Sub-processors

Last updated: 14 June 2026

The third parties below process Customer Personal Data on behalf of SCM·Edge Suite under written sub-processor agreements that mirror the protections set out in our Data Processing Addendum. Customers are notified of additions or replacements via this page and the legal changelog at least 30 days before they take effect, unless an immediate security or continuity change requires otherwise.

Core sub-processors

Required to deliver the platform.

Sub-processorPurposeData categoriesRegion
Lovable Cloud (Supabase)Primary application database, auth, file storageAll tenant data, auth identifiers, uploadsEU (Frankfurt) or US (configurable per workspace)
Lovable AI Gateway (Google Gemini)LLM inference for AI proposals, customs HS classification, dunning drafts, copilotPrompts derived from tenant data (no training retention)US / multi-region
Cloudflare WorkersEdge compute for the web app & public APIRequest metadata, in-flight payloadsGlobal edge

Optional sub-processors

Engaged only when a Customer enables the corresponding feature (e.g. WhatsApp messaging, factoring disbursement, paid billing).

Sub-processorPurposeData categoriesRegion
ResendTransactional + campaign email deliveryRecipient email, message bodyUS/EU
Meta WhatsApp Business PlatformWhatsApp messaging (inbound + outbound)Phone numbers, message contentGlobal (Meta infrastructure)
Telegram Bot APITelegram channel messagingTelegram user IDs, message contentGlobal
Africa's TalkingSMS + USSD bridge for low-bandwidth marketsPhone numbers, message contentAfrica
PaystackPSP for NGN, GHS, ZAR, KES payments + factoring disbursementPayer name, amount, bank account (for disbursement)Africa
FlutterwavePSP for cross-border Africa paymentsPayer name, amount, payment instrument metadataAfrica
Safaricom M-PesaMobile-money PSP (Kenya)MSISDN, amount, transaction referenceKenya
PaddleMerchant-of-record for USD/EUR/GBP subscription billingBilling name, email, address, payment instrumentEU/US
SentryServer error telemetry (when SENTRY_DSN configured)Stack traces, request metadata, optional user idEU or US (per workspace setting)

Object to a new sub-processor

Email privacy@scmedge.example within 30 days of a change being posted here. We will work with you in good faith to resolve the objection or, where the change cannot be avoided, allow you to terminate the affected service without penalty for the remainder of the term.