Last updated: 30 October 2026
Commonkeep uses a small number of service providers ("sub-processors") to run the service. Each one processes data only on our instructions, under a written contract with data-protection terms at least as strict as those in our agreement with your society (Terms, Schedule 1). We stay responsible for them.
We tell every society's admins 30 days before we add or replace a sub-processor. Your society can object on reasonable data-protection grounds; if we can't accommodate the objection, it can end the agreement without penalty.
Current sub-processors
| Sub-processor | What it does for us | Data involved | Where the data is processed | Safeguards |
|---|---|---|---|---|
| DigitalOcean, LLC | Hosting: application servers, database, receipt file storage and backups | All society data: members, flats, roles, expenses, receipts, approvals, dues, payments, audit trail | India (Bangalore): app and database · Singapore: receipt files and backups | Data processing agreement; encryption at rest; access limited to named staff |
| Twilio Inc. (Verify) | Sending one-time login codes by SMS | Mobile number, the code. Also the number and code typed at login or sign-up by anyone, member or not, to check the code | United States, delivered through local mobile networks | Data processing agreement; codes only, never financial details |
| Expo (650 Industries, Inc.), then Google (Firebase Cloud Messaging, Android) or Apple (Push Notification service, iPhone) | Delivering push notifications to the mobile app. Expo passes each message to Google's or Apple's service, which delivers it to the phone. Used only when push notifications are switched on for the service | The phone's push token and platform. The message is content-free: a title ("Commonkeep"), one fixed sentence such as "You have 1 thing to sign.", and reference numbers (item type and id) so the app can open the right screen after sign-in. Never a vendor, amount, name, comment or receipt image | United States | Data processing terms with Expo; the message holds no society record |
| OpenRouter, Inc. | Routing receipt images to the AI model | The receipt image with location and camera data removed, the society's currency, country and category names. No names, phone numbers or flat numbers. | United States | Data processing agreement; zero data retention enforced on every request; routing pinned to first-party providers only (Google Vertex AI for receipts), no reseller fallback |
| Google LLC (Google Cloud, Vertex AI) | Reading receipts with the Gemini model: suggests amount, vendor, date and category for a person to check | As for OpenRouter | United States | Google Cloud terms: no training on our data; zero data retention |
Planned
These are not processing any data yet. They will be added to the table above, with 30 days' notice, before they start.
| Sub-processor | What it will do | Data involved | Where | When |
|---|---|---|---|---|
| Anthropic, PBC | Preparing set-up drafts from records a treasurer drops in, after two separate confirmations (Privacy Notice §4A) | The text read from the dropped files, with names and flat numbers; phone numbers replaced with placeholders | United States | When Add your records is switched on |
Not sub-processors
- WhatsApp. Invites and reminders are prepared by Commonkeep and sent by your treasurer or committee from their own WhatsApp. Commonkeep does not send them and WhatsApp does not process data on our behalf; WhatsApp's own terms apply to those messages.
- Your bank or UPI app. Owners pay the society directly. Commonkeep never handles money or payment credentials; it records only the reference you enter.
- Analytics, crash reporting and advertising. We use none: no analytics, crash-reporting, tracking or advertising services in the app or on this website. In particular, Sentry is not used. The app records one first-party counter in our own database ("opened the monthly summary"); no outside company receives it.
Questions
Write to [email protected].