Trust & Infrastructure Transparency
Authorized Subprocessor Register
Effective Date: September 19, 2026 · Compliance: DPDPA 2023 & CERT-In Directions
STRICT DATA LOCALIZATION (MUMBAI, INDIA):
All primary tenant databases, PostgreSQL instances, and disaster recovery backups are hosted strictly within sovereign Indian data centers in the Mumbai region, complying with Indian data sovereignty and CERT-In mandates. Werkora does not use any third-party behavioral advertising or data-broker subprocessors.
| Subprocessor Entity | Processing Activity | Data Center Location | Security Safeguards |
|---|---|---|---|
| Akamai Connected Cloud (Linode) | Cloud virtual machines, container orchestration, Kubernetes worker nodes, and private networking. | Mumbai, India (ap-south-1) | SOC 2 Type II, ISO 27001, CSA STAR Level 1 |
| Akamai Object Storage | Offsite encrypted database backups and 180-day audit log retention repository. | Mumbai, India (ap-south-1) | SOC 2 Type II, ISO 27001, AES-256 server-side encryption |
| Razorpay Software Private Limited | Authorized payment aggregator, digital transaction tokenization, and billing checkout processing. | Bangalore, India | PCI-DSS Level 1 Certified, RBI Payment Aggregator License |
| Internet Security Research Group (Let's Encrypt) | Automated issuance and 90-day renewal of TLS 1.3 cryptographic certificates. | United States / Global CDN | WebTrust audited Root CA, strict ACME protocol automation |