Sub-processors

Last updated: September 18, 2026

When you use MyKaya, your practice is the Data Fiduciary for your clients' data and MyKaya is your Data Processor. These are the third parties that process that data on our behalf — what each one does, what data it handles, and where. You can reference this list in your own client notices and consent forms. Our commitments about this processing are set out in our Data Processing Agreement.

1. Clinical data

Session audio, transcripts, notes, assessments and client records.

Sub-processors of clinical data
Provider	What they do	Data involved	Where
Vercel Inc.	Hosts the MyKaya web app and its APIs	All app data in transit, including session audio uploads	EU — Sweden (Stockholm)
Microsoft Azure — Blob Storage	Stores session audio files	Session audio	EU — Ireland (North Europe)
Microsoft Azure — Container Apps	Runs our audio-processing service	Session audio, transcripts	EU — Sweden (Sweden Central)
Microsoft Azure — Database for PostgreSQL	Main application database	Client records, transcripts, notes, assessments (sensitive clinical fields are additionally encrypted by us)	EU — Sweden (Sweden Central)
Microsoft Azure OpenAI Service	Transcribes English and other global-language sessions; drafts notes, summaries and insights	Session audio, transcripts, notes	United States and other Azure regions (see notes)
Sarvam AI	Transcribes and translates Indian-language and code-mixed sessions	Session audio, transcripts	India
Hexclave (formerly Stack Auth)	Sign-in, and delivery of account and alert emails — including high-risk screener alerts sent to the therapist	Therapist account details; for risk alerts, the client’s name, screener name and score	Outside India (see notes)

AI model training: Microsoft commits that Azure OpenAI prompts and outputs are not used for training, and we have opted out of Sarvam AI using our data to train or improve its models.
Azure OpenAI:our Azure OpenAI resource is in the United States (East US 2) and uses a global deployment, so Microsoft may process an individual request in any Azure region where the model runs. Stored data, including Microsoft's abuse-monitoring store, stays in the United States. Under Microsoft's standard terms, content its automated systems flag as potentially abusive may be retained and reviewed by authorised Microsoft staff.
Sarvam AI: processes and stores data in India; its terms allow transfers to its own service providers in other countries.
Hexclave: a US-based provider that does not currently publish where it hosts data.
Processing outside India: clinical data is processed in India, the European Union, the United States and, for individual Azure OpenAI requests, other Azure regions. The Digital Personal Data Protection Act, 2023 permits these transfers; if the Government restricts transfers to a country we use, we will move that processing.

2. Account, billing and operations

These providers do not receive session content.

Sub-processors of account and operational data
Provider	What they do	Data involved	Where
Razorpay	Payment processing	Billing and payment details	India
Sentry (Functional Software, Inc.)	Error monitoring and security alerting	Technical error data and record IDs. Configured to exclude session content, request bodies and IP addresses	EU — Germany
Google	Sign in with Google	Name, email address, profile picture	Global

Providers used on our website for hosting, analytics, bot protection, email lists and advertising measurement are listed in sections 3 and 4 of our Privacy Policy.

3. Changes to this list

We will email account owners at least 30 days before a new sub-processor starts processing clinical data, and update this page. You can object on reasonable data-protection grounds as described in section 9 of our Data Processing Agreement. Questions about this list: team@mykaya.app.