Primary database, authentication, file storage, realtime
- Data categories
- Identity details, Sign-in credentials, Documents, Activity events, Audit records
- Region
- EU (eu-west-1) with replication to US for backups
- Transfer mechanism
- EU SCCs 2021/914 + PDPA explicit consent at signup
AI model inference (Claude family) for conversational + analysis tasks
- Data categories
- Chat messages, Analysis written by officers, Narrative in forwarded applications, Document text, Document images, Identity data within free text (transfer ground unresolved)
- Region
- United States
- Transfer mechanism
- EU SCCs + zero-retention agreement on API tier
AI model inference for conversation + voice (Realtime API, Whisper)
- Data categories
- Chat messages, Voice recordings, held briefly
- Region
- United States
- Transfer mechanism
- EU SCCs + 30-day max retention, no training
AI model inference for structured extraction, internal plumbing, offline batch work, intent classification and short rewrites in English and Swahili, and English learning material
- Data categories
- Chat messages, Document text, Identity data within free text (transfer ground unresolved)
- Region
- Singapore
- Transfer mechanism
- UNDETERMINED SINCE 2026-08-07. An executed agreement exists, but the recorded transfer ground was per-subject opt-in consent scoped to behavioural batch summarisation, and the owner directive widened this provider to every data class including special category. The consent ground does not cover that and is not observable at dispatch, so no ground currently supports the actual flow. Counsel must select one; the widened purpose is separately notifiable to controllers.
Text-to-speech (Eleven v3) and speech-to-text (Scribe v2) for Swahili + English
- Data categories
- Voice recordings, Transcripts
- Region
- United States + EU
- Transfer mechanism
- EU SCCs + voice prints retained <30 days unless user opts in
SMS, WhatsApp Business, voice telephony for staged-call walkthrough
- Data categories
- Phone numbers, Message content, Call metadata
- Region
- United States with regional routing for Tanzania via local carrier
- Transfer mechanism
- EU SCCs + Twilio binding corporate rules
Tanzania-local SMS, USSD, voice routing (lower latency + cost)
- Data categories
- Phone numbers, Message content
- Region
- Kenya (regional African processing)
- Transfer mechanism
- Intra-EAC processing under EAC Treaty alignment
Edge CDN, WAF, DDoS protection, bot management
- Data categories
- IP addresses, Request headers, Edge network logs, kept for 24 hours
- Region
- Global edge network with EU/US primary
- Transfer mechanism
- EU SCCs + Cloudflare DPA
Mobile subscription billing, entitlements (Free/Standard/Premium)
- Data categories
- App user identifiers, Subscription status, Transaction identifiers
- Region
- United States
- Transfer mechanism
- EU SCCs + RevenueCat DPA
Frontend hosting, serverless functions, edge runtime
- Data categories
- Request logs, held briefly, Deployment metadata
- Region
- Global edge with EU/US primary
- Transfer mechanism
- EU SCCs + Vercel DPA