Sub-processors
Version 1.4Effective 11 September 2026Subject to periodic review
Nia Impact, trading as Nia Impact Invest ("Nia", "we"), operates Nia Within. To run the platform we rely on a small number of third-party service providers that process personal data on our behalf — our "sub-processors". Each one processes data only on our documented instructions and is bound by data-processing terms — a written agreement where the provider offers one; the status of each agreement is shown in the last column — and may only process data on our documented instructions, and is required to keep it confidential and secure. This page lists who they are, what they do for us, what data reaches them and where it is processed. It is the list referred to in our Privacy Policy and Data Processing Agreement.
We keep the list as short as we can. Information you upload — fund and portfolio-company reporting documents, KPI values, report narratives — reaches only the providers marked with a ● in the "Content" column. Everyone else sees account, contact or technical data only.
Current sub-processors
| Provider | What it does for us | Data it receives | Content? | Location / region | Safeguard |
|---|---|---|---|---|---|
| Vercel Inc. (USA) | Hosts the web application and runs its scheduled jobs | All web traffic: account and session data, uploads in transit, request logs | ● | Application runs in London (lhr1); Vercel's other services in the USA | Vercel DPA with EU Standard Contractual Clauses and UK Addendum; EU–US Data Privacy Framework |
| Neon, LLC (a Databricks company, USA) entity name to be confirmed | Hosts the platform database | Everything stored in the platform: user accounts, organisation records, submissions, reports, advisor conversations, audit logs | ● | AWS Europe (London) | Databricks DPA (SCCs) incorporated in the service terms; EU–US Data Privacy Framework (Neon, LLC) |
| Cloudflare, Inc. (USA) | Stores uploaded and generated files (object storage) and their backup copies | Uploaded documents, templates, generated reports, policy documents, profile pictures | ● | European Union jurisdiction | Cloudflare Customer DPA (SCCs Modules 2/3, UK Addendum); Data Privacy Framework |
| OpenRouter, Inc. (USA) | Gateway that routes the platform's AI requests to a model host | Prompts sent to the AI advisor and report tools, including excerpts of your documents; embedding inputs | ● | USA (gateway); OpenRouter does not store prompts — prompt logging is off by default and we do not switch it on | OpenRouter Data Processing Agreement (26 August 2026; SCCs Module 2, UK Addendum), incorporated in its Terms; routing restricted by us to zero-data-retention hosts that do not train on data |
| Amazon Web Services, Inc. — Amazon Bedrock (via OpenRouter) | Runs the AI models | Same as OpenRouter | ● | USA, EU (Ireland) or the host's global cross-region endpoint, chosen per request | Zero data retention: no prompt or response written to storage or shared with the model provider (AWS Bedrock policy) |
| Anthropic, PBC (via OpenRouter) | A permitted host for the Claude AI models under our routing rules. Today it receives no requests: the Claude models we use run on Amazon Bedrock and Google Vertex AI, because no zero-retention endpoint on Anthropic's own service is listed for them | Same as OpenRouter (none today) | ● | USA | Would only ever be used on zero-data-retention terms; Anthropic does not train on API data |
| Google LLC — Vertex AI (via OpenRouter) | Runs the AI models | Same as OpenRouter | ● | USA, EU or the host's global cross-region endpoint, chosen per request | Zero-data-retention endpoints only; Google does not use customer data to train models |
| Microsoft Corporation — Azure AI Foundry (via OpenRouter) | Runs AI models and creates every text embedding: it is the only host with a zero-data-retention endpoint for the embedding model | Same as OpenRouter | ● | EU (Sweden) or global endpoints, chosen per request | Zero-data-retention endpoint for embeddings; prompts not available to the model developer, not used for training (Microsoft data-privacy commitments) |
| OpenAI, L.L.C. (via OpenRouter) | A permitted host for AI models under our routing rules. Today it receives no requests: no zero-data-retention endpoint on OpenAI's own service is listed for the models we use, the embedding model included | Same as OpenRouter (none today) | ● | USA | Would only ever be used on zero-data-retention terms; no training on API data |
