1. About this list
Open Institute uses selected third-party service providers to help operate and support Sabasi.
Where a service provider processes personal data on behalf of OI in connection with Sabasi, that provider may act as a subprocessor.
This list identifies the principal subprocessors currently used by Sabasi and the purposes for which they are engaged.
It should be read together with the Sabasi Privacy Policy and Sabasi Data Processing Agreement.
2. Current Sabasi subprocessors
| Subprocessor | Purpose | Personal data that may be processed | Processing location |
|---|---|---|---|
| Amazon Web Services (AWS) | Cloud infrastructure, hosting, database services, storage, backups, transactional and notification email, and AI services where enabled | Customer Data, survey responses, uploaded files and media, account and technical data, email addresses and email content, and data submitted to enabled AI functionality | Primarily European Union for core Platform services. Certain AI processing may occur in the United States where the relevant AI functionality is enabled |
| Cloudflare, Inc. | Platform and network security, content delivery, bot and automated-abuse protection, including Cloudflare Turnstile | IP address, request and device information, security information, and data required to perform challenge and abuse-prevention checks | Cloudflare operates a global network and processing may occur in multiple countries |
| tawk.to | Live-chat and customer-support functionality | Information submitted through support chat, chat history, contact information where provided, and related technical or visitor information | United States |
AWS maintains its own list of subprocessors relevant to the AWS services and regions used by its customers.
Cloudflare maintains a current list of the subprocessors it uses to provide its services and operates processing through its global network.
Tawk.to states that customer chat data is stored at rest in Google Cloud data centres in the United States and that it acts as a processor for customer data.
3. Artificial intelligence processing
Where a Customer uses Sabasi AI functionality, including Ask AI or other enabled AI-assisted features, relevant data may be processed through Amazon Web Services AI services.
AI functionality is subject to the User's Sabasi permissions and the applicable Customer account context.
Further information about the use of AI and personal data is provided in the Sabasi Privacy Policy.
4. Customer-selected integrations
Services that a Customer independently selects or configures are not automatically OI subprocessors.
This may include:
- external APIs;
- webhook destinations;
- customer-selected data systems;
- CRM systems;
- health-information systems;
- imported or connected data sources; and
- other third-party services to which a Customer instructs Sabasi to transmit data.
The Customer is responsible for assessing the legality and suitability of independently selected recipients and integrations.
Where OI itself appoints a provider to operate Sabasi and that provider processes personal data on OI's behalf, that provider will be assessed for inclusion in this list.
5. Changes to subprocessors
OI may add or replace subprocessors as Sabasi develops.
Where OI processes personal data on behalf of a Customer under the Sabasi Data Processing Agreement, OI will provide reasonable advance notice of an intended new or replacement subprocessor as required by the applicable agreement.
A Customer may object to a proposed change on reasonable data-protection grounds in accordance with the Data Processing Agreement.
The effective date and version of this page will be updated when material changes are made.
6. Subprocessors of our subprocessors
The providers listed above may engage their own subprocessors in delivering their services.
OI does not reproduce every downstream provider on this page. Those providers maintain their own subprocessor information and contractual data-protection arrangements.
OI assesses its direct service providers and requires appropriate data-protection safeguards through applicable agreements.
7. Future services
A planned service or integration is not included in this list until it is deployed and processes personal data for Sabasi.
For example, planned error or performance-monitoring services are not treated as current Sabasi subprocessors until they are enabled in production.
8. Contact
Questions about Sabasi subprocessors or international processing may be directed to:
Open Institute
9 Riverside Building
P.O. Box 50474-00100
Nairobi, Kenya
Email: hello@openinstitute.africa