Contents
The short version
- Six companies help us run Stratum: Vercel, Anthropic, Razorpay, Resend, Google and Plausible. They are listed below with what they see and where.
- Razorpay processes our payments. We never store your card details.
- Every one is under written terms, and none may train models on your data.
- The ledger, bank and mailbox providers you connect are your choice and are listed separately.
- We tell you at least 30 days before adding or replacing one. You can object, and if we cannot resolve it, you can leave with a refund of prepaid fees.
1. What this list is
A subprocessor is a company that Aniketh Marian, sole proprietor, trading as DA SUAN ENTERPRISES and Stratum AI ("Stratum", "we", "us") engages to help provide the service, and that may process personal data for us as part of it: client data, or the billing data we hold about our clients. Each one is bound by written terms that protect the data at least as well as our Data processing addendum. This page is Annex 3 of that addendum.
Our own team, working from New York, USA, also processes client data under the same controls.
2. Current subprocessors
| Name | Purpose | Data involved | Location | Transfer mechanism |
|---|---|---|---|---|
| Vercel Inc. | Hosting of the website and application, and request logs | All client data processed by the application; IP addresses and browser details in logs | USA | EU Standard Contractual Clauses and UK Addendum |
| Anthropic PBC | AI processing for the agents. Contractually barred from training models on client data | The ledger records, transactions, documents and message content an agent needs for a task | USA | EU Standard Contractual Clauses and UK Addendum |
| Razorpay Software Private Limited | Payment processing for our fees. Stratum never stores card details | Name, email and payment details, handled by Razorpay on its own checkout. We receive only the payment reference, amount, status, name, email and company | India | Razorpay's written merchant terms. Payment data is processed in India |
| Resend | Sending transactional email, such as notifications, approval requests and website form messages to Stratumai.co@gmail.com | Recipient names and email addresses, and message content | USA | EU US Data Privacy Framework and UK Extension, and EU Standard Contractual Clauses |
| Google LLC (Gmail) | The Stratumai.co@gmail.com mailbox, where your emails and website form messages arrive | Names, email addresses and the content of messages you send us | USA | EU US Data Privacy Framework and UK Extension, and EU Standard Contractual Clauses |
| Plausible Analytics | Cookieless website analytics | No personal data. Aggregated page views, referrers, browser, device and country | EU (Germany) | No transfer outside the EU |
3. Services you connect
These are not our subprocessors. You choose them, you have your own contract with each, and your data sits there under that contract. We list them so you can see the full path of your data. We read from them and, within your approval thresholds, write to them only on your instructions. We connect email or bank data only where you choose to connect it.
| Service | What we do there | Data involved | Location |
|---|---|---|---|
| QuickBooks Online | Read ledger records through OAuth; draft journal entries and apply payments within your thresholds | Customers, vendors, invoices, bills, payments, accounts | As set by your agreement with the provider |
| Your bank or bank feed provider, if you connect it | Read only access to bank transactions for reconciliation. The agents never move money | Bank transactions, account names and masked account numbers | As set by your agreement with the provider |
| Your mailbox provider, such as Google Workspace or Gmail, if you connect it | Read relevant email and documents; send payment reminders from your mailbox on your rules | Email content, attachments, contact details | As set by your agreement with the provider |
| Slack, if you connect it | Send approval requests and summaries; read channels you choose | Message content, user names | As set by your agreement with the provider |
4. How we add a subprocessor
- We review its security and privacy practices and sign written data protection terms with it.
- At least 30 days before it starts processing client personal data, we email the account owner of every client and update this page, with the name, purpose, data and location.
- In an emergency, such as a subprocessor failing in a way that puts the service or your data at risk, we may replace it on shorter notice and tell you as soon as possible. The right to object still applies.
Want notice sent to someone else too? Email Stratumai.co@gmail.com with their address.
5. How to object
Email Stratumai.co@gmail.com within the 30 day notice period and tell us your data protection concern. We will work with you in good faith, for example by not using the new subprocessor for your data. If we cannot resolve it within 30 days, you can end the affected service by written notice and we will refund prepaid fees for the unused period.
Questions about this document: Stratumai.co@gmail.com.