| LlamaIndex, Inc. (LlamaCloud / LlamaParse, USA) | Converts uploaded documents into text and tables: PDF, image and scanned files, Word files with no readable text, and any PDF or Word data submission in which the Platform's own reader finds no reportable figures, are sent to the external parsing service; spreadsheets, CSV, Policy Hub documents and Advisor attachments are always read on the platform | The uploaded document itself | ● | EU (Frankfurt) endpoint | DPA (SCCs); documents used only to return results, never for training; caching disabled by us; deleted within 48 hours |
| Resend (Plus Five Five, Inc., USA) | Sends invitation, sign-in, password and notification emails | Recipient name and email address, email content | — | USA | DPA (SCCs, UK Addendum); EU–US Data Privacy Framework; logs kept 30 days |
| Functional Software, Inc. (Sentry) (USA) | Error monitoring | Error reports containing a user identifier, organisation identifier and technical details of the failed request | — | EU (Frankfurt) for event data; account metadata in the USA | DPA; EU–US Data Privacy Framework; SCCs as fallback; server-side data scrubbing |
| Gupshup Inc. (USA) | Delivers WhatsApp messages to and from the platform's advisor | Phone number, message text, links to files sent over WhatsApp | ● | USA, Europe and Asia | Provider's standard data-processing terms, accepted 4 September 2026 |
| Meta Platforms — WhatsApp LLC (USA) | The WhatsApp messaging network | Phone number and message content in transit | ● | USA | WhatsApp Business Data Processing Terms and Global Data Transfer Addendum, where those terms make WhatsApp a processor |
| GitHub, Inc. (a Microsoft company, USA) | Runs the off-site backup job for the database (used since 1 September 2026; not running on a schedule at present) | A complete compressed copy of the production database, present on the runner only for the duration of the job (protected by TLS in transit and encrypted at rest in the backup bucket; not separately encrypted on the runner) | ● | USA (Microsoft Azure) | GitHub Data Protection Agreement (SCCs, UK Addendum); EU–US Data Privacy Framework |
Google sign-in is not offered on the platform (no sign-in button is shown), so Google is not on this list.
Changes to this list
We will give you at least 30 days' notice by email to your organisation's administrators before we add or replace a sub-processor. You may object on reasonable data-protection grounds within that period; if we cannot address the objection we will work with you on a way to withdraw the affected service. For the AI model hosts, the commitment is our fixed host list — a change to the platform's own routing rules, which we control — not the gateway's notice: OpenRouter's agreement excludes AI model providers from its own 30-day sub-processor notice. Data-protection questions: sarah@niaimpactinvest.com.
Last updated: 6 September 2026.
Who we are and how to reach us
Nia Impact (trading as Nia Impact Invest) · company number 221851
Lot 02, Floor 1, CentrePoint, Trianon, Mauritius
Legal and privacy: sarah@niaimpactinvest.comSupport: hello@niaimpactinvest.com
Version history
- v1.4Across the legal set — Version 1.4, effective 11 September 2026: the company you contract with changes. The contracting company is now Nia Impact, company number 221851, registered at Lot 02, Floor 1, CentrePoint, Trianon, Mauritius, still trading as Nia Impact Invest; the Terms, the Privacy Policy and the sub-processor list carry its details in place of the previous South African company's; that company's tax-registration number is removed from clause 1.1 and from the signature block, and the sentence in the fees clause that stated fees exclusive of that tax is removed, with nothing put in its place. The clauses that rest on South African law — governing law, jurisdiction and notice timing, the intellectual-property indemnity, the fee currency and interest rate, the electronic-acceptance and consumer-protection provisions, and the data-protection framing of the Privacy Policy — are unchanged in wording and now carry a visible note that they are under review by our legal counsel following the move; counsel's pass on that text is a separate step. Because the company you contract with is not the one named in version 1.3, the acceptance-registry identifiers change to terms-2026-09-11-draft, privacy-2026-09-11-draft and ai-notice-2026-09-11-draft, and everyone is asked to accept the re-issued documents once on their next sign-in. The product name is unchanged from 1.3; all seven documents are re-issued as 1.4 so the set shares one version.
