Sub-processors
The third parties that help us run CaseThread, what they do, and where they operate.
Last updated: Draft — pending counsel sign-off
About this list
We use the vetted sub-processors below to provide the service. Each is bound by appropriate data-protection terms, and cross-border processing relies on the POPIA §72 safeguards. We will update this list and give reasonable notice before adding or changing a material sub-processor, so practices can object.
[UPDATE — confirm each sub-processor's current processing region and that a signed DPA / data-protection addendum is in place before relying on this list.]
| Sub-processor | Purpose | Region |
|---|---|---|
| Supabase | Database, authentication and file storage | EU — bound by DPA (POPIA §72) |
| Vercel | Application hosting and scheduled jobs (cron) | EU / global — bound by DPA |
| Resend | Transactional email (confirmations, reminders, invoices, invites) | EU / global — bound by DPA |
| WinSMS | SMS appointment reminders and opt-out handling | South Africa |
| PayFast | Your CaseThread subscription (ZAR). Never used for money between you and your clients. | South Africa |
| Sentry | Error monitoring — technical diagnostics only. No user, IP or session data is attached, and identifiers (email, ID number, phone, tokens) are stripped from error text before it is sent | EU / global — bound by DPA |
| Cloudflare | Bot defence (Turnstile CAPTCHA on the auth/public forms) and off-site backup of uploaded case documents (R2) | Turnstile: global. Document backup: EU jurisdiction, enforced. Bound by DPA |
More: Privacy Policy · Terms of Service · PAIA Manual · Data Processing Agreement · Cookie & Tracking Policy · Billing, Refund & Cancellation Policy · Acceptable Use Policy