This page lists the third-party subprocessors that Melaya Labs LLC ("Melaya", "we", "us", or "our") engages to process personal information on our behalf in the course of providing the Melaya platform, including the Agentic Framework, the Melaya Engine, the websites at melaya.org and associated subdomains, APIs, clients, and related services (collectively, the "Services"). It should be read together with our Privacy Policy, Terms of Service, and Security Overview.
1. What a Subprocessor Is
A subprocessor is a third party that Melaya engages to process personal information on our behalf in order to deliver the Services. Each subprocessor listed below performs a specific, limited function under a written contract that imposes confidentiality and data protection obligations consistent with our Privacy Policy. Subprocessors are only permitted to process personal information as necessary to provide their service to Melaya, and not for their own independent purposes.
2. Our Role as Controller and Processor
For personal information collected directly through the Services, Melaya acts as the controller and the subprocessors below act as our processors. Where Melaya processes personal information on behalf of an enterprise customer under a written agreement, Melaya acts as a processor and the subprocessors below act as our onward subprocessors, with the enterprise customer as the controller. In either case, the subprocessors listed here are the parties that may process personal information under Melaya's instruction.
3. Notice of Changes
Melaya maintains this list as the canonical, public record of its subprocessors. When we intend to add or replace a subprocessor that processes personal information, we will update this page and provide affected enterprise customers with at least fifteen (15) days' prior notice before the new subprocessor begins processing, except where a shorter period is necessary to comply with law or to address a security or continuity risk. Where a written agreement grants a right to object, an enterprise customer may object to a new subprocessor on reasonable data protection grounds within the notice window.
4. Current Subprocessors
The following subprocessors are engaged in production as of the date at the top of this page. Residency reflects where the relevant processing takes place; the primary compute and database are hosted in the Singapore region as confirmed by live verification.
| Subprocessor | Location | Purpose | Transfer Safeguard |
|---|---|---|---|
| Cloudflare, Inc. | USA, global edge | TLS termination, WAF, DDoS mitigation | SCCs + Cloudflare DPA |
| Grafana Labs | Singapore (same region as production) | Off-box log + metric collection | SCCs + DPA |
| Infisical, Inc. | USA | Vault for envelope-wrapped credential ciphertext | SCCs + DPA |
| Stripe, Inc. | USA | Payment processing | EU SCCs Module 2 + UK IDTA |
| Alibaba Cloud (compute host) | Singapore (ap-southeast-1) | Primary compute, database, and cache hosting | SCCs + DPA |
| Object storage provider (operator-specified) | Region per deployment | Backups, DSAR exports, audit archive | SCCs + DPA |
| Transactional email provider (operator-specified) | Region per deployment | MFA, password reset, DSAR notices | SCCs + DPA |
5. Residency Note
The primary application host, the primary PostgreSQL database, and the Redis cache run in the Asia Pacific (Singapore) region (ap-southeast-1). Off-box log and metric collection runs in the same region. Certain operator-specified subprocessors (object storage and transactional email) are deployed in the region configured for a given deployment; their residency therefore depends on the specific deployment.
6. Legal Entity Names Under NDA
The specific legal entity names, jurisdictions, and executed data processing agreements for the operator-specified providers listed above (object storage and transactional email) are maintained in our internal security vault and are available to enterprise customers under NDA. The named subprocessors above (Cloudflare, Grafana Labs, Infisical, Stripe, and Alibaba Cloud) are disclosed here in full.
7. Contact
Questions about our subprocessors, or requests for the executed subprocessor DPAs and transfer safeguards under NDA, should be directed to: