LitFin Sub-processors

These are the third parties we engage to deliver the platform. We publish this list to satisfy Tanzania PDPA s.34, GDPR Art. 28(2)(4), and the sub-processor objection clause in our Data Processing Agreement.

Version 2026.08.07Machine-readable JSON Read the DPA

Supabase Inc.

Added 2025-10-01

Primary database, authentication, file storage, realtime

Data categories: identity, credentials, documents, events, audit
Region: EU (eu-west-1) with replication to US for backups
Transfer mechanism: EU SCCs 2021/914 + PDPA explicit consent at signup
Their DPA: https://supabase.com/legal/dpa

Anthropic PBC

Added 2025-10-01

AI model inference (Claude family) for conversational + analysis tasks

Data categories: chat_messages, document_text
Region: United States
Transfer mechanism: EU SCCs + zero-retention agreement on API tier
Their DPA: https://www.anthropic.com/legal/dpa

OpenAI, L.L.C.

Added 2025-10-01

AI model inference for conversation + voice (Realtime API, Whisper)

Data categories: chat_messages, voice_audio_short_lived
Region: United States
Transfer mechanism: EU SCCs + 30-day max retention, no training
Their DPA: https://openai.com/policies/data-processing-addendum

DeepSeek AI

Added 2025-11-15

AI model inference for structured extraction, internal plumbing, offline batch work and English learning material

Data categories: chat_messages, document_text, identity_data_in_free_text_UNRESOLVED
Region: Singapore
Transfer mechanism: UNDETERMINED SINCE 2026-08-07. An executed agreement exists, but the recorded transfer ground was per-subject opt-in consent scoped to behavioural batch summarisation, and the owner directive widened this provider to every data class including special category. The consent ground does not cover that and is not observable at dispatch, so no ground currently supports the actual flow. Counsel must select one; the widened purpose is separately notifiable to controllers.

ElevenLabs Inc.

Added 2025-11-01

Text-to-speech (Eleven v3) and speech-to-text (Scribe v2) for Swahili + English

Data categories: voice_audio, transcripts
Region: United States + EU
Transfer mechanism: EU SCCs + voice prints retained <30 days unless user opts in
Their DPA: https://elevenlabs.io/dpa

Twilio Inc.

Added 2025-12-01

SMS, WhatsApp Business, voice telephony for staged-call walkthrough

Data categories: phone_number, message_content, call_metadata
Region: United States with regional routing for Tanzania via local carrier
Transfer mechanism: EU SCCs + Twilio binding corporate rules
Their DPA: https://www.twilio.com/legal/data-protection-addendum

Africa's Talking Ltd.

Added 2025-12-15

Tanzania-local SMS, USSD, voice routing (lower latency + cost)

Data categories: phone_number, message_content
Region: Kenya (regional African processing)
Transfer mechanism: Intra-EAC processing under EAC Treaty alignment

Cloudflare Inc.

Added 2025-10-01

Edge CDN, WAF, DDoS protection, bot management

Data categories: ip_address, request_headers, edge_logs_24h
Region: Global edge network with EU/US primary
Transfer mechanism: EU SCCs + Cloudflare DPA
Their DPA: https://www.cloudflare.com/cloudflare-customer-dpa/

RevenueCat Inc.

Added 2026-01-15

Mobile subscription billing, entitlements (Free/Standard/Premium)

Data categories: app_user_id, subscription_status, transaction_id
Region: United States
Transfer mechanism: EU SCCs + RevenueCat DPA
Their DPA: https://www.revenuecat.com/dpa/

Vercel Inc.

Added 2025-10-01

Frontend hosting, serverless functions, edge runtime

Data categories: request_logs_short_term, deployment_metadata
Region: Global edge with EU/US primary
Transfer mechanism: EU SCCs + Vercel DPA
Their DPA: https://vercel.com/legal/dpa

Objection window

When we add or change a sub-processor, active bank customers under our DPA receive a 30-day objection window. To subscribe to change notifications email privacy@litfin-training.com.