Sub-processors & security.
Who helps us run Altrix.one, where data lives, and how we protect it.
Overview
Altrix.one, a brand of Altrix.one (legal entity: [LEGAL ENTITY NAME]), uses the service providers below to run the Service. They may process personal data that our client businesses put into Altrix.one. Each gets only the data it needs for its job, under contract terms that protect it.
We give at least 30 days' notice before adding or replacing a sub-processor, as our Data Processing Agreement explains. To get notices by email, write to corp@altrix.one.
Used for every client
| Provider | What it does | Data | Location |
|---|---|---|---|
| Hostinger | Server that hosts the app, database and files | All client data | India |
| Meta Platforms | WhatsApp Business Platform; Instagram and Messenger messaging; lead ads | Names, phone numbers, messages and media, lead-form answers | Global |
| Razorpay | Subscription payments and wallet top-ups (India) | Payer name, email, phone, payment details (card data stays with Razorpay) | India |
| Cloudflare | DNS, delivery and protection for altrix.one | IP addresses and request data | Global |
| Email provider (to be named) | Sign-in codes, invites, invoices and alerts by email | Name, email address, message content | To be confirmed |
| Backup storage (to be named) | Encrypted nightly backups | All client data, encrypted | To be confirmed |
Used only when a feature is switched on
| Provider | Feature | Data | Location |
|---|---|---|---|
| Anthropic | AI & Automation (lead qualifying, reply drafts, summaries, briefings, setup assistant) | The text needed for each request | USA |
| Stripe (if used) | Card payments outside India | Payer name, email, payment details | To be confirmed |
| Twilio or Exotel | Centralized Call Centre (Enterprise, beta) | Caller numbers, call audio, recordings and logs | Twilio: USA and global. Exotel: India |
| Firebase Cloud Messaging and Apple Push Notification service | Push notifications to staff phones | Device token and a short notice (no codes or amounts) | Global |
If you connect your own provider (for example your own payment gateway, telephony account, AI key or Google Workspace), that provider works for you under your own contract, and is not our sub-processor.
Security and trust
Plain facts. Altrix.one is new, with early access from 1 November 2026. We do not yet hold ISO 27001, SOC 2 or similar certifications. This is what we do today:
- Your data, sealed off: every record belongs to one company, every request is checked against that company, and automated tests check that one company cannot read another's data.
- No passwords to steal: sign-in by one-time code (WhatsApp or email), codes expire in 10 minutes, and sensitive actions ask for a fresh code. Enterprise adds single sign-on and office IP allow-lists.
- Keys vault: your WhatsApp, payment, AI and telephony keys are stored write-only and encrypted (AES-256-GCM). Nobody can read them back on screen, including our team.
- Who can see what: role-based access, and an append-only audit log. Our support team can view your account only when you allow it, read-only, for up to 2 hours.
- Where data lives: the app and database are hosted in India. Some providers, such as Meta and AI providers, process data abroad.
- Releases and backups: every release goes to a small group first, with one-click rollback. Nightly encrypted backups with restore drills are being set up before general launch.
- Your control: export your data at any time, delete one person's data, or delete the whole company (with a 7-day undo window).
- If something goes wrong: we tell affected companies without undue delay, and within 48 hours of becoming aware of a breach of their data.
To report a security issue, email corp@altrix.one.