Sub-processors and data processing
Last reviewed: 27 August 2026
Ozah Digital Limited uses service providers for defined technical purposes. This register states what the application is currently configured to use and clearly separates live use, test configuration and providers that are not engaged.
A provider being listed here does not claim that a separate negotiated DPA has been signed. Rows marked for contract review remain a compliance action until the applicable agreement, transfer terms and security material have been verified and recorded.
Provider register
| Provider | Purpose | Data | Location | Status |
|---|---|---|---|---|
| Supabase | Managed PostgreSQL database and authentication services | Workspace, prospect, customer, staff and audit records | EU project region | In use; contract review required |
| Vercel | Application hosting and delivery | Request metadata, network addresses and form data in transit | Global edge with configured EU compute region | In use; contract review required |
| Resend | Transactional email, including sign-in codes and requested reports | Recipient address, subject, message content and delivery events | Provider infrastructure outside and within the EU | In use; contract review required |
| Anthropic | AI-assisted drafting and summarisation when an AI workflow is selected | Public business facts, evidenced findings and limited drafting context | United States | In use; contract review required |
| Google Maps Platform | Places discovery and PageSpeed measurements | Business search terms, public place identifiers and website URLs | Global | In use; contract review required |
| Paystack | Payment initiation and transaction verification | Payer contact, amount, reference and payment status; no full card number | Nigeria and provider infrastructure | Test mode only |
| Inngest Cloud | Hosted background workflow delivery | Workflow identifiers and configured event payloads | Provider infrastructure | Not engaged |
| Amazon SES | Separate cold-outreach email delivery | Recipient address, approved message and delivery event | Configured EU region | Not engaged |
| Cloudflare R2 | Object-locked storage for signed contract files | Signed commercial documents and integrity metadata | Configured storage region | Not engaged |
| Upstash | Hosted rate limiting and cache | Protected request keys, counters and short-lived cache entries | Configured EU region | Not engaged |
| Sentry | Application error monitoring | Scrubbed error and performance telemetry | Configured project region | Not engaged |
International transfers
When a provider processes personal data outside Nigeria, we assess the destination, contractual protection, necessity and available regional controls under the Nigeria Data Protection Act 2023. A configured region reduces data movement but does not replace a transfer assessment.
AI processing boundary
AI drafting receives the minimum context required for the selected task, such as a business name, public facts and findings already tied to evidence. Extraction treats website content as untrusted data and does not give the model tools. Raw encrypted contact fields, payment data, inbox contents and private customer files are not intended AI prompt inputs.
Changes and objections
We review this register on the schedule shown above and before enabling a materially new provider. Existing customers can ask how a provider affects their data or object where the law provides that right.
See our privacy notice and terms of service.