- v1.3Across the legal set — Version 1.3, effective 9 September 2026: the product is renamed. The application these documents govern is now called Nia Within, and every document is re-issued with the new name; the wording is otherwise unchanged, and the company you contract with at this version is still the South African company named in the documents. Because the Terms, the Privacy Policy and the AI-processing notice are re-issued under a new name, their acceptance-registry identifiers change to terms-2026-09-09-draft, privacy-2026-09-09-draft and ai-notice-2026-09-09-draft, and everyone is asked to accept the renamed documents once on their next sign-in. The Terms, the Privacy Policy, the Cookie Notice and the sub-processor list carry the new name; the AI-processing page and the German summaries carry no text change; all are re-issued as 1.3 so the set shares one version.
- v1.2Across the legal set — Version 1.2, effective 7 September 2026: a factual correction to what version 1.1 said about embeddings. Embeddings — the numerical representations of your text used for search — are now sent only to an endpoint that keeps no copy of the input and does not train on it; today that is Microsoft Azure, the only such endpoint offered for the embedding model we use. Version 1.1 said that no zero-retention endpoint existed for embeddings and that they were sent to Microsoft Azure or OpenAI. Both statements are corrected: Privacy Policy section 6(a) and the section 7 table, the AI-processing page and the sub-processor list now say that embeddings go only to the zero-data-retention endpoint at Microsoft Azure, and that OpenAI remains a permitted host under our routing rules but receives no requests today. This tightens how your text is handled; nothing is taken away and nothing new is asked of you, so no one is asked to accept again. The Cookie Notice, the Terms and the German summaries carry no text change and are re-issued as 1.2 so the set shares one version. Privacy Policy and Terms of service — Version 1.2, effective 7 September 2026: two statements in section 10 of the Privacy Policy are replaced because the Platform now does what they said it could not yet do. Deleting your account no longer deletes the audit-trail entries recorded in your name: each entry keeps what was done and when, and your name is replaced by a label that does not identify you, such as "deleted admin #a1b2c3d4" — never your name and never your e-mail address. Administrator accounts can now be deleted the same way as any other account; a setting an administrator changed for an organisation keeps its value, with the setter's name removed. The sentences saying the trail was deleted with the account, and that some administrator accounts could not yet be deleted, are removed because they are no longer true. Nothing is taken away, nothing new is asked of you, and you are not asked to accept again. Clause B8 of the Terms of service (closing your account) is corrected to match: it no longer says that audit entries recorded in your name are deleted when you delete your account yourself, or that you should ask your administrator to remove you instead — whichever way your account is closed, the entries are kept under the same non-identifying label. The other five documents carry no text change and are re-issued as 1.2 so the set shares one version.
- v1.1Across the legal set — Version 1.1, effective 6 September 2026: a wording and link tidy-up of version 1.0. Nothing is taken away and nothing new is asked of you; the only change to what the Terms require is one new commitment by Nia, in clause 21.1, which section 21.3 makes effective on publication, so no one is asked to accept again. Privacy Policy section 7: the GitHub row now says the database backup job is not running on a schedule at present, as sections 9 and 10 already said; the opening sentence of section 7 is reworded by one word. Privacy Policy sections 9 and 10: the database-backup sentences now say the off-site copies were taken from 1 to 3 September 2026 and the job is not running on a schedule; the promise itself is unchanged. Sub-processor list: Resend's legal entity is written as Plus Five Five, Inc. Terms 21.1: Nia still provides a copy of any earlier version on request, and now commits to 10 business days where the request is made in writing — the same turnaround as an export under 7.8. All documents: the legal hub and the versions page are linked from the site footer. The Cookie Notice, the AI-processing page and the German summaries carry no text change and are re-issued as 1.1 so the set shares one version.
- v1.0Version 1.0, effective 4 September 2026: the first published version, adopted by Nia Impact Invest. It supersedes the draft of 2 September 2026. Later revisions will be listed here with a summary of what changed.