Authorized Subprocessors Directory
In accordance with GDPR, UK GDPR, and international data protection standards, this directory discloses all third-party vendors and cloud providers engaged by MENTISERA (SMC-Private) Limited (trading as TUTORERA) to process personal data.
Before onboarding any external cloud service or technology partner, TUTORERA conducts comprehensive data security and privacy impact evaluations. All subprocessors are legally bound by Data Protection Addenda (DPAs) mandating confidential treatment, adherence to Standard Contractual Clauses (SCCs) for international transfers, strict encryption standards, and an absolute prohibition against selling or using user data for unauthorized commercial purposes.
Current Infrastructure & Processing Partners
| Subprocessor | Category | Purpose of Processing | Entity Location | Transfer Safeguards |
|---|---|---|---|---|
| Amazon Web Services (AWS) | Hosting & Infrastructure | Cloud compute, encrypted object storage for verification documents, and network perimeter security. | United States, Germany (EU), Singapore | Standard Contractual Clauses (SCCs), ISO 27001, SOC 2 Type II |
| MongoDB Inc. (MongoDB Atlas) | Database Services | Managed database clusters, persistent user records, requests, bookings, and encrypted logs. | Frankfurt (Germany) / Dublin (Ireland) | EU GDPR Compliance, AES-256 Encryption at Rest, SOC 2 Type II |
| PayFast (APPS Pvt Ltd) | Payment Processing | State Bank of Pakistan (SBP) regulated payment gateway processing domestic card and bank transfers. | Pakistan | SBP PSO/PSP Regulatory License, PCI-DSS Certified |
| 1LINK / JazzCash / EasyPaisa | Payment Processing | Local digital wallet and interbank fund transfer processing for domestic Pakistani students and tutors. | Pakistan | State Bank of Pakistan Oversight, SBP Authorized Platform Settlement |
| Resend / SendGrid (Twilio Inc.) | Communications | Transactional system emails, booking notifications, password resets, and verification messages. | United States, European Union | GDPR Compliant DPA, SCCs, TLS 1.3 Transmission Encryption |
| Cloudflare Inc. | Hosting, Security & Networking | Production frontend hosting through Cloudflare Workers/OpenNext, edge routing, Web Application Firewall (WAF), distributed denial of service (DDoS) mitigation, and SSL termination. | Global Edge Network | ISO 27001, SOC 2 Type II, Global Privacy Framework |
| Google LLC / Google Ireland Ltd | Analytics & Telemetry | Aggregated, privacy-respecting website telemetry and performance diagnostics (Google Analytics 4). | United States, Ireland (EU) | EU-US Data Privacy Framework, IP Anonymization, DPA |
Subprocessor Updates & Notification Mechanisms
TUTORERA reviews and updates this directory when engaging new technology vendors or replacing existing systems:
- Advance Notice: We post material additions or changes to this directory at least thirty (30) calendar days before any new subprocessor commences processing personal data.
- Right to Inquire or Object: Enterprise, institutional, or individual users with contractual data protection agreements may register inquiries or reasonable objections regarding new subprocessors by emailing hello@mentisera.pk within the notification period.