How we use sub-processors
A sub-processor is a provider that processes personal data for us so that a part of Assessly can work. Where we process an Institution's data as its Data Processor under the Digital Personal Data Protection Act, 2023, these providers process it on our instructions. Each one receives only what its function needs and is bound by contract to protect that data and to use it only to provide its service. We remain responsible to the Institution for what they do with its data.
The same list appears in the Data Processing Annex that we sign with colleges.
The Assessly Platform
| Provider | What it does | Personal data it receives | Where |
|---|---|---|---|
| Supabaseon Amazon Web Services | Database, sign-in, file storage (including proctoring images) and server functions. | All Institution Data and account data. | India (Mumbai) |
| Amazon Web ServicesMumbai region | Servers that run students' code, operated by Assessly. Desktop app updates. | Code students submit and its test input. | India (Mumbai) |
| Amazon Web ServicesUS East region | The live-update connection for chat and notifications on web and phone. | Account and Institution identifiers, name, online status and connection IP address. Not message text. | United States |
| VercelVercel Inc. | Hosts the web app. Vercel Web Analytics counts page views without cookies. | IP address, request data and page views with browser, device type and country. | Global network |
| CloudflareCloudflare, Inc. | DNS, network protection, Turnstile bot checks on forms and delivery of files. | IP address and request data. | Global network |
| OpenAIOpenAI, L.L.C. | AI grading and feedback, the Ace tutor, the staff assistant, interview dialogue and scoring and job tagging. | Answers, code, explanations, tutor messages, interview transcripts, CV text, and files and job description photos staff upload. Names only where they appear in that text. Not email addresses. | United States |
| DeepgramDeepgram, Inc. | Speech to text in AI mock interviews. | The student's voice during the interview. Assessly does not store the audio. | United States |
| CartesiaCartesia, Inc. | The AI interviewer's voice. | The interviewer's words, which can include the student's name. | United States |
| ResendResend, Inc. | Service emails such as sign-in codes, invitations and results. | Email address, name and the content of the message. | Outside India |
| SentryFunctional Software, Inc. | Error monitoring for the web, phone and desktop apps and our servers. On the web, a replay of the screen around an error, only for users who accept analytics cookies. | Web: account identifier, email address, role, Institution identifier, the error, page and browser, sent whatever the cookie choice; on-screen text in an error replay. Phone: account identifier and device details. Desktop: the error only. | European Union (Germany) |
| PostHogPostHog, Inc. | Product analytics for the web app: the pages, clicks and click positions of signed-in users, whatever the cookie choice. | Account identifier, name, email address, role, Institution, league, skill level and usage events. | United States |
| Better Stack | Uptime monitoring and the status page. Server error logs only if we turn them on. | None for uptime checks. Error details only if server error logs are turned on. | Outside India |
| Expo650 Industries, Inc. | Delivers phone notifications and app updates. | Device push token and notification text. | United States |
| Google and AppleFirebase Cloud Messaging, Apple Push Notification service | Deliver notifications to Android phones and iPhones. | Device push token and notification text. | Global |
| Google FontsGoogle LLC | Loads the fonts the web app uses. | IP address and browser details sent with the font request. | Global network |
This website
These providers serve assessly.in only.
| Provider | What it does | Personal data it receives | Where |
|---|---|---|---|
| CloudflareCloudflare, Inc. | Hosts assessly.in, network protection and Turnstile bot checks on forms. | IP address and request data. | Global network |
| PostHogPostHog, Inc. | Website analytics, only if you accept analytics cookies. Desktop app downloads and launches are counted without cookies, IP addresses or personal profiles. | Pages visited, clicks and a device identifier. | European Union (Frankfurt) |
| Cal.comCal.com, Inc. | Booking a demo or a drive call from the Website. | Name, email address and what you write in the booking. | Outside India |
| Supabase and Resend | Our servers in Mumbai receive the contact, demo, careers and bug bounty forms and send them to our mailbox by email. | What you enter in the form. | India (Mumbai); email outside India |
| Zoho MailZoho Corporation | Our mailboxes, including hello@ and grievance@, where form submissions and your emails to us arrive. | Your name, email address and message. | India |
Where data is processed
The database, file storage and code execution are in India, in the Amazon Web Services Mumbai region. The providers shown as outside India receive only what their function needs.
The DPDP Act permits transfers of personal data outside India except to countries the Central Government restricts. None of these locations is restricted today.
Changes and notice
This list is current. When we add or replace a provider that will receive personal data, we update the list. Institutions with a signed agreement are told by email before the change, as their agreement sets out (our standard terms give at least 15 days), and may object on reasonable data protection grounds.
Questions about a provider? Write to our Grievance Officer at grievance@assessly.in.