Data Processing Agreement

Roles

Where you upload or generate personal information inside your Komply workspace, you act as the responsible party under POPIA and Auto Alpha Advisory (Pty) Ltd (registration number 2025/213512/07), trading as Komply, acts as your operator. This page sets out the terms on which we handle that information. It forms part of our Terms of service and you accept it when you accept them.

Our undertakings as your operator

• We process personal information in your workspace only with your knowledge or authorisation: to provide Komply as you configure it, and on your other written instructions.
• We treat that information as confidential and do not disclose it, unless the law requires us to or it is needed for the proper performance of our duties, including to the sub-processors below.
• We maintain the security measures described under Security, and we bind each sub-processor by a written data processing agreement.

Sub-processors

• Supabase — application database, authentication, and file storage. EU region (Ireland).
• Vercel — application hosting and serverless runtime. Serverless functions run in the EU (Frankfurt, Germany), and a visitor's request first reaches Vercel's network at the point nearest them. Vercel is a US company with its main processing facilities in the United States, and it may process Komply's data wherever it or its subprocessors operate.
• DigitalOcean — runs our server in Amsterdam, the Netherlands, which hosts the audit engine and Umami. The audit engine is the upstream scanner that produces the compliance findings Komply mirrors into your dashboard; it receives the domain you ask us to scan, and its findings can include personal information your website shows. Umami is our cookieless, privacy-first web analytics, at analytics.mattsvault.xyz. It runs on our public marketing pages only (never in the signed-in dashboard) to measure aggregate page views and page performance, and it sets no cookies and builds no cross-site profile. DigitalOcean is a US company.
• Resend — transactional email delivery (sign-in links, monthly digest). United States.
• Google Workspace — hosts the mailbox that receives email sent to hello@ and io@getkomply.co.za (enquiries, data requests and service alerts). Google may process it in any country where Google or its subprocessors have facilities.
• Anthropic — large-language-model processing for three purposes: (1) tailoring a conflict-of-interest policy to the FSP. A guard rejects any rewrite that changes a template sentence or adds a law, and key individuals' and representatives' names are cut to initials before transmission (the FSP's registered name is sent as it is); (2) B-BBEE own-certificate field extraction — a certificate the tenant uploads, or a filed document that Komply's own check, run on Komply's servers before anything is sent, recognises as the tenant's B-BBEE certificate or sworn affidavit, or that the tenant says is one, is sent unredacted because the document content is required for extraction; this is the tenant's own data, processed on their behalf; and (3) FSCA licence reading — a filed document the tenant says is its FSP licence is sent as filed, to read the FSP number, name, category, products and licence date for the tenant to check and save in its FSCA set-up or FSP profile; Komply keeps the values only when the licence names the tenant's workspace. Anthropic, a US company, stores what Komply sends in the United States; Komply does not limit where Anthropic's model runs, so the model may process it in other countries. Anthropic deletes what Komply sends within 30 days, unless the law requires it to keep it longer or it flags a request as breaking its usage policy, when it may keep the request for up to 2 years and the safety classification scores for it for up to 7 years. Where its contract with Komply allows, it may also anonymise the data and keep it longer, for research or statistics. By default it does not use what Komply sends to train its models. We have no zero-data-retention agreement with Anthropic.
• CIPC APIVerse (CIPC / the dtic, South Africa) — company-registry lookup at onboarding (registration number → public company details and director roster). Data is processed within South Africa. Director ID numbers and dates of birth are stripped at our boundary and never stored. Not in use yet: the lookup is not switched on, so no data is sent to CIPC today.
• Sentry (Functional Software, Inc., a US company) — error tracking. Not in use yet; it receives nothing before 24 November 2026. Komply will then send Sentry its error reports (sign-in emails that fail to send, failed AI model calls and page errors). Komply will remove the personal information it can identify before sending a report, and will set Sentry not to store IP addresses; Sentry still works out an approximate location from the internet address a report comes from. Sentry stores the reports in the EU (Frankfurt, Germany) and can access them under its agreement with us.

PayFast (South Africa) handles subscription payments as a separate responsible party, under its own privacy policy, not as our sub-processor. Card details go to PayFast and never reach us.

Before we add or replace a sub-processor, we publish the change on this page at least 14 days before it takes effect, and email each workspace owner once Komply has paying customers.

Cross-border transfers

Your data leaves South Africa to reach the sub-processors above: Supabase (Ireland); Vercel (Frankfurt, Germany, and the United States, where its main processing facilities are); DigitalOcean (Amsterdam, the Netherlands); Resend (the United States); Anthropic (stored in the United States, and its model may run in other countries); and, once it is in use, Sentry (Frankfurt, Germany). For each transfer we rely on POPIA s72(1)(a): each sub-processor is bound by its data processing agreement with us. Those agreements are written for the EU's General Data Protection Regulation and other laws; none of them names POPIA. For Anthropic, policy wording is sent with key individuals' and representatives' names cut to initials and B-BBEE own-certificate extraction is the document content you uploaded on your own behalf, as is FSCA licence reading, while Resend handles only the recipient address and message content needed to deliver transactional email. Once Komply's CIPC lookup is switched on, CIPC APIVerse will process company-registry data within South Africa. Email sent to hello@ and io@getkomply.co.za is delivered to our Google Workspace mailbox (in any country where Google or its subprocessors have facilities). Our contract with each sub-processor binds it to protect your data, on the terms of its own agreement.

Security

Tenant isolation is enforced at the application layer: every database query is scoped to your workspace by your authenticated session. Row-Level Security policies provide defense in depth on the database side. Encryption in transit (TLS 1.2+) and at rest (AES-256). OAuth refresh tokens (Xero) are additionally encrypted at the application layer with AES-256-GCM. Access to production data is limited to named operators.

Breach notification

If there are reasonable grounds to believe that personal information in your workspace has been accessed or acquired by an unauthorised person, we notify you immediately, and in any event within 24 hours of becoming aware, with the facts known at that point. We send updates as the investigation continues, so that you can meet your own duty to notify the Information Regulator and the people affected.

Liability under this agreement

Our liability under this agreement sits inside the limits in the Terms of service (“Limits on our liability”), including the cap. Each of us bears its own costs of responding to a breach; a claim by you for costs caused by our breach of this agreement is subject to those limits.

On termination

When you close your workspace, its records are retained for 12 months (so you can recover if you change your mind), then permanently deleted. Files you uploaded, such as B-BBEE certificates and employer-record receipts, are deleted on request: automatic deletion of stored files is not yet switched on. Documents waiting in the filing tray are the exception: they are deleted 90 days after upload unless Komply has filed them. You can request earlier deletion of anything at any time via hello@getkomply.co.za.

A signed counterpart

Enterprise customers can request a counter-signed PDF version of this DPA on letterhead. Email hello@getkomply.co.za and we'll send one within two business days.