Subprocessors

Phyto Nex LLP engages a small number of carefully selected third parties ("subprocessors") to help deliver the Phyto Nex AI service. A subprocessor is any vendor or affiliate that may process personal data contained in Customer Data on our behalf. This page lists each of them, the purpose for which we use them, the data they can access, where processing takes place and the legal mechanism that protects any international transfer.

Every subprocessor is reviewed by our security and privacy teams before onboarding and reassessed annually. We check independent assurance reports (SOC 2 Type II or ISO/IEC 27001), sign a data processing agreement imposing obligations at least as protective as our own Data Processing Addendum at /legal/dpa, and limit each vendor to the minimum data required for its function. For example, our monitoring vendors receive operational logs that have already been scrubbed of names, email addresses, amounts and receipt text, and our billing provider never receives employee expense data at all.

Customer Data at rest is stored in the AWS region the customer selects at onboarding: US-East (N. Virginia, us-east-1) or Asia Pacific (Mumbai, ap-south-1). Subprocessors listed with a US location may process limited data in transit from either region, under the safeguards shown. Approved pushback messages are delivered to the customer's own Slack workspace, Microsoft Teams tenant or email domain, and from that point are governed by the customer's agreement with that provider.

Card numbers are truncated to the last four digits at ingestion, so no subprocessor receives a full primary account number. Language model requests to Anthropic, PBC are made under zero data retention terms, and no subprocessor is permitted to use Customer Data to train models.

This list is effective as of September 1, 2026. Where the DPA applies, it forms part of our customer agreements.

Software engineering, site reliability, customer onboarding and technical support are performed directly by personnel of Phyto Nex LLP in India. Personnel access Customer Data only when necessary to operate or support the service, through single sign-on, multi-factor authentication and just-in-time access controls, and only with a time-limited support grant from the customer for workspace-level access.

Phyto Nex LLP has no affiliates or subsidiaries that process Customer Data. Any change to that position will be announced on this page with the same 30-day notice that applies to new subprocessors.

We give at least 30 days' notice before a new subprocessor begins processing Customer Data. Notice is provided by updating this page and by emailing everyone subscribed to our subprocessor notification list. Customer administrators listed as privacy or security contacts in the application are subscribed automatically.

To subscribe an additional address, send an email to privacy@phytonexai.com with the subject line "Subscribe to subprocessor updates" and the name of your organization. We will confirm the subscription within two business days.

In an emergency, for example where a subprocessor suffers a security failure or ceases operation, we may need to replace it with less notice. In that case we will notify subscribers as soon as possible and explain the reason for the change.

Customers may object to a new subprocessor on reasonable grounds relating to data protection during the 30-day notice period.

1. Email privacy@phytonexai.com from an administrator account, naming the subprocessor and explaining the data protection concern.
2. Our privacy team acknowledges the objection within two business days and arranges a call with your privacy or security lead.
3. Where possible, we will propose an alternative, such as configuring your workspace so that the subprocessor does not process your data, or delaying the change for your account.
4. If we cannot resolve the objection within 30 days, you may terminate the affected service and receive a pro rata refund of prepaid fees, as set out in section 7 of the DPA.

For any other question about our subprocessors, contact our privacy team at privacy@phytonexai.com or our security team at security@phytonexai.com.