| Provider | Location | Purpose | Data boundary |
|---|---|---|---|
| Amazon Web Services and applicable contracting affiliate | South Africa (Cape Town) for selected application services; provider support/control-plane locations as described in its service terms | DNS/TLS, application delivery, container runtime, identity/MFA, logs and transactional email | Account/session, contact-enquiry and technical-log information required for the relevant service. |
| Google Ireland Limited / Google LLC | Provider infrastructure may process in multiple countries | Optional Google Analytics 4 measurements on the public website | Loaded only after analytics consent; advertising personalisation/signals are disabled; not used for customer evidence. |
| Microsoft and applicable contracting affiliate | Microsoft 365 service locations under the account agreement | Business email and shared legal, privacy, security and support aliases | Business correspondence; sensitive evidence is moved to an approved protected channel. |
Customer production services
The Order Form and DPA identify the approved database, evidence-object, malware-scanning, monitoring, support, messaging and model providers for the customer’s deployment. Personal information is transferred outside South Africa only under a recorded POPIA section 72 basis and contractual safeguards.
Provider changes
Customer terms provide advance notice, a data-protection objection process and an exit remedy for a material new sub-processor. Questions can be sent to privacy@masstrail.co.za.