A complete, current list of the third-party service providers we rely on to deliver our Services, and what data each one processes on our behalf.
A "subprocessor" is a third party we engage to process personal data on our behalf in order to provide our Services — for example, a payment processor, a carrier that delivers your messages, or the cloud provider that hosts our database. This page lists every subprocessor we currently use, organized by category, along with the purpose for which each one processes data and the categories of data involved.
We only share the minimum data each subprocessor needs to perform its function, and we require every subprocessor to protect your data under terms at least as protective as our own Privacy Policy and GDPR Privacy Policy.
| Subprocessor | Purpose | Data Categories |
|---|---|---|
| Hubtel | Mobile money and card payment processing (Ghana) | Payment details, phone number, transaction amount |
| Paystack | Card and bank payment processing | Payment details, email, transaction amount |
| Payaza | Payment processing | Payment details, transaction amount |
| PawaPay | Mobile money payment processing (multi-country Africa) | Payment details, phone number, transaction amount |
| Subprocessor | Purpose | Data Categories |
|---|---|---|
| Meta (WhatsApp Business Platform) | WhatsApp message delivery | Recipient phone number, message content |
| Telecel & ConnectMobile | Direct SMS carrier termination (Ghana) | Recipient phone number, message content |
| Dexatel, Arkesel, Termii, Seven, Orange Cameroon | SMS/voice aggregation across African markets | Recipient phone number, message or call content |
| Google Cloud (Speech-to-Text / Text-to-Speech) | Voice API transcription and speech synthesis | Call audio, transcribed text |
| Subprocessor | Purpose | Data Categories |
|---|---|---|
| Kairos | Facial recognition and liveness detection for Identity Verification customers | Identity documents, facial images, biometric templates |
| IPinfo | IP geolocation for fraud-risk signals | IP address, approximate location |
| Subprocessor | Purpose | Data Categories |
|---|---|---|
| Supabase | Primary database and authentication | All platform data necessary to operate the Services |
| Tigris | Object storage (S3-compatible) for uploaded files and media | Uploaded documents, media attachments |
| Firebase (Google Cloud) | Push notifications | Device tokens, notification content |
| Vercel | Web hosting for our site and dashboard | Site traffic and request metadata |
| Subprocessor | Purpose | Data Categories |
|---|---|---|
| Google Gemini | AI features within ExaChat and fraud-signal scoring | Conversation content submitted to AI features |
| Subprocessor | Purpose | Data Categories |
|---|---|---|
| Arcjet | Bot detection, rate limiting, and abuse prevention | Request metadata, IP address |
| Cloudflare (Turnstile) | CAPTCHA / bot-challenge on public forms | Browser and device signals |
| Subprocessor | Purpose | Data Categories |
|---|---|---|
| Resend | Transactional email delivery for our site and dashboard | Recipient email address, email content |
| SpaceMail | Business email and SMTP relay | Email content, sender/recipient addresses |
| Subprocessor | Purpose | Data Categories |
|---|---|---|
| Google Analytics & Google Tag Manager | Website usage analytics | Pseudonymous browsing and device data |
| Vercel Analytics | Website performance monitoring | Page load and performance metrics |
| Subprocessor | Purpose | Data Categories |
|---|---|---|
| Google OAuth & GitHub OAuth | Optional sign-in to our developer dashboard | Name, email address, profile identifier |
Before engaging any subprocessor that will handle personal data on our behalf, we assess their security and privacy practices and put a data protection agreement in place with them. Where a subprocessor is located outside your country or region, we rely on standard contractual clauses or an equivalent lawful transfer mechanism.
Our Compliance page describes the security certifications we hold today and the ones we're actively working toward.
Questions about a specific subprocessor or our DPA? Reach our team: