Legal · Sub-processors

Sub-processors

The services that process data on our behalf — their role, where they process it, and the agreement covering them. The Markdown twin is the AI-readable form.

Sub-processorRoleRegionDPA
PostHog Inc.Product analytics + session replayEU (Frankfurt)Standard PostHog DPA
Functional Software, Inc. (Sentry)Error + performance monitoringEUStandard Sentry DPA
Grafana LabsMetrics visualisationEUStandard Grafana Cloud DPA
Google Cloud PlatformHosting (Cloud Run, Functions, Firestore)europe-west1 (Belgium)Google Cloud DPA
Firebase (Google)Auth, Firestore, Hostingeurope-west1Google Cloud DPA
WiraPayHosted checkout + subscription billingEU (europe-west4 NL, eu-central-1 DE)Same operator (Citizens Draft) — first-party, not a third party
PaystackPayment processing (card + M-Pesa rails)Ireland (AWS); company HQ NigeriaPaystack DPA, via the Merchant Services Agreement
Safaricom PLC (M-Pesa)M-Pesa rail, engaged by PaystackKenyaCovered by Paystack's sub-processor flow-down
Anthropic, PBCAI destination generationUS (EU when available)Anthropic DPA
ResendTransactional emailEUResend DPA
Nager.DatePublic holiday lookupEUPublic API, no PII transmitted

We update this list before adding a new sub-processor. More in our privacy policy.

About the payment chain

Paying goes roamgap → WiraPay → Paystack → your card network or M-Pesa.

WiraPay is our own payment service, operated by Citizens Draft — the same business that operates roamgap. It is listed above because you are handed off to it at checkout and it is a visibly different service, but it is not a third party, so there is no data-processing agreement between us and it. roamgap never sees or stores your card details.

Paystack is the payment processor WiraPay uses, and it is a genuine third party under a data-processing agreement. Safaricom provides the M-Pesa rail; Paystack engages it, and Paystack’s agreement covers that onward step.