Subprocessor register.
This is the complete, published list of every third party that processes personal information on our behalf — its purpose, the data categories involved, where it is based, and the agreement in place. We publish it in full rather than gate it behind a request: if you are trusting us with your tenants' data, you should be able to see exactly who else touches it.
Your personal information is held at rest inside the Republic. The primary database — tenant, landlord and applicant identity, leases, payments and financial records — runs on Amazon Web Services in the Cape Town region (af-south-1), and sensitive documents (IDs, FICA, leases, proof of payment) are held in a private object-storage store in the same South African region. Both choices were made deliberately for POPIA data residency.
Two categories of processing remain cross-border and are listed as such below: our application and edge layer runs on global infrastructure (transient processing in transit, not where data lives at rest), and a handful of optional, opt-in integrations are cross-border by nature. Where personal information crosses a border we rely on the conditions in POPIA s.72.
Hosted in South Africa
Personal information processed by these providers stays inside the Republic.
Amazon Web Services (RDS)
In South AfricaManaged PostgreSQL database — primary application data
- Location
- South Africa (Cape Town, af-south-1)
- Data shared
- Tenant, landlord, and applicant identity, Lease and payment records, Maintenance, inspections, security incidents, Document metadata and storage references
- Agreement
- Standard DPA (click-through) — view
Production database runs in the AWS Cape Town region (af-south-1) so personal information stays inside the Republic for POPIA data residency.
Vercel Blob — private document store
In South AfricaObject storage for sensitive documents (IDs, FICA, leases, proof of payment, signed PDFs)
- Location
- South Africa (Cape Town, cpt1)
- Data shared
- ID documents, FICA records, Lease PDFs, Proof of payment, Tax pack exports
- Agreement
- Standard DPA (click-through) — view
Dedicated private store provisioned in the Cape Town region. Access is authorised per request and the underlying storage URL is never exposed to the client. Covered by the Vercel master DPA accepted at signup.
Stitch
In South AfricaHistorical — processed tenant payment, DebiCheck mandate, and payout data prior to retirement of the integration
- Location
- South Africa
- Data shared
- Bank identifiers, Mandate metadata, Payment amounts, ID number (mandate)
- Agreement
- Integration retired — no active agreement — view
RETIRED — the Stitch integration has been decommissioned. No new personal data flows to Stitch and the API credentials have been revoked. This entry is retained for POPIA transparency because tenant payment and DebiCheck mandate data was processed by Stitch prior to retirement. Rent collection and payouts now run on the supported bank-CSV / direct bank-feed model.
TPN (Tenant Profile Network)
In South AfricaTenant credit + rental history screening
- Location
- South Africa
- Data shared
- Applicant ID number, Rental history, Income / employment data
- Agreement
- Partner agreement executed at activation — view
Screening agreement signed when an agency activates TPN integration.
SMS Gateway for Android
In South AfricaOutbound SMS for OTP, alerts, lease updates
- Location
- Self-hosted or operator location
- Data shared
- Phone numbers, SMS body content
- Agreement
- Standard DPA (click-through) — view
EskomSePush
In South AfricaLoad-shedding schedule sync
- Location
- South Africa
- Data shared
- Property suburb / area code
- Agreement
- No personal information shared — view
No personal information shared — only public area codes.
Beagle Watch / Fidelity ADT / Chubb / Aura / Namola
In South AfricaArmed-response dispatch from tenant emergency alerts
- Location
- South Africa
- Data shared
- Tenant name, Property address, Emergency category, Coordinates
- Agreement
- Partner agreement executed at activation
Activated only for opted-in workspaces with a connected security profile. Each provider signs a partner agreement at activation.
Cross-border (POPIA s.72 safeguards)
These providers process data outside the Republic. Each transfer relies on a comparable data-protection regime, contractual necessity, or binding rules that meet POPIA's standard. Several are optional and only engaged for workspaces that switch them on.
Vercel
Cross-borderApplication hosting, build, and edge request delivery
- Location
- United States (global edge)
- Data shared
- Application logs, Request metadata, IP addresses, Page content in transit
- Agreement
- Standard DPA (click-through) — view
Compute / edge layer only — requests are processed here in transit. Personal data at rest lives in the South African database and the private document store, not on Vercel compute.
Vercel Blob — public media store
Cross-borderObject storage for non-sensitive inline media (avatars, inspection and maintenance photos)
- Location
- United States
- Data shared
- Profile avatars, Inspection photos, Maintenance photos
- Agreement
- Standard DPA (click-through) — view
Non-sensitive media only. No identity, financial, or contractual documents are stored here — those live in the private Cape Town store above.
Meta / WhatsApp Business Platform
Cross-borderTenant + vendor messaging, MFA delivery
- Location
- United States / Ireland
- Data shared
- Phone numbers, Message content, Delivery metadata
- Agreement
- Standard DPA (click-through) — view
Business Data Transfer Addendum auto-applied to every WABA.
CloudMailin
Cross-borderInbound email parsing for utility bills + bank notifications
- Location
- United Kingdom
- Data shared
- Forwarded utility statements, Bank notification email content
- Agreement
- Standard DPA (click-through) — view
SMTP / Email Provider
Cross-borderTransactional and operational email
- Location
- Varies (configured per workspace)
- Data shared
- Recipient email addresses, Email subject and body
- Agreement
- Standard DPA (click-through)
Provider determined per workspace via SMTP_* environment variables. DPA is whichever provider you configure.
Intuit QuickBooks Online
Cross-borderAccounting reconciliation (optional, opt-in)
- Location
- United States
- Data shared
- Bank transactions, Invoice and receipt totals
- Agreement
- Standard DPA (click-through) — view
Sentry
Cross-borderError tracking and observability (optional)
- Location
- United States
- Data shared
- Stack traces, User id, Browser metadata
- Agreement
- Partner agreement executed at activation — view
Sentry requires the DPA to be downloaded, signed, and emailed back to privacy@sentry.io.
Google (Google Ads)
Cross-borderAdvertising conversion measurement on the public marketing site (gtag.js)
- Location
- United States (global)
- Data shared
- Advertising cookie identifiers, IP address, Page/conversion events on marketing pages
- Agreement
- Standard DPA (click-through) — view
Marketing site only — the gtag.js conversion tag (AW-18185546277) never runs inside the authenticated application. Disclosed in the Privacy Policy cookies section and the cookie banner; operates under Google Ads Data Processing Terms.
Section 21 of POPIA requires us to maintain a written list of operators and the processing they perform. This page is that register, kept current as our providers change.
Active customers can request advance written notice of any new sub-processor, and a counter-signed copy of the register, from our Information Officer at privacy@regalis.co.za. The right to object to a new sub-processor is set out in our Data Processing Agreement.