Subprocessors
Last updated 17 August 2026
These are the third parties that process personal data on our behalf. Each one receives only what it needs to do its job. This list is part of our Data Processing Addendum; customers are notified before we add a new subprocessor.
Current subprocessors
| Provider | Purpose | Personal data it receives | Location |
|---|---|---|---|
| Anthropic | AI grading of assessment answers | The candidate’s written explanation. No name, email, or account identifier is sent. | United States |
| Amazon Web Services | Application and database hosting | All stored data. | United States (us-east-1) |
| Vercel | Web application hosting and delivery | Request metadata, including IP address, in transit. | United States / global edge |
| Razorpay | Payment processing for company accounts | Billing contact and payment details, supplied directly by the payer. | India |
| Resend | Transactional email delivery | Recipient name and email address, and the message body. | United States |
| Mixpanel | Product analytics — only for users who have consented | Account identifier, role, and feature-usage events. Configured not to collect IP addresses. | United States |
| Optional “Sign in with Google” | Only for users who choose it: email address and basic profile. | United States / global | |
| GitHub | Optional “Sign in with GitHub” | Only for users who choose it: email address and username. | United States / global |
Transfers outside India
Most of the providers above process data outside India, so using BrokenCode involves a cross-border transfer of personal data. Transfers are made under contractual safeguards with each provider and are permitted under the DPDP Act except to territories the Central Government has restricted.
Changes to this list
We will notify customers at least 30 days before a new subprocessor starts processing personal data, giving you time to object. Objection handling is described in the DPA.
What is not here
For clarity, and because buyers ask: we use no advertising networks, no data brokers, no session-recording or heatmap tools, and no analytics beyond Mixpanel. Web fonts are self-hosted, so rendering a page does not disclose your visit to a font provider.
Questions about this document? See our grievance redressal contact.