Last updated on 11 June, 2026.
This page lists the third-party service providers (each a "Sub-processor") that Poocho Research Technologies Private Limited engages to help us run the Platform — including Studio, our analysis product, and Recruit, our participant recruitment and research session product.
We update this page as our technology stack evolves. If you have a signed agreement with us, the notice arrangements in that agreement and in our Platform Terms apply to material changes.
How we use Sub-processors
We engage Sub-processors for two main reasons:
- to run the infrastructure the Platform depends on — for example, cloud hosting, payments, and email delivery; and
- to provide specific capabilities inside our products — for example, transcription, translation, and the artificial intelligence features in Studio.
Each Sub-processor is engaged under service, API, or enterprise terms that include, at minimum, obligations on purpose limitation and appropriate security. For Sub-processors that provide artificial intelligence capabilities, the basis for their no-training commitment is set out in the tables below. Where the nature or sensitivity of the data warrants a bilateral data processing agreement, we execute one — for example, a Business Associate Agreement with AssemblyAI.
We remain responsible to you for the acts and omissions of our Sub-processors in respect of your data, on the terms set out in your agreement with us.
Sub-processors for Studio
Note for Studio v1 users: Most AI sub-processors listed in this section — including Sarvam, AssemblyAI, Cohere, and Anthropic Claude — apply to Studio v2 only. However, Google Gemini applies to both Studio v1 and Studio v2: session recordings and transcripts from Studio v1 are sent to Google's Gemini API. If you are using Studio v1, your use is otherwise governed by the Researcher Terms at poocho.co/legal/researcher-terms.
Hosting and infrastructure
| Provider |
Service |
Location of processing |
| Amazon Web Services (AWS) |
Cloud hosting; encrypted file storage (S3); audio extraction and conversion within
Poocho's infrastructure (Lambda, MediaConvert); content delivery network (CloudFront)
|
India (ap-south-1, Mumbai). Data sent to AI sub-processors may be processed outside
India — see AI section below.
|
| Supabase (PostgreSQL) |
Application database — customer accounts, projects, recordings metadata,
transcripts, highlights, themes, and workflow state; also handles authentication
for Studio v2. Row-level security enforced at both database engine level and
application layer.
|
India (AWS ap-south-1, Mumbai). |
| TurboPuffer |
Vector database — stores embedding vectors returned by Cohere for semantic
search. No Customer Data content is stored at the vector layer; vectors are
mathematical representations only.
|
US Central. |
Transcription and translation
| Provider |
Service |
No-training basis |
Location of processing |
| Sarvam (primary) |
Speech-to-text transcription, speaker diarisation, and English translation.
Receives audio file (16kHz mono MP3) extracted from original upload within
Poocho's AWS infrastructure.
|
Sarvam enterprise T&C (accepted by Poocho) prohibit use of customer data
for model training. Written confirmation from Sarvam additionally in progress.
|
India (Bangalore). |
| AssemblyAI (fallback) |
Speech-to-text transcription when primary transcription is unavailable.
Receives audio via time-limited presigned S3 URL.
|
BAA executed with AssemblyAI. Zero Data Retention (ZDR) configured —
files are deleted immediately after processing. Opt-out also confirmed
(data-opt-out@assemblyai.com).
|
US infrastructure. Files deleted immediately after processing under ZDR.
|
Artificial intelligence — analysis, synthesis, and querying
| Provider |
Service |
No-training basis |
Location of processing |
| Google Gemini |
Content extraction from transcripts — chapters, summary, key takeaways,
demographic markers. Also handles translation in the AssemblyAI fallback path.
Text only; no audio. Used via Google's paid commercial API tier. Applies to both
Studio v1 and Studio v2 — Studio v1 sends session recordings and transcripts to
the Gemini API externally.
|
Automatic on paid quota tier — contractually exempt per Google API Terms.
