Last updated: [[DATE]] · Subscribe to changes: [[SUBSCRIBE LINK / EMAIL]]
CredCheck ([[LEGAL ENTITY NAME]]) uses the service providers below to run the platform. Each one processes personal data only on our instructions, under a written agreement with data protection and security obligations.
Providers are configurable. CredCheck supports several interchangeable providers for messaging, payments and AI. Platform administrators choose which are active, and some choices depend on plan, country or customer selection (for example payment provider). This list includes every provider the platform is built to use. A provider receives data only when it is enabled for that processing. We give customers [[30]] days' notice before adding a new sub-processor (see the DPA, section 5).
Infrastructure (always used)
| Sub-processor | Purpose | Personal data | Processing location | Transfer mechanism |
|---|---|---|---|---|
| Hetzner Online GmbH | Cloud hosting of application servers, database, Redis and monitoring | All platform data | Germany (Nuremberg, nbg1). Other EU sites (Falkenstein, Helsinki) possible for resilience. | EU hosting. Transfer from Nigeria: [[NDPA s.41 mechanism]]. |
| Cloudflare, Inc. | CDN, DNS, TLS termination, WAF and rate limiting, visitor geolocation headers, bot protection (Turnstile, when enabled), R2 object storage (product and report images, code deliverables, scan archives, backups, data-request exports) | IP address, request metadata, stored files | Global edge network. R2 location [[CONFIRM jurisdiction or location hint]]. | [[SCCs / Cloudflare DPA; NDPA mechanism]] |
Messaging and notifications
| Sub-processor | Purpose | Personal data | Processing location | Transfer mechanism |
|---|---|---|---|---|
| Resend ([[LEGAL ENTITY — CONFIRM]]) | Transactional email to business users (invites, password resets, security, fraud, recall and billing notices) | Name, email address, message content | United States [[CONFIRM]] | [[SCCs / DPA]] |
| Africa's Talking ([[ENTITY — CONFIRM]]) | Consumer USSD sessions and SMS replies. SMS notifications to business users. Airtime top-ups for consumer rewards. | Phone number, USSD/SMS content (codes, results), airtime amount | [[CONFIRM — Kenya / Nigeria / cloud region]] | [[CONFIRM]] |
| Meta Platforms ([[Inc. / Ireland Ltd — CONFIRM contracting entity]]), WhatsApp Business Cloud API | Consumer verification over WhatsApp (messages, QR images). WhatsApp notifications. | Phone number, WhatsApp profile metadata, message content and images | United States / global | [[Meta Business terms, data processing terms]] |
| Expo (650 Industries, Inc.) | Push notification delivery for recall alerts and report updates. Expo forwards to Apple Push Notification service and Firebase Cloud Messaging. | Push token, notification content | United States | [[SCCs / DPA]] |
Payments (CredCheck acts as controller for billing)
| Sub-processor | Purpose | Personal data | Processing location | Transfer mechanism |
|---|---|---|---|---|
| Paystack ([[ENTITY — CONFIRM]]) | Subscription checkout, recurring charges | Billing contact name and email, payment card or bank details (held by Paystack, never CredCheck) | Nigeria / [[CONFIRM]] | [[CONFIRM]] |
| Flutterwave ([[ENTITY — CONFIRM]]) | Subscription checkout, recurring charges | As above | Nigeria / United States [[CONFIRM]] | [[CONFIRM]] |
| Stripe ([[Inc. / Payments Europe Ltd — CONFIRM]]) | Subscription checkout, recurring charges (mainly outside supported African markets) | As above | United States / EU | [[SCCs / DPA]] |
AI model providers (used only when AI features are enabled)
| Sub-processor | Purpose | Personal data | Processing location | Transfer mechanism |
|---|---|---|---|---|
| Anthropic, PBC | Copilot, intelligence briefs, forecast summaries, packaging photo comparison | Prompts with email addresses and phone numbers redacted. Tenant business data needed for the feature. Consumer packaging photos (cleaned of metadata). | United States | [[SCCs / DPA; confirm no training on API data and retention period]] |
| OpenAI ([[ENTITY — CONFIRM]]) | Same features, as primary or fallback per admin settings | As above | United States | [[As above]] |
| Google LLC (Gemini API) | Same features, as primary or fallback per admin settings | As above | United States / global | [[As above; confirm paid-tier data terms]] |
The platform can also run the packaging comparison with an on-server comparator that sends no data to any AI provider.
Not currently used
The platform configuration names these providers, but no integration is built yet:
- Termii and Twilio (SMS)
- Postmark, Amazon SES and SMTP relay (email)
- Firebase Cloud Messaging direct (push)
- Sentry (error monitoring)
- Google sign-in
They will be added to this list, with notice, before they process any personal data.
Operational tools (no personal data intended)
- Self-hosted Prometheus, Grafana, Loki and Tempo run on our own servers, so they are not sub-processors.
- PagerDuty and ntfy receive infrastructure alerts that are not intended to contain personal data. [[CONFIRM alert payloads, and whether ntfy is self-hosted]]