Overview
A subprocessor is a third-party service provider that processes personal information on our behalf to help us deliver Lorraine products. Every subprocessor listed here is bound by contract to appropriate confidentiality and security commitments.
We update this page when we onboard or retire a subprocessor. Enterprise customers receive advance notice of material changes under their Data Processing Agreement.
Questions about a specific subprocessor, or the POPIA-aligned safeguards we rely on for cross-border transfers, should be sent to legal@uselorraine.co.za.
Current subprocessors
| Provider | Purpose | Location |
|---|---|---|
| Amazon Web Services (AWS) | Primary cloud infrastructure for the Lor-1 API and application databases. | af-south-1 (Cape Town, South Africa) |
| Cloudflare | Edge network, CDN, DNS, and Workers runtime for the Lorraine website and web applications. | Global (edge) |
| Sanity | Content management for marketing content (blog, policy pages, FAQs). | United States |
| PostHog | Product analytics and feature flags. Consent-gated; no PII in event payloads. | European Union |
| Paystack | Card payment processing and subscription billing for web checkout. | South Africa, and other African markets as we expand |
| RevenueCat | Subscription entitlement management for the iOS and Android apps. Receives a pseudonymous app user ID. | United States |
| Apple | In-app purchase billing and subscription management for iOS. | United States |
| In-app purchase billing and subscription management for Android. | United States | |
| Modal | On-demand GPU compute for Lor-1 model inference and training. | United States |
| Resend | Transactional email (account verification, receipts, support). | United States |
| Better Auth | Authentication infrastructure for the Lorraine services (self-hosted). | South Africa (self-hosted on AWS) |
Cross-border transfers
Where a subprocessor is located outside South Africa, we rely on the transfer safeguards provided by section 72 of POPIA — binding contractual commitments and, where applicable, equivalent data protection regimes. We do not rely on a single entity or jurisdiction to process clinical or account data.