Legal
Effective June 26, 2026
The infrastructure and AI partners we rely on to deliver Assessly securely and at scale, and how we hold them to India's data-protection standards.
To run Assessly's code execution, AI evaluation, and voice-interview features reliably, we rely on a small, named set of third-party infrastructure and AI providers. They are our subprocessors: under the Digital Personal Data Protection Act, 2023 they process personal data on our instructions, just as we process student data on your institution's instructions. We share only the minimum each one needs, and bind them by contract to protect it and to use it only to serve you.
Service
Purpose
Data region
Supabase, Inc.
Primary database, authentication, and blob storage.
Asia / EU
Amazon Web Services, Inc.
EC2 compute for the Judge0 isolated code execution pipeline.
India (Mumbai, ap-south-1)
Vercel Inc.
Frontend application hosting and edge network distribution.
Global Edge
Cloudflare, Inc.
DDoS mitigation and Turnstile bot protection (strictly necessary).
Global Edge
OpenAI, L.L.C.
AI grading of written explanations, the Ace assistant, and AI mock-interview generation and analysis. Submitted text is processed, not used to train models.
US
Groq, Inc.
Low-latency LLM inference for AI explanation scoring during evaluation.
US
Deepgram, Inc.
Speech-to-text transcription of the candidate's spoken answers in AI voice interviews.
US
Cartesia, Inc.
Text-to-speech voice synthesis for the AI interviewer in AI voice interviews.
US
PostHog, Inc.
Product analytics and telemetry. Signed-in product usage is captured as first-party analytics to run and improve the service; anonymous and marketing-site analytics are sent only if Analytics cookies are accepted.
EU (Frankfurt)
Functional Software, Inc.
Frontend error monitoring and crash reporting.
EU
Resend, Inc.
Transactional email delivery (e.g., OTPs, magic links).
EU / US
Better Stack, Inc.
Uptime monitoring and public status page hosting.
EU
Our primary database and code-execution pipeline run in India (Mumbai). Some subprocessors, the AI, email, and monitoring providers, process limited data outside India, in regions such as the United States and the European Union, as shown in the table above.
The DPDP Act permits transfers of personal data outside India, except to countries the Central Government specifically restricts. Wherever data leaves India, we keep the transfer to what the feature needs and bind each provider by contract.
This page is the live list. As the product grows we may add or change subprocessors, and we'll update this page when we do. Institutions that would like advance notice of new subprocessors can ask us, and we'll add them to the list of people we tell before a change takes effect.
Questions about a subprocessor or how your data is handled? Write to our Grievance Officer at grievance@assessly.in.