Sub-processors
Message delivery, payment collection and hosting are not all done by us. This document names the companies involved rather than describing them as trusted partners, because the phrase tells a reviewer nothing.
1What a sub-processor is
A company we engage to process data on our behalf, under contract, for one named purpose.
The arrangement
Each sub-processor acts on our instructions, is bound by confidentiality and security obligations at least as strict as ours, and may use the data only for the purpose listed below. None of them may use it for their own ends.
What is not on this list
Companies that provide us with something not involving customer data — office software, accounting, the coffee — are not sub-processors and are not listed.
2The current list
Confirmed for your own workspace in writing on request, including which provider is active for message delivery in your region.
| Provider | What it does | What it can see | Where |
|---|---|---|---|
| Chapa | Collecting plan payments by card, telebirr and bank transfer | Billing contact, amount, payment reference. No documents. | Ethiopia |
| Infobip / Twilio / GeezSMS | Delivering signing links and one-time passcodes by SMS | Signer phone number and the message text. No documents. | Routed to Ethio Telecom and Safaricom; provider infrastructure is international |
| Mailgun / SendGrid | Delivering invitations, passcodes, reminders and completed copies by email | Signer name, email address, message text, and any copy attached to it | International |
| Expo (Expo Application Services) | Delivering notifications to the eFirma app on a phone | The installation's notification token, the title of the document and the name in the message. No documents, and never a signing link. | International |
| Apple / Google | Carrying that notification the last step onto an iPhone or an Android phone | The same token and the same message text. No documents. | Global |
| Object storage (S3-compatible) | Storing documents, sealed copies and evidence at rest, encrypted | Encrypted document and evidence files | In region |
| Cloudflare | Protecting and delivering efirma.et and the API | Connection metadata: IP address, request path, user agent | Global edge network |
3How we choose and watch them
Fewer of them is better. Each one is a place your data can go wrong.
- We use a sub-processor only where the alternative is not building the capability at all.
- Each is assessed on security and on where it stores data before it goes anywhere near production.
- Access is limited to the data the named purpose needs — a delivery provider never receives a document.
- Identity checks are the exception to the whole list: card images, portraits, face frames and voiceprints are processed by eFirma alone, and go to no provider named here.
- The arrangement is reviewed annually, and immediately after any incident involving that provider.
4Changes to this list
Notice before, not a discovery afterwards.
Notice
We give workspace administrators at least 30 days' notice by email before adding a sub-processor that will handle customer data, except where we are replacing one urgently for security reasons — in which case we tell you as soon as the change is made.
Objecting
If a new sub-processor is unacceptable to your organisation, write to [email protected] within the notice period. We will look for an alternative arrangement, and where there is none you may end the agreement for that reason without penalty.
Questions about this document, a signed copy on letterhead, or an Amharic version: [email protected]. Published in English; where an Amharic copy differs, the English version governs.