Sub-processors
Infrastructure and payment providers used by VerifyNow.
Review date: 3 November 2026. Verification scope is listed for each provider.
- Providers listed
- 10
- South African processing
- 9
- Outside South Africa only
- 1
| Provider | Purpose | Processing location |
|---|---|---|
| Fly.ioInfrastructurePrivacyCompliance documentsSecurity certificationsSOC 2 Type 2 | Purpose:Document Intelligence analysis and isolated image rendering | Location:South AfricaJohannesburg, South Africa for the application workload; account, support and operational services may use other locationsDocument Intelligence requests are authenticated and restricted to the Johannesburg analysis runtime. Temporary working files are removed after processing. This workload location does not describe all provider account, support, log or backup processing. |
 | Purpose:Application and API hosting; batch processing and report delivery. | Location:South AfricaPrimary application execution: Cape Town, South Africa. Edge delivery, logs and support may involve other locations.Application and API hosting; access is controlled by authenticated accounts. |
 | Purpose:Private storage for temporary Proof of Address and Document Intelligence uploads, large-batch source files and downloadable CSV results. | Location:South AfricaCape Town, South Africa (af-south-1).Versioning disabled; no replication rules. Public access blocked, HTTPS and encrypted uploads required. Batch-result and source-file expiry rules apply after 30 and seven days from upload. Temporary Proof of Address and Document Intelligence uploads have a one-day lifecycle backstop alongside scheduled cleanup; lifecycle deletion is asynchronous. |
 | Purpose:Managed Redis for API retry processing, encrypted Document Intelligence responses, encrypted batch inputs and results, and encrypted retained vehicle and asynchronous bank results | Location:South AfricaAWS Cape Town, South Africa (af-south-1); no additional read regions configured for the application cache.Authenticated cache access and expiry controls support processing, retries and temporary results. OTP code hashes, recipient-derived abuse tokens and retry payloads use encrypted Cape Town storage with service-specific expiry. The application database retains opaque references and billing controls. |
| NeonInfrastructurePrivacySecurity certificationsSOC 2 Type 2ISO/IEC 27001ISO/IEC 27701 | Purpose:Authentication, user accounts, billing and operational metadata | Location:United StatesAWS Northern Virginia, USA (us-east-1).How we protect this data outside South AfricaDatabase connections use TLS and the provider encrypts stored data at rest. Access is limited to authenticated VerifyNow systems and authorised staff. Large-batch inputs and results are not stored here: they are encrypted in Cape Town, and this database keeps only opaque references to them. Processing follows the provider’s data processing terms and POPIA’s cross-border transfer requirements.Application records and database backups follow their applicable retention schedules. |
 | Purpose:Training-material storage. Legacy private-file integrations follow their service retention controls. | Location:South AfricaTraining materials: South Africa, confirmed by VerifyNow. Other Cloudflare services follow their applicable processing arrangements.Access and retention depend on the relevant media or private-file service. |
| PaystackPaymentsPrivacySecurity certificationsPCI DSS Level 1ISO/IEC 27001ISO/IEC 27701 | Purpose:Payment checkout, payment authorisation and transaction reconciliation. | Location:South Africa and internationalSouth African and international services; see the provider privacy policy for its processing arrangements.How we protect data processed outside South AfricaCard details are entered on the payment provider’s own checkout, so VerifyNow does not receive or store full card numbers. Saved-card references are stored encrypted. The provider protects payment data under its own security and card-industry obligations.Payment information is handled under the payment provider’s security and retention terms. |
| PayfastPaymentsPrivacySecurity certificationsPCI DSS Level 1 | Purpose:Historical payment records and payment reconciliation. Legacy credit-fulfilment endpoints are disabled. | Location:South Africa and internationalSouth African and international services; see the provider privacy policy for its processing arrangements.How we protect data processed outside South AfricaCard details are entered on the payment provider’s own checkout, so VerifyNow does not receive or store full card numbers. Saved-card references are stored encrypted. The provider protects payment data under its own security and card-industry obligations.Payment information is handled under the payment provider’s security and retention terms. |
| SMS delivery partnerSMS OTP deliverySMS OTP processing terms | Purpose:Delivery of requested transactional SMS codes. Production activation is subject to routing and legal review. | Location:South AfricaSouth African supplier; published policy permits cross-border processing. Exact hosting, support and downstream routing locations require contractual confirmation before activation.Policy reviewed 21 October 2026. Message content is retained for operational or lawful needs; communication-related metadata is retained for approximately three years. Carrier and backup schedules are separate. VerifyNow processing expiry does not delete downstream carrier records. |
| Face match servicesBiometric verificationSecurity certificationsiBeta ISO/IEC 30107-3 PAD Level 1ISO/IEC 27001:2022 | Purpose:Comparison of a selfie with a reference identity photo when a customer runs a face match check. | Location:South Africa and EUSouth Africa and the European Union.How we protect data processed outside South AfricaOnly the two images needed for the comparison are sent, over encrypted connections. Processing in the European Union is subject to the EU General Data Protection Regulation, which gives protection substantially similar to POPIA, and to the supplier’s processing terms.Images are sent only when a face match check is requested. |
Batch services retain submitted information while processing and delivering results. File, result, consent and audit records follow the retention schedules below.
