1. Introduction & 2. Definitions
Veyro uses specialized third-party service providers to support the delivery, operational scaling, security, and maintenance of our payment orchestration and operations platform.
Some of these external providers process Customer Personal Data on Veyro's behalf and qualify as Subprocessors under applicable data protection legislation (such as the GDPR Article 28, UK GDPR, and India's Digital Personal Data Protection Act, 2023). This policy details our vendor evaluation standards, the active Subprocessor register, and your contractual right to object to material infrastructure updates.
3. Why Veyro Uses Third-Party Providers
We engage premier enterprise infrastructure vendors solely where their specialized capabilities are necessary to operate, protect, and improve the platform:
4. Categories of Subprocessors
Depending on your integration tier and configured connectors, Subprocessors fall into distinct operational categories:
Provides virtualized compute environments, routing nodes, and managed database clusters for storing non-sensitive transaction metadata and merchant integration preferences.
Manages portal credentials, multi-factor authentication (MFA) tokens, and role-based session authorizations.
Captures application performance metrics and stack traces. All payloads are processed through automated data-scrubbing filters before telemetry ingest.
5. Current Subprocessor Register
The following entities represent our active, verified third-party Subprocessors processing Customer Personal Data on Veyro's behalf:
Amazon Web Services (AWS)
Legal Entity: Amazon Web Services, Inc.Google Cloud Platform (GCP)
Legal Entity: Google LLCCloudflare
Legal Entity: Cloudflare, Inc.Neon / Supabase Database
Legal Entity: Neon Inc. / Supabase Inc.Sentry
Legal Entity: Functional Software, Inc.Resend / Postmark
Legal Entity: Resend, Inc. / ActiveCampaign LLC6. Connected Payment Providers are Independent Controllers
Veyro is an orchestration software layer. When you connect your own gateway account (e.g., Stripe, Razorpay, Cashfree, PayPal), that gateway acts as an independent Controller / financial institution directly contracted by you. They process cardholder data under their own regulatory licenses and privacy notices. Because Veyro does not engage those gateways on your behalf, merchant-connected gateways do not appear on Veyro's Subprocessor register.
7–8. Due Diligence and Mandatory Contractual Terms
Prior to onboarding any Subprocessor, Veyro conducts formal technical risk reviews verifying:
- Verification of ISO/IEC 27001 or SOC 2 Type II independent audit compliance.
- Execution of a binding Data Processing Agreement with equivalent Article 28 GDPR terms.
- Implementation of zero-trust network access and AES-256 resting encryption standards.
- Contractual restrictions barring the vendor from utilizing Customer Data for secondary model training or commercialization.
- Mandatory 48-hour breach notification SLA commitments.
9–10. International Transfers & Change Notifications
Transfers to vendors outside the European Economic Area (EEA) or UK are governed by the European Commission's Standard Contractual Clauses (SCCs) and UK International Data Transfer Addendum.
Veyro provides at least thirty (30) days advance notice before engaging a new Subprocessor that processes Customer Personal Data via dashboard alerts and registered email updates.
11. Customer Objections Procedure
Customers with an active DPA may object to a proposed new Subprocessor on reasonable data protection grounds within thirty (30) calendar days of receiving notification.
Email privacy@veyro.com detailing your merchant workspace ID, the specific Subprocessor in question, and the verifiable data protection risk. Veyro will collaborate in good faith to propose technical mitigations or alternate configurations.
12–16. Lifecycle, Security Incidents & Dependencies
When a vendor contract terminates, Veyro mandates the verified cryptographic deletion of all cached backups and operational data within thirty (30) days.
If an incident occurs at a Subprocessor impacting Customer Personal Data, Veyro triggers immediate containment and executes its breach notification obligations under the DPA.