Legal
Sub-processors
Askery uses the vendors below to deliver the service. Every row says exactly what they do, the data they touch, and where they sit. Referenced from our Privacy Policy and DPA.
Last updated .
| Sub-processor | Purpose | Data | Location |
|---|---|---|---|
| Supabase (managed Postgres + Auth) | Primary database; user authentication; storage for uploaded files. | Forms, responses, user accounts, file uploads, workspace metadata. | Singapore (ap-southeast-1) |
| Microsoft Azure (AKS + ACR + Blob + Front Door) | Application hosting (Kubernetes), container registry, static asset CDN, web traffic edge. | Compute + cached static assets only; no customer data is stored on Azure outside of the running pods. | South India (Pune) for compute; Front Door edge POPs worldwide. |
| Brevo (transactional email) | Sending invite, password-reset, response-notification and result-ready emails. | Recipient email address; the body of the email being sent. | EU (France). |
| Google (Gemini API + Workspace APIs) | LLM backing AI features (form generation, AI editing, Form Intelligence Smart Rules, Decision Engine code generation, brand-from-URL, AI insights) via the Gemini API. Also powers optional per-workspace Google Sheets sync, Google Calendar events, and Google Meet links — only when the workspace owner explicitly connects their Google account. | For Gemini: form briefs, response answers when AI is explicitly invoked on that form, workspace name. For Workspace APIs: OAuth tokens encrypted at rest plus the sheet rows / calendar events you ask us to write. Google does not use Gemini API data to train models per its API terms. | Global, governed by Google's terms. |
| Razorpay (payment processing) | Processing subscription payments for paid plans. Only customer billing details — never respondent answers. | Billing name, email, address, and payment instrument details (handled directly by Razorpay; we never see the card). | India. |
| Cloudflare (DNS + Turnstile) | DNS for askery.app; Turnstile anti-abuse challenge — rolling out, enabled only on forms where the owner has explicitly turned it on. | IP addresses of respondents during a Turnstile challenge; standard DNS query metadata. | Global edge. |
How this list is maintained
We update this page when a sub-processor is added, removed, or changes role. Material changes are also announced on the changelog. Customers under a signed DPA receive prior written notice of new sub-processors per the terms agreed there.
Questions?
For a signed DPA, sub-processor-change notification preferences, or specific regional-residency requirements, contact us.