Sub Processors
Version 1, approved 1 Nov 2026
Sub-processors
Bluetrino SA PTY Ltd uses the service providers below to run ComplianceThing. Each processes personal information only on our instructions, under written terms at least as protective as our Data Processing Agreement.
We give customers 30 days' notice before adding a sub-processor. A customer may object on reasonable grounds; email support@bluetrino.com.
| Sub-processor | Purpose | Data | Location |
|---|---|---|---|
| Supabase | Database, authentication, file storage | All account data and Customer Content | Ireland (AWS eu-west-1) |
| Vercel | Hosting the web application | Data in transit while requests are served | Ireland (functions in Dublin); requests enter at the nearest edge, Cape Town for South African users |
| OpenAI | AI assessments, amendments, consistency checks, the assistant, search embeddings, optical character recognition (OCR) | Document text and questions sent to the model; document files or images submitted for OCR | United States |
| Anthropic | AI assessments, amendments, consistency checks, the assistant, search embeddings, optical character recognition (OCR), depending on the feature and provider selected | Document text and questions sent to the model; document files or images submitted for OCR | United States |
| Mistral AI | AI assessments, amendments, consistency checks, the assistant, search embeddings, optical character recognition (OCR), depending on the feature and provider selected | Document text and questions sent to the model; document files or images submitted for OCR | European Union |
| Sentry | Error and performance monitoring | Error reports and performance traces: stack traces, page addresses, timings and browser details. User details, request bodies and AI inputs and outputs are switched off | United States |
| Resend | Sending email | Name, email address, message content | Ireland (eu-west-1) |
| Cloudflare (Turnstile) | Bot protection at sign-in | IP address, browser signals | Global network |
| Optional sign-in | Name, email address | Global |
Transfers outside South Africa
Customer Content is stored and processed in Ireland, where the GDPR applies. Only OpenAI and Sentry receive it in the United States, each under a data processing agreement that protects personal information in a way substantially similar to POPIA (section 72). OpenAI may not use Customer Content to train its models and does not keep our responses; its abuse-monitoring logs are kept for up to 30 days.