minimothSub-processors
Last updated: 26 September 2026
This page lists the sub-processors MiniMoth engages to process End-User Personal Data under our Data Processing Agreement, and the specific data flow each one is scoped to — a sub-processor listed below only ever sees the traffic described in its "Scope" column, not every OTP MiniMoth handles.
| Sub-processor | Purpose | Scope | Location |
|---|---|---|---|
| Meta Platforms, Inc. | WhatsApp message delivery (WhatsApp Business Platform / Cloud API) | Every OTP sent over WhatsApp — domestic and international, on both MiniMoth's shared account and a customer's own connected account | United States |
| MSG91 | SMS delivery, DLT-registered sender | Domestic (+91) OTPs only — never used for the international WhatsApp-only capability, which has no SMS fallback | India |
| Cloudflare, Inc. | Network edge proxy and DDoS protection for api.minimoth.dev | Every API request in transit, including the phone number in each OTP send/verify call | United States |
| Railway Corporation | Application hosting, database, and cache infrastructure | All End-User Personal Data at rest and in processing | Singapore |
| Resend | Transactional email delivery | Account and billing notification emails to Customer — not End-User Personal Data | United States |
| Razorpay Software Private Limited | Payment processing for wallet top-ups | Customer's own payment instrument and billing data — not End-User Personal Data | India |
Questions about a sub-processor, or an objection under our DPA, can be sent to [email protected].