Service providers & subprocessors

This is a functional register of principal platform dependencies, last reviewed on the date shown. A provider is involved only where the relevant feature or workflow uses it. Inclusion is not a claim that every provider receives every customer’s information, or that every payment method is available in every country.

Some providers process data for Centranet, some provide services directly to the customer, and some act as independent controllers. The actual role, contracted entity, processing locations and safeguards must be assessed for the specific service. Contact us for details needed to complete your supplier assessment.

Vercel supports the public website and application delivery. Cloudflare supports configured DNS, edge delivery, protection, custom domains and gateway routing. Supabase supports configured authentication, databases and backend functions. Contabo hosts configured Centranet operational services on the VPS.

These services can handle connection metadata and the application or operational information needed for their functions. Their inclusion does not imply that data exists only in Kenya or only on one server. Hosting and service arrangements can differ between platform modules.

Resend and Centranet’s VPS mail service support configured outbound mail and incoming mail workflows. Meta’s WhatsApp platform supports authorized business messages, templates and delivery events. SMS providers, including Onfon where configured, receive the telephone and message data needed to deliver a communication.

Sentry receives configured application diagnostics and error context. Avoid entering unnecessary secrets or sensitive subscriber information into free-text fields or diagnostic attachments. Processing and retention also depend on the provider’s configuration and applicable agreement.

IntaSend and Safaricom M-Pesa are used for supported and enabled payment workflows. Other providers, such as Paystack or a customer’s independently configured gateway, may be involved where explicitly selected and available. They may process payer details, transaction references and financial or verification data under their own obligations.

A customer’s independent payment, SMS, email, analytics or domain account is not automatically a Centranet-appointed subprocessor. Identify the account owner, roles and applicable provider terms before enabling the integration.

OpenAI/Codex supports authorized assistant workflows, which may involve task instructions, selected business content and relevant application context. This register does not promise that all processing is local, that no provider retains data, or that a particular model-training exclusion applies without the relevant account terms.

LinkedIn, Meta and other authorized social channels receive the content and account authorization needed for enabled publishing. Optional Google Analytics and Microsoft Clarity, when permitted through cookie choices, receive public website measurement data. Account access does not mean every social API capability has been approved.

For contracted processing, material subprocessor changes and objections are handled under the applicable data-processing terms. Ask for the current service-specific list, entity details, locations and transfer safeguards if needed for procurement or compliance. Customer-selected providers and their downstream suppliers should also be included in your own assessment.