| Subprocessor | Purpose | Location | Status |
|---|---|---|---|
| Hetzner Online GmbH | Cloud compute and block storage | Finland (EU) | Active |
| Cloudflare, Inc. | DNS, TLS termination and proxy | Global edge | Active |
| Email gateway | Transactional email and newsletter confirmation | To be confirmed | Not configured |
| SMS / WhatsApp gateway | OTP and service notifications | To be confirmed | Not configured |
| DHA reseller | Identity verification | South Africa | Not configured |
| AVS-R bureau | Bank account verification | South Africa | Not configured |
| Payout providers | Stipend disbursement | South Africa | Not configured |
| Biometric matcher / PAD vendor | Template matching and liveness | To be confirmed | Contract defined |
Change notification
Tenant administrators will be notified before a new subprocessor starts processing tenant personal information, where the data processing agreement requires it. A tenant may object under that agreement.
Cross-border transfer
The primary hosting subprocessor is in the European Union. The transfer is assessed under POPIA section 72, with the GDPR, a data processing agreement, encryption, access control and audit logging as safeguards. See the Trust Centre for detail.
Questions
Contact the Information Officer at [email protected] for the current data processing agreement or a security questionnaire.