Sub-processors
Effective date: see the version banner at the top of this page.
This page lists the sub-processors Zilo Software (Pty) Ltd ("Zilo") engages to provide the ItsSuite Service. Each entry identifies the sub-processor, the function it performs, and the country in which it processes personal information.
We notify Customers of changes to this list at least 30 calendar days before the change takes effect, via the platform announcements system. Customers may object on reasonable grounds — see the Data Processing Addendum §5.
Current sub-processors
Hosting and infrastructure
| Sub-processor | Function | Country |
|---|---|---|
| Insert hosting provider (e.g. Hetzner, AWS, Azure) | Compute, primary database storage, object storage for shared documents and knowledge base files | South Africa / EU |
| Insert CDN provider | Static asset delivery, image caching | Global |
| Insert backup storage provider | Encrypted off-site backups of the primary database | EU |
Communications
| Sub-processor | Function | Country |
|---|---|---|
| Meta Platforms Ireland Ltd | WhatsApp Business Platform — delivery of outbound messages, receipt of inbound messages, template approval, conversation billing | Ireland (EU) |
| Insert transactional email provider (e.g. Resend, Postmark) | Delivery of platform-issued transactional emails: verification OTPs, password resets, billing receipts, platform announcements | EU / US |
Artificial intelligence (only when the AI features are enabled in your workspace, and only when a workspace uses our key — not when BYO key is in effect)
| Sub-processor | Function | Country |
|---|---|---|
| OpenAI Ireland Limited | LLM inference for AI Respond, AI Classify, AI Summarise nodes; embedding generation for the knowledge base | Ireland (EU) |
| Anthropic PBC | Optional alternative LLM provider for AI nodes | United States |
Billing and payments
| Sub-processor | Function | Country |
|---|---|---|
| Insert payment processor (e.g. Stripe, Paystack) | Card processing, wallet top-ups, recurring subscription charges | EU / South Africa |
| Insert invoice / accounting service | Invoicing automation, VAT compliance | South Africa |
Observability and security
| Sub-processor | Function | Country |
|---|---|---|
| Insert error tracking (e.g. Sentry) | Application error logs and stack traces; scrubbed of personal information | EU / US |
| Insert log analytics | Operational log aggregation; scrubbed of message bodies and PII | EU |
| Insert vulnerability monitoring (optional) | Dependency CVE scanning, security advisories | EU / US |
How we choose sub-processors
Before engaging a sub-processor we conduct a vendor review that includes:
- a written processing agreement covering POPIA-equivalent obligations;
- a review of the sub-processor's security certifications (SOC 2, ISO 27001, BSI C5);
- a review of any cross-border transfer mechanism (Standard Contractual Clauses, adequacy decision);
- a review of the sub-processor's incident-response and breach- notification commitments.
Audit and inspection
A Customer may inspect a sub-processor's third-party audit report on written request. Some reports are subject to confidentiality undertakings.
Contact
To raise an objection or ask a question about this list, email legal@itssuite.com.
Initial template — entries marked "Insert ..." must be filled in with the actual sub-processors used in production before this list is relied on for compliance purposes.