IrisOS
IrisOS Legal

Subprocessor and Service Provider Register

This register distinguishes IrisOS subprocessors from payment providers and customer-authorized integrations. A listed provider processes Customer Data only when the corresponding service or integration is used for the Customer’s enabled workflows.

Last updated: October 22, 2026

1. Operator and register status

IrisOS, available at https://irisos.app, is operated by GRL Enterprises (we, us, or our). Our business address is 307, Grima Unnathi, Kyalasanahalli, Bengaluru – 560077, Karnataka, India.

A Subprocessor is a third party engaged by GRL Enterprises to process customer-controlled Personal Data on its behalf. A provider can have a different role for its own account, payment or security purposes. The entries below use service names; exact contracting entities, production regions and transfer mechanisms remain subject to verification. No country-specific residency or executed contractual safeguard is implied.

2. Infrastructure and authentication

  • Supabase — authentication implementation and potential hosted database infrastructure. Data includes identity, session and authentication records; application records depend on the actual database deployment. Authentication processor path confirmed in code; database hosting region and executed terms unverified.
  • Vercel — deployment configuration and performance tooling are present. If deployed/enabled, hosting handles requests and application traffic and performance tooling handles diagnostic signals. Actual production host, enabled telemetry, locations and processing terms require confirmation.
  • PostgreSQL through Prisma — application storage technology, not itself a named external legal entity or evidence of a hosting region. The actual database host must be recorded before finalizing the infrastructure subprocessor list.

3. AI provider integrations

  • OpenAI — supported inference for financial analysis and forecasting, plus voice and transcription. May receive prompts, internal instructions, permitted workspace context, audio and transcripts depending on feature. Potential AI subprocessor when enabled; API account, retention and transfer settings unverified.
  • Google Gemini — supported query classification, summaries, meetings and automation planning. May receive a query even where another provider completes the answer, together with supplied context for applicable workflows. Paid/unpaid status and applicable processing terms must be confirmed.
  • Anthropic Claude — supported strategy, reasoning and document-generation paths. May receive prompts, instructions, supplied content and permitted workspace context. Model configuration, actual activation and contractual retention arrangement require confirmation.

4. Support, communications and anti-abuse

  • Google Sheets — support and access-administration workflows can send submitted name, email, request details, timestamps and status to a configured spreadsheet. Potential operator service provider; not simply a customer calendar integration.
  • Configured SMTP provider — transactional email can contain recipient addresses, notifications, support details and document attachments. Code supports SMTP and references Google SMTP configuration, but the actual provider and region must be confirmed.
  • Google reCAPTCHA — anti-abuse integration can process browser/request risk signals where enabled. Its contractual role and applicable notice/consent requirements must be assessed separately.
  • Logs and monitoring — application activity/error records exist; confirm actual host log and performance recipients and retention. A dependency or development tool is not automatically an additional production subprocessor.

5. Payments and customer-selected integrations

  • Razorpay — current IrisOS plan-payment integration. Processes checkout/payment information; IrisOS retains order/payment references and amounts. Its independent regulatory, fraud and payment activities should not all be described as processing solely on customer instructions.
  • Google OAuth and Calendar — customer-authorized account access and calendar exchange. Processes grant/account details, event contents and participants as required by the connection; Google may also act under its own customer relationship.
  • Meta — customer-authorized advertising/lead/account workflows. Exchanges permitted advertising, lead and account records. Its independent platform activity is distinct from IrisOS processing.
  • Canva, Stripe and PayPal — integration/catalog paths appear in the repository, including mocked adapter behavior. They are not represented here as confirmed active IrisOS subprocessors. Confirm enabled processing and the customer/provider relationship before adding a production entry.
  • Other document-signing or design providers — configuration or links alone do not establish active processing. Confirm the specific enabled workflow before extending this register.

6. Updates, objections and inquiries

Changes to subprocessors follow the DPA’s notice and objection provisions. Changes to customer-selected integrations follow the Customer’s authorization and applicable provider terms. Contact us to identify the providers used for a particular Workspace or to raise a data-protection objection.

For privacy, legal, billing or service requests, email contact@irisos.app, use Get Help in IrisOS, or write to GRL Enterprises at the business address above. Include the relevant workspace and request details; do not send passwords or payment-card credentials.