / monitoring vendors not visible in this repository] | Hosting, monitoring, analytics | [TO CONFIRM] | [TO CONFIRM] | [TO CONFIRM] |
Notes:
- When a workspace supplies its own AI provider key, calls are made with that key and billed to that account. The provider still receives the content.
- Vector and graph data is separated per workspace in our systems and removed when a workspace is purged.
Services you connect
These are chosen and authorised by you. They are not our sub-processors. When you connect one, we read from it (and in some cases write to it) using credentials you give us. Their own terms and privacy policies apply to your use of them.
| Service | What it does for you |
|---|---|
| Jira / Atlassian | Import and sync requirements and tickets |
| GitHub | Read repositories, pull requests; open pull requests |
| Bitbucket | Read repositories, pull requests; open pull requests |
| Azure DevOps | Read repositories and work items |
| SonarQube or similar scanner servers you configure | Code quality results |
| Your mailbox (IMAP) for support tickets, if you enable it | Create tickets from email |
Credentials you give us for these services are stored encrypted with your workspace's key.
Public data sources
Our security scanning looks up known vulnerabilities in public databases such as OSV.dev. Those lookups contain package names and versions, not your source code.
Changes
We will update this list before adding a new sub-processor that handles Customer Content. [TO CONFIRM: notice method and period, for example 30 days by email to Owners.]
Questions: see the Contact section of the Privacy Policy.