Sub-processor List
Last updated: June 12, 2026
This is the named sub-processor list referenced in §7 of the Privacy Policy, §8.8 of the Terms of Service, and the Data Processing Addendum — the third parties ReBillion engages to process Customer Data on customers' behalf.
Current sub-processors
| Sub-processor | Purpose | Data types processed | Location of processing | Security posture | Listed since |
|---|---|---|---|---|---|
| Amazon Web Services (AWS) | Cloud hosting and storage | Customer Data (transaction documents, account data, usage logs) | United States | SOC 2 / ISO 27001 certified provider | 06/2026 |
| OpenAI | AI inference for document and email analysis | Customer Data content submitted for AI processing | United States | SOC 2 (per provider's published attestations) | 06/2026 |
| Anthropic | AI inference for document and email analysis | Customer Data content submitted for AI processing | United States | SOC 2 (per provider's published attestations) | 06/2026 |
| Google (Workspace APIs / Google Cloud) | Customer-connected email, calendar, and drive processing; build infrastructure | Customer Data the customer connects (Gmail, Calendar, Drive) | United States | SOC 2 / ISO 27001 certified provider | 06/2026 |
| Twilio | SMS/messaging routing | Message content and phone numbers | United States | SOC 2 (per provider) | 06/2026 |
| Twilio SendGrid | Transactional email delivery | Email content and recipient addresses | United States | SOC 2 (per provider) | 06/2026 |
| Razorpay | Payment processing | Billing information | India | PCI DSS Level 1 (per provider) | 06/2026 |
| Garvik operations team (incl. partner staffing) | Dedicated transaction assistant services (the $499/month tier) | Customer Data accessed under role-based access controls and confidentiality obligations | India and the Philippines (via partner) | Contractual confidentiality + RBAC; covered by our security program | 06/2026 |
Customer-directed integrations
When a customer activates an integration with a third-party platform, data flows to that platform at the customer's direction and is governed by that platform's own terms. These are customer-directed disclosures — the platforms below are not ReBillion sub-processors:
- Dotloop
- SkySlope
- Brokermint
- Open to Close
- DocuSign
- Follow Up Boss
- Gmail / Outlook / Google Calendar / Google Drive
Change management
We update this list within 30 days of adding or removing a sub-processor. Enterprise customers can subscribe to advance notice of sub-processor changes:
Subscribe to change notificationsUnder the Data Processing Addendum, enterprise customers receive at least 30 days' advance notice of the addition or replacement of a sub-processor that processes Customer Personal Data.