Sub-processors
The categories of third parties AfriGRC may engage to process Personal Data in support of the Services, referenced from our Data Processing Agreement and Privacy Policy. We name categories rather than specific vendors below, pending legal and procurement review.
- Last Updated
- August 5, 2026
- Effective Date
- To be confirmed upon legal review
- Version
- 0.1 (Draft)
This page is a working draft of our Sub-processors list, published for transparency ahead of formal legal review. It does not constitute legal advice, does not name confirmed vendors, and should not be treated as a final, legally approved list until AfriGRC confirms it has completed that review.
Categories today, named vendors once confirmed.
This page lists the categories of third parties AfriGRC may engage as Sub-processors — entities that process Personal Data on our behalf, in support of the Services. We name categories rather than specific vendors below, the same choice our Privacy Policy's Data Sharing section already makes, until vendor confirmation is complete as part of formal legal and procurement review.
Categories of recipients, not a vendor list.
The same six categories named in our Privacy Policy's Data Sharing section — specific vendor confirmation is pending legal and procurement review.
| Category | Purpose | Data Location | Status |
|---|---|---|---|
| Cloud Infrastructure | Hosting and storage of the Platform's underlying infrastructure. | To be confirmed | Vendor confirmation pending legal & procurement review |
| Email Delivery | Delivering transactional and account-related email on our behalf. | To be confirmed | Vendor confirmation pending legal & procurement review |
| Payment Providers | Processing subscription billing, where applicable. | To be confirmed | Vendor confirmation pending legal & procurement review |
| Analytics | Understanding aggregated platform usage and performance. | To be confirmed | Vendor confirmation pending legal & procurement review |
| Professional Advisers | Legal, audit, and other professional advisers engaged under confidentiality obligations. | To be confirmed | Vendor confirmation pending legal & procurement review |
| Authorities | Regulators or law enforcement, only where legally required to disclose. | N/A | Engaged only if and when legally required |
Referenced by our Data Processing Agreement.
Our Data Processing Agreement references this list as the current statement of Sub-processor categories engaged by AfriGRC. Where a Customer's signed agreement requires a different or more specific Sub-processor disclosure mechanism, that agreement governs.
Contact Legal to be notified of updates.
An automated subscription mechanism for changes to this list is not yet available. In the meantime, contact our Legal team using the details in Contact Information below to ask about a specific Sub-processor category or to request advance notice of material changes for your organization's agreement.
Every revision, in one place.
- Establishes the page structure: category-level entries only, no vendor names.
- Data location and vendor confirmation for every category are pending legal and procurement review.
Questions about this list.
Privacy
General questions about how AfriGRC shares data — see our Privacy Policy for full detail.
Contact Privacy TeamQuestions about a specific Sub-processor category?
Reach our Legal team directly, or review the Data Processing Agreement this list supports.