Batch storage update: 16 October 2026
New batch row inputs and verification results are encrypted with AES-256-GCM and stored in the existing Cape Town Redis database. The application database holds opaque storage references alongside account, billing and operational metadata. Downloadable files remain in private Cape Town S3 storage. Live-data expiry and provider backup retention are separate controls.
Batch processing and personal information
Batch services process submitted identity details and verification results to complete the requested checks and deliver reports. Account, operational and billing records are retained under their applicable schedules. Private batch files use the Cape Town S3 storage described above.
Encryption and access
HTTPS protects transfers. Private batch files use S3 AES-256 encryption and authenticated downloads. API duplicate-request protection can retain responses containing personal information for up to 72 hours to support retries without duplicate charges.
Processing period and deletion
Batch results have a default access period of 30 days after completion. Large-batch source uploads have a seven-day retention period. S3 lifecycle rules expire result files 30 days from upload and source files seven days from upload. Scheduled cleanup removes expired data; failed deletions are retried. Expired access links do not by themselves establish that a file has been erased.
Scope of the storage statement
The S3 location statement applies to private files in the Cape Town bucket. Account, billing, audit and backup records have separate retention schedules. Supplier processing, payment services, email delivery and customer-downloaded copies follow their respective arrangements.
Data residency and data sovereignty in South Africa
VerifyNow hosts its application and its private file and batch storage in South Africa. Uploaded identity documents, large-batch files and batch verification results are processed and stored in South African data centres, so that data stays under South African jurisdiction and the Protection of Personal Information Act (POPIA).
- Cape Town: private file storage for uploads, batch source files and downloadable results, plus the encrypted cache for batch inputs, results and retry data.
- Johannesburg: Document Intelligence analysis, with temporary working files removed after processing.
- Cape Town application hosting: primary execution of the web application and API.
Providers with South African processing: Fly.io, Vercel, AWS (Amazon Web Services), Upstash, Cloudflare, Paystack, Payfast, SMS delivery partner, Face match services. Where a provider also processes data elsewhere, its entry above explains how that data is protected.
Processing outside South Africa
Neon (United States) holds account, login, billing and operational records. Large-batch inputs and results are not stored there: they are encrypted in Cape Town and referenced only by opaque identifiers.
Section 72 of POPIA permits a transfer of personal information outside South Africa only when a listed condition applies, for example when the recipient is bound by a law, binding corporate rules or an agreement giving protection substantially similar to POPIA. For processing outside South Africa, VerifyNow sends only the data a service needs, encrypts it in transit with HTTPS or TLS, limits access to authenticated systems and authorised staff, and relies on the provider's data processing terms. Security safeguards follow POPIA section 19, and providers acting as operators process personal information under sections 20 and 21.
Data residency questions
Where does VerifyNow store personal information?
The web application and API run in Cape Town. Uploaded documents, large-batch files and batch results are stored in private, encrypted file storage in Cape Town. The cache that holds encrypted batch inputs, results and retry data also runs in Cape Town. Document analysis runs in Johannesburg. Face match is processed in South Africa and the European Union. Account, login, billing and operational records are held in a database in the United States, which keeps only opaque references to Cape Town batch data.
Does VerifyNow keep data in South Africa for data sovereignty?
The services that store uploaded identity documents, batch files and batch results are hosted in South Africa, so that data stays under South African jurisdiction while it is processed and stored. The register on this page lists each provider, its processing location and any processing that takes place elsewhere.
What does POPIA say about transferring personal information outside South Africa?
Section 72 of the Protection of Personal Information Act (POPIA) allows a transfer to a third party in a foreign country only if a condition applies. Examples are that the recipient is bound by a law, binding corporate rules or a binding agreement that gives protection substantially similar to POPIA, that the data subject consents, or that the transfer is necessary to perform a contract with the data subject.
How is data protected when a provider processes it outside South Africa?
Only the data a service needs is sent. Connections are encrypted with HTTPS or TLS, access is limited to authenticated systems and authorised staff, and processing follows the provider’s data processing terms and POPIA’s cross-border requirements. Each such provider shows its specific safeguards in the register.
Are VerifyNow’s providers operators under POPIA?
A provider’s role depends on the service. Where a provider processes personal information for VerifyNow, it acts as an operator. POPIA sections 20 and 21 require operators to process only with authorisation, keep the information confidential and maintain security safeguards under a written contract.
Questions about where your data is processed? Email privacy@verifynow.co.za.
This register covers infrastructure and payment services. A provider’s data-protection role depends on the service and processing arrangement.
Verification services may involve government sources, authorised data suppliers and specialist verification providers. These suppliers are described by category. Applicable operator agreements and lawful disclosure duties follow their processing role.