The following table lists all third-party service providers (subprocessors) currently engaged by INJENA GROUP FZE LLC (the operator of Monarkh) to deliver the Monarkh Suite. This page is updated when subprocessors are added, removed, or when DPA status changes.
Active Subprocessors
| Provider | Purpose | Data Shared | Region | DPA Status |
|---|---|---|---|---|
| Google Vertex AI | AI processing of emails, documents and uploads, and chat: name protection, content extraction, summaries and answers | Pseudonymised text | European Union (Vertex AI EU endpoint) for the parent app; Google’s global endpoint for the children’s portal chat | Not executed. Google Cloud Data Processing Addendum available via Google Cloud Console. |
| Supabase | PostgreSQL database and file storage: user accounts, enriched emails, summaries, calendar events, uploaded documents | Pseudonymised email content, user account data, uploaded files | Frankfurt, Germany (AWS eu-central-1) | Covered by Supabase’s Terms (data processing addendum incorporated), effective 1 August 2026. |
| Render | Application hosting: API gateway, email pipeline, chat engine, document processor, and the cache for chat sessions | Application code, runtime environment variables, data in transit, application logs (7-day retention) | Frankfurt, Germany (eu-central) | Not executed. Available on Team plan via Render support. |
| Qdrant Cloud | Vector database: semantic search over emails and uploaded documents | Vector embeddings of pseudonymised content, metadata tags (bond IDs, student IDs) | Frankfurt, Germany (GCP europe-west3) | Not executed. DPA request pending via Qdrant support. |
| Cloudflare R2 | Nightly backup of uploaded files (14-day retention) | Uploaded file content | European Union (EU-jurisdiction bucket) | Not executed. |
| Cloudflare | Edge network: DNS, CDN, WAF, DDoS protection for monarkh.net and monarkh.ae | HTTP request metadata (IP addresses, request headers). No application data. | Global edge network | Not executed. Standard DPA available at cloudflare.com/dpa. |
| Google Firebase Cloud Messaging | Push notifications to the app | Device tokens; notification text, which shows children’s names only as hidden tags | Global (no region setting) | Not executed. Covered by the Google Cloud Data Processing Addendum once executed. |
| Resend | Transactional email: account verification, password reset | User email addresses, email subject lines | European Union (Ireland) | Not executed. DPA template request pending. |
Previously Listed (No Longer Active)
The following providers were previously listed in our privacy policy but are not currently integrated into the Monarkh Suite:
- Twilio — not integrated
- SendGrid — not integrated
- Stripe — not integrated
- Amazon Web Services (direct) — Supabase runs on AWS infrastructure, but Monarkh does not have a direct AWS relationship
- OpenAI — not currently used in production pipeline
- Anthropic — not currently used in production pipeline
- Google AI Studio (Gemini API): no longer used; all AI processing moved to Vertex AI.