EasyOTP Subprocessor List

Operated by Braintech Corporation Private Limited

Effective Date: August 2025

1. Introduction

This Subprocessor List identifies the third-party subprocessors that Braintech Corporation Pvt. Ltd. ('Braintech', 'we', 'our') engages to assist in providing EasyOTP Services, including authentication (OTP, Magic Link, QR), A2P messaging, and scan validation products. Subprocessors may process limited personal data as necessary to deliver our Services.

2. Subprocessor Commitments

Braintech ensures that all subprocessors:

• Are bound by written agreements ensuring appropriate confidentiality, security, and data protection obligations.
• Process personal data only as necessary to provide services to Braintech and EasyOTP vendors.
• Implement technical and organizational measures aligned with industry standards (ISO 27001, SOC 2, GDPR, HIPAA, DPDP, and CCPA).
• Support compliance with user consent, data residency, and cross-border data transfer requirements.

3. Current Subprocessors

Subprocessor	Purpose	Data Processed	Region
Amazon Web Services (AWS)	Cloud hosting & infrastructure	Account metadata, authentication logs	US, EU, India, Singapore
Google Firebase	Push notifications & analytics	Device tokens, usage metadata	Global
Cloudflare	Content delivery & DDoS protection	IP addresses, traffic metadata	Global
SendGrid (Twilio)	Transactional email delivery	Vendor/admin emails, notifications	US/EU
WhatsApp Business API (Meta)	Fallback OTP/A2P delivery	Phone numbers, message payloads	Region of recipient
SMS Gateway Providers	Fallback OTP/A2P delivery via SMS	Phone numbers, message payloads	Region of recipient

4. Notification of Changes

• Braintech may update this Subprocessor List from time to time.
• Vendors will be notified via dashboard and/or email of material changes.
• Vendors may object to new subprocessors where legally permitted, within 30 days of notification.

5. Data Residency and Transfers

• Data is stored regionally: US (US users), EU (EU/EEA users), India (Indian users), and Singapore (rest of world).
• Cross-border transfers are protected by Standard Contractual Clauses (SCCs), HIPAA BAAs, or equivalent safeguards.
• Subprocessors are contractually required to honor Braintech’s data residency and security policies.

6. Contact

For questions regarding subprocessors, please contact:

Braintech Corporation Private Limited
Email: contact@easyotp.com
Website: https://easyotp.com

7. Version Control

Version	Date	Description of Changes	Approved By
1.0	Aug 2025	Initial Subprocessor List published for EasyOTP services.	Legal/Compliance