Sub-processors

Klari engages a small number of third-party providers to operate the Service. This document identifies each provider, its service, the region in which it is intended to process data, and the personal data it may receive. It supports customer diligence and does not replace the completed supplier and transfer schedule in a signed Data Processing Agreement.

How we use this list

Before a customer signs, Klari will provide the current version of this list and the supplier information needed for the customer’s review. If Klari proposes to add a sub-processor, it will assess the change, update this list and give notice where applicable law or the customer contract requires it. Where an addition materially changes the data location or category of access, Klari will give at least 14 days' notice and allow a written objection.

Transparency

Klari publishes the supplier names because customers need a usable starting point for vendor diligence. The list is versioned, and a signed customer DPA will identify the suppliers and transfer terms that apply to that engagement.

Active sub-processors

Provider	Service	Intended processing location	Personal data it may receive
Supabase	Database, object storage and authentication	Frankfurt, Germany (eu-central-1)	Tenant Data, user identifiers, authentication and account information, and requests submitted through the marketing site's access form
Vercel	Application hosting	Frankfurt, Germany (fra1)	Transient request and session information; no intended persistent Tenant Data
Resend	Transactional email delivery	Ireland (eu-west-1)	Recipient email addresses and message content, including sign-in and invitation links
Sentry	Error monitoring	Frankfurt, Germany (EU ingest)	Error reports, stack traces and minimised diagnostic metadata
Upstash	Rate-limit cache	Ireland (eu-west-1)	User account identifiers and IP addresses, stored unhashed as rate-limit keys that expire within one hour; no compliance records
Cloudflare	Authoritative DNS for klari.ng	Global edge network	DNS lookup information only; no Tenant Data and no email content
Google Cloud EMEA Limited (Google Workspace)	Email for Klari addresses, including support requests	No fixed location — the Business Starter plan offers no data-region setting	Content of emails sent to Klari addresses, which may include Customer Data a Customer chooses to include

The locations above describe the intended service region; they do not by themselves resolve the legal basis for a transfer from Nigeria or the possibility of access under a provider's applicable law. The customer-specific transfer mechanism and any required approval must be completed in the signed Data Processing Agreement.

What we do not use

• No advertising or ad-tech provider processes Tenant Data.
• No third-party analytics or session-replay provider is used for the Service.
• No customer-support platform has routine access to Tenant Data.

Supplier controls

Klari will conduct supplier diligence proportionate to the processing, use written data-processing terms where required, limit access to what is necessary for the service, and maintain a current record of the supplier’s role, location, data categories and relevant security information. Klari remains responsible for managing its sub-processors as required by applicable law and the customer contract.

Klari group structure

Klari Technologies Limited (Nigeria, RC 9542173) is the customer-facing entity and Data Processor of record. No affiliated entity has routine access to Tenant Data.

Contact

Sub-processor and security enquiries: security@klari.ng Privacy enquiries: privacy@klari.ng