Capnode sub-processors

Introduction

Capnode is the autonomous AI SRE for Kubernetes, operated by AIKAY Technologies Pvt Ltd ("Capnode", "we", "us"). To run the service reliably and securely, we rely on a small set of trusted third-party providers — known as sub-processors — that may process certain data on our behalf.

This page lists the categories of sub-processors we use, the purpose each one serves, and where they operate. We keep the list current and impose binding data-protection obligations on every sub-processor before they handle any data on our behalf. This page supplements our Privacy Policy and Data Processing Addendum (DPA).

What is a sub-processor

A sub-processor is a third party that we engage to process personal data or customer data in the course of providing the Capnode service — for example, the cloud infrastructure that hosts our application and database, or the provider that delivers transactional email.

Capnode is designed to keep customer data exposure minimal. The Capnode agent runs inside your own Kubernetes cluster under a least-privilege, RBAC-scoped role, and never mutates its own namespace. It streams cluster state and events to the Capnode server, where state is stored and the service is operated. The sub-processors below support that operation; they do not gain independent rights to the data they help process.

Before engaging any sub-processor, we:

• assess the provider's security posture and data-protection practices;
• enter into a written agreement that imposes data-protection obligations no less protective than those in our own customer commitments;
• restrict the provider to processing data only as needed to deliver the relevant function, and only on our documented instructions;
• confirm appropriate safeguards are in place for any cross-border transfer of personal data.

Current sub-processors

The table below describes the categories of sub-processors Capnode currently uses. Entries are listed by function. Region values shown as [Region] are configured per deployment and are confirmed on request.

Sub-processor	Purpose	Location
Cloud hosting provider	Application & database hosting	[Region]
Managed database	Persistent storage	[Region]
Email delivery	Transactional & support email	[Region]
Error & performance monitoring	Reliability	[Region]
Web analytics (if enabled)	Site usage	[Region]

Note: this list is maintained and updated by Capnode. The specific named providers and regions for your deployment are confirmed on request — contact us at support@capnode.io.

Data-protection obligations

Every sub-processor is contractually bound to handle data in line with our commitments to you. In particular, we require each sub-processor to:

• process data only on our documented instructions and solely to perform the agreed function;
• maintain appropriate technical and organisational security measures, including encryption in transit and at rest where applicable;
• ensure personnel with access to data are bound by confidentiality obligations;
• support our compliance with applicable data-protection laws, including the EU/EEA GDPR and the CCPA, and rely on recognised transfer mechanisms (such as Standard Contractual Clauses) where data crosses borders;
• assist with data-subject requests and security-incident notifications;
• delete or return data when it is no longer needed for the agreed purpose.

For the full description of how we process customer and personal data, including roles, security measures, and transfer mechanisms, see our DPA and Privacy Policy.

Updates & notifications

We may add, remove, or replace sub-processors as the service evolves — for example, to improve reliability, security, or performance, or to support new regions. When we make a material change to this list, we update this page and revise the "Last updated" date above.

To be notified of changes to our sub-processors before they take effect, email support@capnode.io and ask to be added to our sub-processor change notifications. If you have an active subscription with a DPA, the notice and objection mechanics in that DPA apply.

Contact

Questions about this list, a specific sub-processor, or our data-protection practices? We're happy to help.