Compliance & Sub-processors
Status
Owner: Tech lead · Status: draft · Canonical source: Enterprise Cloud Service Agreements
Discloses third-party sub-processors and international compliance certifications applicable to the platform.
Authorized Sub-processors
| Provider | Services Used | Role | Processing Location |
|---|---|---|---|
| Microsoft Corporation | Azure Cloud Infrastructure (VM, PostgreSQL, Redis, Blob, Key Vault) | Primary hosting and data persistence | Southeast Asia (Singapore) |
| Microsoft Corporation | Azure OpenAI Service | Enterprise GPT-4o model inference | Southeast Asia / East US |
| Anthropic PBC | Claude API | Claude 3.5 Sonnet model inference | United States / Global |
Compliance Frameworks
Underlying cloud infrastructure inherits rigorous international certifications:
- ISO/IEC 27001: Information Security Management.
- SOC 2 Type II: Security, Availability, and Confidentiality audit reports.
- GDPR / PDPD (Vietnam): Data subject rights and lawful processing compliance.
Existing Controls
- Enterprise Data Protection Agreements (DPAs) in place with all cloud providers.
- Primary data persistence restricted to Southeast Asia regions.
Evidence (Files & Configuration)
- Microsoft Azure Compliance Offerings
- FPT Enterprise Master Services Agreement
Limitations & Roadmap
- Pursuing dedicated application-level SOC 2 certification for the Flezi Galaxy software layer.