Sub-processors
This page lists the infrastructure and operational sub-processors that Verify Now engages to provide our identity verification services.
Overview
To provide reliable and secure identity verification services, Verify Now engages certain third-party service providers ("sub-processors") who process personal information on our behalf. These sub-processors provide infrastructure and operational services that enable us to deliver our platform.
Key Point: Sub-processors listed here are infrastructure and operational partners only. They do not include verification data sources (such as the Department of Home Affairs), which are authoritative sources accessed under lawful authority rather than sub-processors.
Current processing: Ordinary single-check reports are delivered without private-file storage by default. All temporary private-file storage and primary application request execution take place in Cape Town, South Africa. Isolated image rendering takes place in Johannesburg. Global edge security and managed Redis services can process limited technical and time-limited idempotency records outside South Africa. The customer register records each scope, location and safeguard.
Important Distinction
Sub-processors (Listed Below)
Third-party service providers who process data on our behalf to support our infrastructure and operations:
- • Cloud hosting providers
- • Database services
- • Private file storage
- • Time-limited idempotency
- • Biometric face comparison
- • Email/SMS delivery
- • Monitoring and analytics
- • Support tooling
Verification Sources (NOT Sub-processors)
Authoritative data sources we access to verify identity information under lawful authority:
- • Department of Home Affairs (DHA)
- • Other lawful government sources
- • Authorised fraud-prevention and verification data providers
- • Other legally permitted sources
Sub-processor Categories
Cloud Hosting & Infrastructure
We use cloud infrastructure providers that offer enterprise-grade security, including global edge networks with DDoS protection, Web Application Firewalls, and serverless architecture to minimise our attack surface.
- Automatic managed TLS certificates (TLS 1.3 with 1.2+ fallback)
- HTTPS-only enforcement across all endpoints
- Automatic security patching on infrastructure
- Bot protection and rate limiting
Database Services
We use managed database services that provide encryption at rest (AES-256 or equivalent), automated backups, and access controls. These services hold account, billing, audit, reference, and service-status metadata. Ordinary report files and biometric images are excluded from the managed database.
- Data encrypted at rest and in transit
- Automated backup and recovery capabilities
- Role-based access controls
Email & SMS Communications
We use email and SMS delivery services to send transactional notifications, verification codes, and service communications.
- Transactional email delivery
- SMS verification codes
- Service notifications
Monitoring & Security
We use monitoring services to ensure platform availability, detect security threats, and maintain service performance.
- Application performance monitoring
- Error tracking and alerting
- Security event logging
Support Tooling
We use customer support tools to manage inquiries and provide assistance to our customers.
- Help desk and ticketing
- Customer communication management
Sub-processor Register
A detailed register of our current sub-processors, including their functions, information scope, processing locations, and transfer safeguards, is available to enterprise customers through the CRM document package or on request.
To Request the Sub-processor Register:
Contact us at privacy@verifynow.co.za
Please include your company name and reference your existing Data Processing Agreement.
Change Notification Process
We are committed to transparency about changes to our sub-processor list:
- Advance Notice: Customers with a DPA will receive at least 30 days' notice before a new sub-processor begins processing personal data
- Objection Rights: Customers may object to new sub-processors within the notice period as outlined in the DPA
- Page Updates: This page will be updated to reflect any changes to sub-processor categories
Sub-processor Requirements
All sub-processors are required to:
- Enter into binding data protection agreements with us
- Implement appropriate technical and organisational security measures
- Process personal data only according to our documented instructions
- Maintain confidentiality of all personal data processed
- Support our compliance with data protection obligations
We manage sub-processor appointments through contractual, security, and oversight controls. Verify Now remains responsible for its own obligations under our DPA and applicable data protection law, subject to the limitations, exclusions, and allocation of responsibility in the Terms of Service and any signed customer agreement.
Contact Information
Questions About Sub-processors?
Company: Urban Luxury Brands (Pty) Ltd trading as VerifyNow
Registration number: 2007/013732/07
Email: privacy@verifynow.co.za / hello@verifynow.co.za
Website: www.verifynow.co.za