Legal · SecureByte
Sub-processors
Third-party services that may process personal information on behalf of SecureByte under our Data Processing Agreement. We maintain this list as a live document and notify customers in advance of any additions.
Draft — pending counsel review. This document is a working template published in good faith during the SecureByte beta. It is not a substitute for independent legal advice and is subject to change. For procurement-grade documents, request the executed copy via legal@securebyte.co.za.
01Overview
A sub-processor is any third-party service that SecureByte engages to process Customer personal information. Each sub-processor is bound by a written data-processing agreement with SecureByte Consulting (Pty) Ltd that is at least as protective as our own Data Processing Agreement. We minimise the number of sub-processors and prefer those whose service can be delivered from inside South Africa, in line with the POPIA Section 72 cross-border transfer rules.
Customer Data is hosted in AWS Cape Town (af-south-1) by default. The bulk of personal information never leaves South Africa; the exceptions are the observability and AI tooling listed below, which may process limited, scrubbed telemetry abroad and to which the cross-border safeguards in Section 6 of our DPA apply.
02Current sub-processors
The table below is the complete and current list. The "Category" column groups them by role:
- Infra: hosts data or network infrastructure customer data depends on.
- Platform: processes customer data as part of a core platform function.
- Tools: operational tooling we use ourselves; receives limited customer data incidentally.
| Service | Purpose | Location | Category |
|---|---|---|---|
Amazon Web Services (AWS) South Africa — Cape Town (af-south-1) by default. EU (eu-west-1) or US (us-east-1) data residency available at Enterprise and Enterprise+. | Primary cloud infrastructure hosting the SecureByte service and Customer Data: compute (ECS/EC2), managed PostgreSQL (RDS), object storage for evidence (S3, server-side encrypted, with Object Lock WORM anchoring of audit-log integrity proofs), key management (KMS), Secrets Manager, content delivery (CloudFront), and certificate management (ACM). | South Africa — Cape Town (af-south-1) by default. EU (eu-west-1) or US (us-east-1) data residency available at Enterprise and Enterprise+. | infra |
Cloudflare, Inc. Global edge network — closest point of presence: Johannesburg, South Africa. | DNS, content delivery (CDN), web application firewall (WAF), and DDoS protection; also hosts the public marketing site (Cloudflare Pages). Sees request metadata (IP address, user agent, requested URL) at the network edge. | Global edge network — closest point of presence: Johannesburg, South Africa. | infra |
PayFast (Pty) Ltd South Africa | Subscription payments and recurring billing via a hosted, redirect-based checkout. PayFast is the cardholder-data environment — SecureByte never receives or stores card numbers, CVV, or expiry data, only a recurring-billing token, a PayFast payment/subscription identifier, and the amount. | South Africa | platform |
Transactional email provider (SMTP) Configured SMTP provider (region depends on the provider in use). | Delivery of transactional email — email verification, password resets, invitations, breach/certificate/auditor notifications, and billing receipts. Receives the recipient email address and the message contents. SecureByte does not send marketing email through this channel without consent. | Configured SMTP provider (region depends on the provider in use). | platform |
Datadog, Inc. United States by default; region configurable (EU site available). | Observability: backend application performance monitoring (APM) and log management, plus optional browser Real User Monitoring (RUM) and Session Replay (sampled at 20%) on the application. Form inputs are masked by default and secret-bearing URLs and error contexts are scrubbed before transmission. May process a logged-in user identifier, email, role, and organisation identifier for session attribution. | United States by default; region configurable (EU site available). | tools |
Functional Software, Inc. (Sentry) United States | Application error, performance, and crash monitoring. Aggregates stack traces and minimal request context for triage. Headers, request bodies, query strings, and stack variables are redacted before transmission. | United States | tools |
Anthropic, OpenAI & Amazon Bedrock United States / EU (varies by provider). Amazon Bedrock can be pinned to the AWS region. | AI-assisted control narratives, evidence suggestions, and remediation guidance. Engaged only when AI features are enabled, and only for the content submitted to those features. Enterprise customers may bring their own provider key (BYOK) — including Amazon Bedrock within the AWS boundary, or a self-hosted model — so AI calls route through their own account. | United States / EU (varies by provider). Amazon Bedrock can be pinned to the AWS region. | tools |
03Customer-configured integrations
Separately from the sub-processors above, the SecureByte platform can connect to third-party systems that you choose to integrate. These are not SecureByte sub-processors — they are services you already control, connected under your own agreements with those providers. You decide whether to enable them, and you supply the credentials and scopes. Cloud-posture connections are requested as read-only.
- Cloud posture (read-only): Amazon Web Services, Microsoft Azure, and Google Cloud, connected via least-privilege roles to read configuration and security metadata.
- Identity & directory: Microsoft 365 / Entra ID, Google Workspace, and SAML/OIDC identity providers (including Okta, Auth0, OneLogin, JumpCloud) for single sign-on and SCIM user provisioning.
- Code & development: GitHub, GitLab, and Bitbucket for application-security evidence.
- Collaboration & ticketing: Slack, Microsoft Teams, Discord, Jira, Linear, and PagerDuty for notifications and workflow.
- Endpoint, security & HR tooling: EDR/MDM (CrowdStrike, SentinelOne, Microsoft Intune, Jamf, Kandji), scanners (Snyk, SonarQube, Tenable), and HRIS systems (BambooHR, Rippling, Workday).
- Customer-controlled evidence storage: Google Drive, SharePoint, or OneDrive, as an alternative to SecureByte-managed AWS S3.
Because you control these connections, the relevant provider’s own terms and privacy policy govern them. You can revoke any integration at any time from your dashboard.
04Notification of changes
SecureByte will notify active customers by email at least 30 days before adding or replacing a sub-processor that will process personal information. The notice will identify the sub-processor, the purpose of engagement, and the location of processing.
05How to object
If you have a reasonable objection to a proposed sub-processor change, please reply to the change notification with your reasons. We will work in good faith to address the objection. If we cannot resolve the objection, you may terminate the affected part of the Service without penalty.