DPA Annex 3 — Subprocessors
Annex 3 — Subprocessors
Document ID: LOS-LEGAL-003C
Title: DPA Annex 3 — Subprocessors
Version: 1.0
Last updated: 2026-10-24
Publisher: Algoshred Technologies Private Limited (Burdenoff Group)
Canonical location: https://burdenoff.com/contracts/labsofscience/LOS-LEGAL-003C
Burdenoff Group Contract Registry — root at https://burdenoff.com/contracts (one subgroup per product). The contracts referenced in this document belong to the LabsOfScience subgroup at https://burdenoff.com/contracts/labsofscience/. Every referenced contract is identified by its Document ID (LOS-LEGAL-### / LOS-PRICING-###) and incorporated by reference.
Status: Published v1.0 — effective 2026-10-24. Reviewed against the production platform and approved for publication by the founder (India jurisdiction); outside-counsel review checkpoints are tracked in LOS-LEGAL-REG.
This list was reconciled on 2026-10-24 against the vendor inventory of the running Service. LabsOfScience has run on AWS-only infrastructure since 2026-08-15; Microsoft Azure was decommissioned on that date and no longer processes any Customer Data. The list matches the public disclosure at https://labsofscience.com/subprocessors. Rows marked conditional apply only when Customer, or an Authorized User, enables the relevant feature.
| Subprocessor | Service / role | Processing location(s) | Personal Data categories |
|---|---|---|---|
| Amazon Web Services, Inc. (AWS) | Cloud infrastructure — compute (Amazon EKS), databases (Amazon RDS for PostgreSQL, Amazon Neptune), cache (Amazon ElastiCache for Valkey), secrets and key management, object storage (Amazon S3) for datasets, files and attachments, and frontend delivery (Amazon CloudFront) | ap-south-1 (Mumbai, India); CloudFront edge for static frontend assets | All categories under Customer Data hosted on the Service |
| Amazon Simple Email Service (SES) | Transactional email | ap-south-1 (Mumbai, India) | Email address, message content of transactional emails |
| Cloudflare, Inc. | CDN, WAF, DNS, Zero Trust | Global edge | Connection metadata, IPs, request headers; cached static assets |
| Google LLC — Gemini API | Large-language-model inference for the AI features (experiment run recommendations, protocol drafting); content is sent only when an Authorized User invokes an AI feature | United States / global (Google-managed) | Prompt content and the experiment, protocol or dataset context the user submits to the AI feature |
| Stripe, Inc. | Payment processing — international (invoiced by Algoshred Technologies Corp, Delaware) | US / EU | Billing identifiers, tokenised card data (Stripe acts as PCI-DSS processor) |
| Razorpay Software Pvt. Ltd. | Payment processing — India and other regional (invoiced by Algoshred Technologies Private Limited) | India | Billing identifiers, tokenised UPI/card data |
| Conditional: Google LLC — Firebase Cloud Messaging, and Apple Inc. — Apple Push Notification service | Push notification delivery to the LabsOfScience mobile apps, only on devices where the user allows notifications | Global (provider-managed) | Device push token, notification title and body |
| Conditional: identity-verification providers (only where Customer enables a verification integration) | Identity and credential verification commissioned by Customer | Per provider — disclosed at enablement under DPA §6 | Identity documents, verification results Customer commissions |
| Rybbit (managed cloud, rybbit.com) | Product and website analytics; sets no cookies and uses no local storage | European Union | Page views and product events with anonymous session identifiers |
| Apache Answer (self-hosted by Algoshred) | Support community at community.labsofscience.com (open-source, operated by us) | India | Community profile and post content |
| Algoshred-operated support tooling | In-house ticketing and customer success — no third-party SaaS support desk | India | Support content |
| GitHub, Inc. | Source-code hosting (Algoshred internal); also referenced by Customer integrations | US | Issue/ticket metadata where Customer engages support via GitHub |
| Linear (Linear Orbit, Inc.) | Internal project tracking | US | Support ticket metadata if Customer escalates |
| Google Workspace (Google LLC) | Internal team collaboration only — email, calendar, docs used by Burdenoff Group personnel for internal operations. Customer Data is not stored in Google Workspace as part of the Service. | US / EU (Google managed) | Internal operational data only |
| Burdenoff Consultancy Services Private Limited | Manpower house — provides engineering, support, security and operations personnel that deliver the Service on Algoshred's behalf (see DPA §1.4) | India | All categories, on Algoshred's instructions |
| Algoshred Technologies Corp (Delaware, USA; EIN 35-2845680) | International payment processing entity invoicing via Stripe | USA | Billing identifiers for international invoicing |
Notes
- No SMS provider is engaged. LabsOfScience does not send SMS messages. If SMS delivery is introduced, the provider will be added here and notified under DPA §6 before it processes any Customer Data.
- AI providers. The Service's AI gateway can route to other model providers (for example OpenAI, Anthropic or OpenRouter), but none of them is enabled for the production Service today. Enabling one is a Subprocessor addition and will be notified under DPA §6 at least 30 days in advance. Where an Order Form enables a customer-selected ("bring-your-own-key") provider, that provider is Customer's own vendor and is not an Algoshred Subprocessor.
- No marketplace payouts or escrow. The services marketplace described in LOS-LEGAL-011 is not live. Stripe and Razorpay process subscription payments only; Algoshred holds no client funds.
- Customer-contracted integrations (the Customer's own ELN / LIMS, accounting system, identity provider, or a verification provider the Customer engages directly) are not Algoshred Subprocessors; Customer is responsible for those relationships and their data-processing terms.
- For Enterprise / dedicated tenant deployments, the Subprocessor list may be narrowed in the Order Form (e.g., AWS ap-south-1 only, AI features disabled, no verification provider).
- The authoritative live list is published at https://labsofscience.com/subprocessors and changes are notified per DPA §6.
Last reviewed: 2026-10-24 (reconciled against the production vendor inventory)
Reference and incorporation
All Burdenoff Group contracts, addenda, exhibits, policies and registers referenced in this document are identified by their Document ID (LOS-LEGAL-### or LOS-PRICING-###) and are published at https://burdenoff.com/contracts. Each such referenced document is incorporated into this document by reference. The version of a referenced document that applies is the version published at https://burdenoff.com/contracts as at the Effective Date of the applicable Order Form (or, where no Order Form exists, the version current at the date of acceptance), unless an executed Order Form specifies a frozen version.