Subprocessors and data locations
The approved architecture candidates, processing regions and transfer safeguards. Appointment still requires contracting and deployment read-back.
Draft v0.2 · providers and regions selected; contracts/activation pending
Planned processing categories
| Provider/category | Data and location | Production status |
|---|---|---|
| Google Cloud Platform | Cloud Run, Cloud SQL, Secret Manager/KMS, logging and monitoring; Johannesburg, South Africa (africa-south1) | Control plane provisioned; customer data plane not active |
| Amazon Web Services | S3 Object Lock evidence/backup plus SES notification bridge; Cape Town, South Africa (af-south-1) | Email identity/evidence architecture qualified; production access and stores pending |
| Supabase Auth | Invitation-only customer identity, session and MFA records; Frankfurt, Germany (eu-central-1) | Selected; dedicated project, DPA and section 72 approval pending |
| Temporal Cloud | Identifiers, cursors, hashes and workflow state only; AWS Frankfurt (aws-eu-central-1), 30-day closed-history retention | Selected; contract, namespace and DPA pending |
| PagerDuty | Minimal alert metadata and operator contacts; global service, no raw customer finance records | Selected; contract, routing and human drill pending |
| Xero | Customer-authorised OAuth connection and draft journals in the customer's selected Xero tenant | Independent integration provider; app registration and acceptance pending |
| CASP, KYT, Travel Rule and pricing providers | Only the minimum transaction/compliance data required by the enabled service; provider-specific countries to be disclosed | Unappointed; no production transfer until named and contracted |
Appointment standard
- Written processing, confidentiality, security and incident terms.
- Documented data categories, purpose, location, retention and deletion.
- Least-privilege access and independent credential boundaries.
- Cross-border safeguard and onward-subprocessor controls.
- Exit/export assistance and verification of deletion where applicable.
POPIA section 72 safeguards and variances
South African processing is the default. The proposed variances are Supabase and Temporal in Frankfurt and PagerDuty's global alert service. They are accepted only because the selected services do not offer a South African region and because their payloads are deliberately minimised: identity/session data for Supabase, opaque identifiers/cursors/hashes for Temporal, and operational alert metadata for PagerDuty.
Before activation, each variance requires a signed DPA or binding terms with substantially similar protection, onward-transfer controls, encryption, least privilege, incident cooperation, data-subject assistance, deletion/export and auditable location/subprocessor commitments. A deployment manifest must prove the selected region and fail if a raw evidence, credential, customer document or locked numeric output is placed in Temporal or PagerDuty.
Change notice
The customer agreement gives at least thirty days' advance notice of a material new subprocessor. A customer may object on reasonable data-protection grounds; ChainClose will seek a reasonable alternative and, if none exists, the customer may terminate the affected service without an early-termination charge. This page will record appointment and effective dates only after contracts and deployment evidence are real.