Subprocessors
Last updated November 9, 2026
ULB Media (Pty) Ltd uses these providers to run OnSanctions. Each is bound by a data processing agreement. We announce changes here and by email to account owners at least 30 days before a new subprocessor starts processing customer data, as the data processing agreement provides.
1. Current subprocessors
| Provider | Purpose | Data | Location | Transfer safeguard |
|---|---|---|---|---|
| VerifyNow (Pty) Ltd | Screening engine: sanctions, PEP and watchlist matching, enrollment for rescreening, encrypted screening responses (48 hours) | Name, entity type, country; our reference and the name as keyed digests. Never the passport number or LEI | Cape Town, South Africa | Data processing agreement; Standard Contractual Clauses for EEA/UK data; POPIA section 72 |
| Cloudflare, Inc. | Website and API hosting, network security, and the D1 database for accounts, key hashes, the subject map and logs | Account data, key hashes, subject fingerprints, call logs; request metadata in transit | Database restricted to the European Union; global network for delivery | Data processing addendum; Standard Contractual Clauses; EU-US Data Privacy Framework |
| Stripe, Inc. and Stripe Payments Europe, Ltd. | Payments, invoices, tax IDs and fraud prevention | Billing contact, email, card details, invoices, tax ID | Ireland, United States and other countries | Data processing agreement; Standard Contractual Clauses; EU-US Data Privacy Framework |
| SiteGround Hosting Ltd. | Email hosting for hello@, privacy@ and security@onsanctions.com | The emails you send us and our replies | European Union | Data processing agreement |
2. Providers of our providers
VerifyNow's own providers are listed in its subprocessor register. Questions: privacy@onsanctions.com.