Sub-processors
Quantum Solutions (Private) Limited ("we", "us") uses the third-party service providers listed below to operate the Quantum Solutions platform. Where we process personal data on behalf of a customer, these are our sub-processors for the purposes of the Data Processing Addendum.
This page is referenced by, but not part of, the Data Processing Addendum. Keeping it separate means we can add or change a provider by giving notice, rather than asking every customer to re-accept an agreement.
1. How we notify you of changes
We will give at least 30 days' notice before a new sub-processor begins processing customer personal data. Notice is given by updating this page and emailing the administrators of every affected organisation.
If you object to a new sub-processor on reasonable data-protection grounds, tell us at hello@quantumsolutions.dev within the notice period. We will work with you to find an alternative. If we cannot, you may terminate the affected services without penalty, with a pro-rata refund of any prepaid fees covering the period after termination.
2. Current sub-processors
| Provider | Purpose | Data processed | Processing location |
|---|---|---|---|
| Amazon Web Services, Inc. | Hosting, compute, storage, identity (Cognito), email delivery (SES), content delivery | All customer data held by the platform | United States (us-east-1) |
| MongoDB, Inc. (Atlas) | Primary application database | All customer data held by the platform | United States |
| Netlify, Inc. | Front-end application hosting | Request metadata, IP addresses | United States |
| Cloudflare, Inc. | Edge network, DNS, DDoS protection | Request metadata, IP addresses | Global edge network |
| CyberSource / Visa Inc. | Card tokenisation and payment processing | Cardholder data entered directly by the payer, payment tokens, transaction records | United States |
| PayPal Holdings, Inc. | Payment processing and wallet | Payer identifiers, payment tokens, transaction records | United States |
| Google LLC (reCAPTCHA) | Bot and abuse prevention | IP address, browser and interaction signals | United States |
We do not use analytics, advertising, or marketing sub-processors.
3. Where data is processed
Our infrastructure runs in the United States. We are established in Sri Lanka. Personal data is therefore processed outside the country you are in.
Every provider above is bound by written data protection terms, and we supplement them with encryption in transit and at rest, access control, and the security measures described in Annex II of our Data Processing Addendum.
4. Payment providers
Card details are entered directly into fields hosted by the payment provider and are never transmitted through or stored on our systems. We hold only a payment token, the card brand, and the last four digits, for display and for charging a payment method you have saved.
When you connect your own payment gateway, your relationship is with that provider directly and their terms and privacy notice govern it. We are not a party to it.
5. Contact
Questions about this list: hello@quantumsolutions.dev
Data protection enquiries: hello@quantumsolutions.dev
Quantum Solutions (Private) Limited NO 61/12, 6th Pope Paul Road, Negombo, 11500, Sri Lanka