Subprocessors

Last updated 13 October 2026

Running DutyTick needs other companies. A server has to be somewhere, email has to be delivered by somebody, and a payment has to be collected through someone who is allowed to collect payments. Each of those companies can, in the course of doing its job, touch personal data that belongs to a customer or to us. That makes them subprocessors, and this is the whole list.

It is published rather than offered on request because a company deciding whether to trust us with its employees' data should be able to see who else is in the chain before it asks. The data processing terms say what each of them is bound to.

The list

Amazon Web Services

Delivers every message DutyTick sends, holds documents uploaded into an account, and serves the application and this website. Also our own DNS and the certificates. Processed in the United States, in the region us-east-1. It sees a recipient's name and address and the contents of a message, and whatever a customer uploads as a document. Contracts on the European Commission's standard contractual clauses where the GDPR applies.

Hetzner Online GmbH

The servers DutyTick runs on, and the databases beside them. In Helsinki, Finland, inside the European Union. This is where the data is: employee records, attendance, leave, documents and the audit trail.

Cloudflare

The bot check in front of sign-in and the public forms, which is how those pages stay open to people without being filled in by scripts all day. It runs at the nearest point of their global network to the visitor. It sees the visitor's address and what their browser tells a challenge, and no data from inside any account.

Purelymail

The mailbox behind our own address, and the inbox an unsubscribe reply arrives in. In the United States. It sees what people write to us.

Razorpay

Collects a payment when a customer pays by card, netbanking or UPI. In India. It sees the payer's name, email and payment instrument. We never hold a card number: it is handed to them and not to us.

GitHub

Holds the source code and runs the deployments. In the United States. It sees no personal data: nothing of yours is in a repository.

One that is deliberately not on the list

The audit trail turns an IP address into a city and a network name. That lookup happens on our own servers, against database files from DB-IP that we download once a month and read in our own process.

No address is ever sent to them, so they learn nothing about anybody and are a supplier of files rather than a subprocessor. It is the kind of distinction that is easy to get wrong in both directions, so it is written down.

Adding one

Before a new company starts handling a customer's data, this page changes and we write to the administrator of each account it affects. You are told rather than expected to notice.

If you object to one, tell us. The honest position is that we cannot run the product without a server and a mail provider, so an objection to a company doing one of those jobs is a reason for a conversation and possibly for you to leave, not something we will pretend we can work around.

Contact

Hardcode Consulting Private Limited
CIN U58200OD2024PTC047252
hi@dutytick.com