Prompts and responses are not used for model training.
|
Google Cloud infrastructure (US). Prompts and responses retained for 55 days
for abuse-monitoring purposes only (not training). Note: the 55-day figure is
sourced from Google's usage policies page; the DPA states "limited period of time."
|
| Anthropic Claude |
Conversational research assistant — natural-language querying across Customer Data.
Used via Anthropic's commercial API. Inputs and outputs deleted from Anthropic's
systems within 30 days.
|
Automatic for all commercial API customers — no opt-out required.
|
US infrastructure. |
| Cohere |
Vector embeddings for semantic search (no content generation). Text segments only.
Embedding vectors are not retained by Cohere after the API response is returned —
they are stored in Poocho's own vector database (TurboPuffer). Used via Cohere's
paid commercial tier.
|
Confirmed via Cohere's published Enterprise Data Commitments, which prohibit use
of customer data for model training.
|
US Central. |
Operational services
| Provider |
Service |
Location of processing |
| SendGrid |
Transactional email delivery (account notifications, system messages)
|
US |
| Courier |
Notification orchestration across communication channels
|
US. SOC2 Type II and ISO27001 certified.
|
| Zoom |
Hosted video sessions where used for Studio research material capture.
Recordings stored in the US; traffic routing follows Zoom's standard
global infrastructure.
|
US (recordings storage). SOC2 Type II and ISO27001 certified.
|
| Zoho Desk |
Customer support ticketing
|
India |
Sub-processors for Recruit
Hosting and infrastructure
Recruit runs on the same hosting and infrastructure as Studio. See the Studio section above.
Operational services
Recruit uses the same operational sub-processors as Studio (see Studio section above) for shared services — including email and SMS delivery, video sessions, and customer support. In addition, Recruit-specific use includes:
| Provider |
Service |
Location of processing |
| Razorpay |
Payment processing for Participant incentives and Poocho Pay wallet loading
|
India |
| Auth0 |
Authentication — passwordless email and Google Sign-In for Researcher and
Participant accounts. Where Google Sign-In is used, receives email address,
name, and profile picture from Google.
|
US |
| SendGrid |
Transactional email delivery to Researchers and Participants (account
confirmations, study status updates, session reminders, Participant deletion
notifications)
|
US |
| Courier |
Notification orchestration across email and messaging channels for Researcher
and Participant communications
|
US. SOC2 Type II and ISO27001 certified.
|
| WhatsApp Business (Meta) |
WhatsApp notifications to Participants
|
US (Meta infrastructure) |
| MSG91 |
SMS delivery for OTP-based authentication of Participants
|
India |
| Zoom |
Hosted online video sessions
|
(see Studio operational services above) |
Research partners (moderation services)
Poocho delivers moderation services in-house where capacity allows. When in-house capacity is insufficient, moderation may be delivered by a vetted external partner from Poocho's partner network, engaged under a Moderation Partner Agreement before the engagement begins.
We do not name individual moderation partners on this page. The specific partner assigned to your engagement, their location, and the categories of data they will access are identified in your scope of work or in a separate notice before the engagement begins.
Sub-processors that handle Participant Profile data
Some Sub-processors listed above also process Participant Profile data — the personal data of Participants who register on the Platform and join our panel. Poocho is the Data Fiduciary for Participant Profile data, and the Participant Privacy Policy describes how we collect, use, and share it.
Changes to this list
We may add, change, or remove Sub-processors from time to time as our technology stack evolves. We will update this page to reflect any change.
For Customers with a signed Data Processing Addendum, the notice arrangements in that DPA apply to material changes — including additions of new Sub-processors that process Personal Data in Customer Data.
For all other Users, we will give reasonable notice of material changes through the Platform, by email to the address associated with your account, or by an update to this page, in line with the change-of-terms process in our Platform Terms.
Questions
For questions about our Sub-processors, write to legal@poocho.co.
For DPDPA grievances, contact our Grievance Officer as set out in our Privacy Policies.
