Draft — not legally reviewed
This is a working draft prepared for review. It has not been checked by a legal practitioner and must not be relied on as it stands. It is published so it can be reviewed, not because it is finished.
Subprocessors
Last updated 15 September 2026
Who processes data on our behalf
These are the services BAG depends on. We add to this list only when it is necessary to run the service.
Your data is processed in Germany, not South Africa
Both the application and the database run in Frankfurt. The two are deliberately in the same place: when the application ran in Cape Town and the database in Frankfurt, every page took roughly 150 ms per database round trip and around nineteen of them, which made the till slow enough to matter at a counter.
That means business and trading data is transferred outside South Africa. POPIA permits this where the recipient country has comparable protection, and Germany is subject to the GDPR. We state it plainly here rather than leaving it to be inferred, because it is a decision a business is entitled to know about before it signs up.
Only static assets — the logo, fonts, stylesheets and scripts — are cached at edge locations worldwide. No business or customer data is cached at the edge.
| Provider | Purpose | Location | Data involved |
|---|---|---|---|
| Vercel | Application hosting and content delivery | Frankfurt, Germany (fra1), with global edge caching of static assets only | Requests, logs, session cookies |
| Neon | Managed PostgreSQL database | Frankfurt, Germany (eu-central-1) | All business and trading data |
| Peach Payments | Subscription card collection, and in-store card acceptance where used | South Africa | Billing contact, card token. Card numbers are entered on Peach's own page and never reach us |
| Optional sign-in | Global | Name, email address, account identifier. No mailbox access is requested |
Not yet engaged
No email delivery provider is engaged yet, so invitation links are shown on screen rather than sent. No SMS provider and no analytics provider is engaged.
Still to be settled before this is finished
Signed data-processing agreements with each provider; confirmed hosting regions and the cross-border transfer basis for each; and how customers are notified before a new subprocessor is added.