Data residency

Where Thumela stores and processes personal information, stated plainly.

The statement

Recipient personal information processed by Thumela is stored and processed in South Africa. Transmission to recipients’ mail providers is inherent to delivery. AWS af-south-1 (Cape Town) is the sending sub-processor.

That is the whole claim. It is deliberately scoped: once a message leaves for a recipient’s mail provider, where that provider stores it is outside our control, as it is for anyone who sends email.

What sits where

• Application tier and database run on xneelo in Johannesburg, South Africa.
• Sending goes through Amazon SES in af-south-1 (Cape Town). AWS is our only sub-processor for recipient data.
• No Cloudflare proxy. Traffic to the site and the API is not routed through a third-party edge network; TLS terminates on our own servers in South Africa.
• No S3, no KMS. Encryption keys for recipient data are held by Thumela in South Africa, not in a cloud key service, and nothing is written to object storage.
• Recipient addresses are encrypted at rest in the database; message records are purged after 90 days.

POPIA

For the launch waitlist on this site, Thumela Online (Pty) Ltd is the responsible party under the Protection of Personal Information Act: we decide why and how your email address is processed, and our privacy notice sets that out.

Once customers send through the API, Thumela acts as an operator for the recipient information those customers hand us: we process it only on their instructions and for delivery, and each customer remains the responsible party towards their own recipients. A written operator agreement will accompany the service when it launches.

Questions about any of this go to privacy@thumela.co.za.