Data Processing Agreement

Roles

Where you upload or generate personal information inside your Komply workspace, you act as the responsible party under POPIA and Auto Alpha Advisory (Pty) Ltd (registration number 2025/213512/07), trading as Komply, acts as your operator. This page sets out the terms on which we handle that information. It forms part of our Terms of service and you accept it when you accept them.

Our undertakings as your operator

• We process personal information in your workspace only with your knowledge or authorisation: to provide Komply as you configure it, and on your other written instructions.
• We treat that information as confidential and do not disclose it, unless the law requires us to or it is needed for the proper performance of our duties, including to the sub-processors below.
• We maintain the security measures described under Security, and we bind each sub-processor except ImprovMX to protect the information to a standard no lower than this agreement. ImprovMX only forwards email sent to hello@ and io@getkomply.co.za, and handles it under its own published terms.

Sub-processors

• Supabase — application database, authentication, and file storage. EU region (Ireland).
• Vercel — application hosting and serverless runtime. Serverless functions run in the EU (Frankfurt, Germany).
• Resend — transactional email delivery (sign-in links, monthly digest). United States.
• ImprovMX: forwards email sent to hello@ and io@getkomply.co.za (enquiries, data requests and service alerts) to our mailbox. It may process it outside South Africa, including in the United States and Europe.
• Google Workspace: hosts that mailbox. Google may process it in any country where Google or its subprocessors have facilities.
• PayFast — subscription billing.
• Auto Alpha Advisory Audit Engine — the upstream scanner that produces the compliance findings Komply mirrors into your dashboard. Hosted by AAA in Amsterdam.
• Anthropic — large-language-model processing for two purposes: (1) tailoring a conflict-of-interest policy to the FSP. A guard rejects any rewrite that changes a template sentence or adds a law, and key individuals' and representatives' names are cut to initials before transmission (the FSP's registered name is sent as it is); and (2) B-BBEE own-certificate field extraction — a certificate the tenant uploads, or a filed document that Komply's own check, run on Komply's servers before anything is sent, recognises as the tenant's B-BBEE certificate or sworn affidavit, or that the tenant says is one, is sent unredacted because the document content is required for extraction; this is the tenant's own data, processed on their behalf. Hosted in the United States; we use the zero-data-retention tier so prompts are not retained for model training.
• CIPC APIVerse (CIPC / the dtic, South Africa) — company-registry lookup at onboarding (registration number → public company details and director roster). Data is processed within South Africa. Director ID numbers and dates of birth are stripped at our boundary and never stored. Not in use yet: the lookup is not switched on, so no data is sent to CIPC today.
• Umami Analytics — cookieless, privacy-first web analytics, self-hosted by Auto Alpha Advisory. Runs on our public marketing pages only (never in the signed-in dashboard) to measure aggregate page views and page performance. It sets no cookies and builds no cross-site profile.

We notify you in-app and by email at least 14 days before adding or replacing a sub-processor.

Cross-border transfers

Your data crosses South African borders to reach Supabase (Ireland), Vercel (Frankfurt, Germany), and Auto Alpha Advisory (Netherlands), all subject to the EU General Data Protection Regulation which provides protection comparable to POPIA (POPIA s72(1)(a)). Anthropic and Resend process data in the United States under binding agreements (POPIA s72(1)(a)); for Anthropic, policy wording is sent with key individuals' and representatives' names cut to initials and B-BBEE own-certificate extraction is the document content you uploaded on your own behalf, while Resend handles only the recipient address and message content needed to deliver transactional email. Once Komply's CIPC lookup is switched on, CIPC APIVerse will process company-registry data within South Africa. Email sent to hello@ and io@getkomply.co.za passes through ImprovMX (including in the United States and Europe) to our Google Workspace mailbox (in any country where Google or its subprocessors have facilities). Our contracts with each sub-processor except ImprovMX bind them to handle your data in accordance with POPIA; ImprovMX handles the email it forwards under its own published terms.

Security

Tenant isolation is enforced at the application layer: every database query is scoped to your workspace by your authenticated session. Row-Level Security policies provide defense in depth on the database side. Encryption in transit (TLS 1.2+) and at rest (AES-256). OAuth refresh tokens (Xero) are additionally encrypted at the application layer with AES-256-GCM. Access to production data is limited to named operators.

Breach notification

If there are reasonable grounds to believe that personal information in your workspace has been accessed or acquired by an unauthorised person, we notify you immediately, and in any event within 24 hours of becoming aware, with the facts known at that point. We send updates as the investigation continues, so that you can meet your own duty to notify the Information Regulator and the people affected.

Liability under this agreement

Our liability under this agreement sits inside the limits in the Terms of service (“Limits on our liability”), including the cap. Each of us bears its own costs of responding to a breach; a claim by you for costs caused by our breach of this agreement is subject to those limits.

On termination

When you close your workspace, its records are retained for 12 months (so you can recover if you change your mind), then permanently deleted. Files you uploaded, such as B-BBEE certificates and employer-record receipts, are deleted on request: automatic deletion of stored files is not yet switched on. Documents waiting in the filing tray are the exception: they are deleted 90 days after upload unless Komply has filed them. You can request earlier deletion of anything at any time via hello@getkomply.co.za.

A signed counterpart

Enterprise customers can request a counter-signed PDF version of this DPA on letterhead. Email hello@getkomply.co.za and we'll send one within two business days.