Sub-processors and International Transfers
The suppliers that help us deliver the service, and where data goes.
Version 1.0 · Last updated 11 November 2026
Current sub-processors
The providers actually involved depend on which system you use. We can confirm those that apply to you on request.
| Provider | What it does for us | Where data is processed |
|---|---|---|
| Oracle Cloud Infrastructure | Servers and databases for hosted client systems | South Africa (Johannesburg) |
| Vercel | Web application hosting and file storage | United States and global edge network |
| Neon | Managed PostgreSQL databases for some web applications | United States |
| Zoho | Business email and email delivery (helvino.org mailboxes) | United States |
| Storage of encrypted off-site backups | Global | |
| Cloudinary | Image and media storage for websites | Global |
| Anthropic | AI drafting assistance inside Helvino's internal staff tools | United States |
Changes to this list
We give clients at least 30 days' notice before adding a sub-processor that will handle their personal data. If you have reasonable data protection grounds to object, tell us and we will work with you on a solution.
Processing outside Kenya
Our infrastructure providers operate outside Kenya, so personal data may be processed and stored in the locations listed above. We rely on the safeguards provided by sections 48 and 49 of the Data Protection Act, 2019, including our contracts with these providers and their security measures.
Section 49 requires the consent of the data subject before sensitive personal data, such as health data, is processed outside Kenya. If your system holds sensitive personal data, you as Data Controller need to obtain that consent. Talk to us if you need help with this.