What a sub-processor is
A sub-processor is a third-party provider Sigmix engages to process data on its behalf in order to deliver the service — for example the cloud that hosts the platform, the network that delivers email, or an AI provider that runs a model you invoke. Each sub-processor is bound by a written agreement with data-protection obligations consistent with our Data Processing Addendum and the Saudi Personal Data Protection Law (PDPL).
The current list
Providers marked KSA-resident process inside the Kingdom of Saudi Arabia. Providers marked Off-Kingdom process outside it — several of these are engaged only when a customer opts into the feature that uses them (noted in the Purpose column).
| Provider | Region | Purpose | Category |
|---|---|---|---|
| Oracle Cloud Infrastructure (OCI) | me-riyadh-1 · Riyadh, Saudi Arabia | Platform hosting, managed PostgreSQL database, object storage, and KSA-sovereign AI inference (Cohere models served in-Kingdom on OCI). | KSA-resident |
| Groq | Dammam, Saudi Arabia | KSA-sovereign AI inference — open-model family served from the Dammam region, with residency enforced fail-closed. | KSA-resident |
| In-Kingdom GPU compute — Oracle · Google Cloud (Dammam) · SCCC · Huawei | Riyadh / Dammam, Saudi Arabia | KSA-sovereign AI inference on dedicated GPU servers hosted in-Kingdom across these data centres — customer prompts and outputs stay within Saudi Arabia. | KSA-resident |
| Paymob | Saudi Arabia | Card payment processing. Card data is tokenized by the gateway and never stored on Sigmix servers. | KSA-resident |
| Qoyod | Saudi Arabia | ZATCA Phase-2 (Fatoora) e-invoicing and bookkeeping — issues the compliant electronic invoice for every purchase. | KSA-resident |
| Taqnyat | Saudi Arabia | SMS delivery — one-time passcodes (OTP) and service SMS to KSA mobile numbers. | KSA-resident |
| Amazon Web Services (SES) | eu-central-1 · Frankfurt, EU | Transactional and marketing email delivery (recipient address and message content transit the sending region). | Off-Kingdom |
| Microsoft Azure (OpenAI Service) | Global | Global AI models (GPT family) — engaged only when a request opts into global models instead of the KSA-sovereign default. | Off-Kingdom |
| Amazon Web Services (Bedrock) | Global | Global AI models (Claude, Grok) — engaged only when a request opts into global models. | Off-Kingdom |
| Google (Gemini) | Global | Global AI models and image generation — engaged only when a request opts into global models. | Off-Kingdom |
| Cloudflare | Global | Realtime video infrastructure for the GLOBAL meetings module only. The KSA-private meetings module does not use it. | Off-Kingdom |
| Meta Platforms (WhatsApp Business) | Global | WhatsApp messaging channel in the Chat module — only when a customer connects and enables WhatsApp. | Off-Kingdom |
| RapidAPI | Global | Retrieval of public (OSINT) competitor-intelligence data for the Competitor Intel module. | Off-Kingdom |
Off-Kingdom transfers
Where a sub-processor above processes personal data outside Saudi Arabia, the transfer is made in accordance with the PDPL's data-transfer provisions and rides SDAIA-approved safeguards (including contractual data-protection commitments with each provider). The KSA-sovereign AI tiers, the private meetings module, and web-chat-only tenants are engineered so their workload data does not leave the Kingdom.
Updates to this list
- Versioned on this page. Any addition, removal or material change to a sub-processor is published here with a new version number and date — this page is the authoritative record.
- DPA customers. Customers with a signed Data Processing Addendum may object to a new sub-processor as set out in the DPA.
Contact
Data protection: dpo@sigmix.sa · legal: legal@sigmix.sa · privacy requests: sigmix.ai/privacy-request.