← Back to SFADDON

Subprocessor List

Version 1.1 · Last updated: May 2026 · SFADDON Pte. Ltd. · Updated whenever the list changes

PurposeThis page lists every third-party service ("Subprocessor") that may process Customer personal data on behalf of SFADDON in connection with our products. It is a companion to the SFADDON Data Processing Agreement (DPA) and is published so Customers can review the current list at any time. SFADDON commits to notifying Customers at least 30 days before adding or materially changing a Subprocessor.
Data Controller
SFADDON India LLP, Pune, India
Privacy Contact
privacy@sfaddon.com
SubprocessorRoleDescriptionHosting RegionCustomer Data Processed
Vercel Inc.Hosting and CDNApplication hosting (compute), edge network, and object storage (Vercel Blob).Global edge network; object storage in Frankfurt, Germany (fra1)Application HTTPS requests; encrypted credentials in environment variables; private blob assets.
Neon, Inc.PostgreSQL databaseManaged PostgreSQL database for all customer and operational data.Frankfurt, Germany (eu-central-1)User accounts (email, hashed password); tenants; encrypted SuccessFactors credentials; scans, issues, scores, audit trail.
Upstash, Inc.Redis cachingManaged Redis for rate limiting and scan cooldown enforcement.United States and EU regionsAuthentication rate metadata (IP-keyed counters); per-tenant scan timestamp counters. No customer PII.
Inngest, Inc.Background job processingDurable background job execution for scan scheduling and async workflows.United StatesJob payloads containing tenant identifiers and scan parameters. No raw SuccessFactors PII.
Resend (Plus Five Five Inc.)Email deliveryTransactional email delivery for account notifications and reports.EU (Ireland, eu-west-1)Recipient email addresses and email body content for account verification, password reset, MFA, scheduled reports, and alerts.
Functional Software, Inc. (Sentry)Error monitoringApplication error tracking and performance monitoring.United States and EU regionsSanitized error context. PII transmission is disabled (sendDefaultPii: false) — no IP addresses, cookies, or email addresses transmitted.
Axiom, Inc.Log managementStructured log ingestion and querying for operational observability.United StatesApplication log events. Logs are structured to exclude raw SuccessFactors PII.
Anthropic, PBCAI / LLM processingAI language model (LLM) API for the VIGIL virtual assistant and AI Pattern Analysis features.United StatesVIGIL: user question + knowledge-base excerpts + abstract tenant context (counts, severities — no names). Pattern Analysis: abstract issue metadata only. No raw SuccessFactors PII transmitted.
Notification of ChangesSFADDON commits to notifying every Customer's primary security contact at least 30 days in advance of: adding a new Subprocessor that processes Customer personal data; changing the geographic processing region of an existing Subprocessor; or materially expanding the categories of Customer personal data processed by an existing Subprocessor.

A Customer who reasonably objects to a new Subprocessor on documented data-protection grounds may, within 30 days of notification, terminate the affected service component. The process is documented in the SFADDON DPA, Section 5.
To subscribe to change notifications, request the full DPA, or raise a data-protection question, email privacy@sfaddon.com.
SFADDON India LLP · Pune, India · Public copyPrivacy Policy · Terms of Service