Legal
Sub-processors
ITSEC uses the sub-processor categories below to deliver the VerifiX platform. The named provider list for a specific deployment depends on the modules enabled, and is issued with the security documentation pack.
- Effective
- 1 August 2026
- Provider
- ITSEC
- Contact
- sales@verifix.ae
These terms describe how the platform is supplied. Enterprise agreements, order forms, and any negotiated amendments take precedence over this page where they conflict.
| Sub-processor | Purpose | Data processed | Location |
|---|---|---|---|
| Amazon Web Services | Cloud hosting, storage, managed databases, and key management | All platform data for customers hosted on this cloud | UAE regions |
| Microsoft Azure | Cloud hosting, storage, managed databases, and key management | All platform data for customers hosted on this cloud | UAE regions |
| Sanctions, PEP, and adverse-media list providers | Screening queries and ongoing monitoring against list data | Name, date of birth, nationality, and other identifiers needed to match | Varies by provider; disclosed per module in the customer list |
| Company registry and corporate data providers | KYB entity lookups, filings, and ownership structure data | Company identifiers, officer and beneficial owner identifiers | Varies by registry jurisdiction |
| Document and biometric verification providers | Document authenticity checks, data extraction, face comparison, and liveness | Document images, extracted fields, facial images, liveness frames | Disclosed per module in the customer list |
| Blockchain analytics providers | Wallet risk scoring, exposure analysis, and transaction monitoring | Wallet addresses, transaction identifiers, counterparty exposure data | Disclosed per module in the customer list |
| Travel Rule network providers | Counterparty discovery and encrypted originator and beneficiary data exchange | Originator and beneficiary identity data, wallet addresses, transfer references | Network-dependent; disclosed in the customer list |
| Communications and notification providers | Transactional email and messaging for verification links and alerts | Recipient email or phone number and message content | Disclosed in the customer list |
Core hosting, storage, databases, and key management sit in UAE regions. Where a screening, registry, analytics, or Travel Rule query must reach a source outside the UAE, only the data needed for that query is sent.
Each sub-processor is bound by data protection obligations no less protective than the data processing addendum. ITSEC gives notice before adding or replacing a sub-processor that handles customer personal data, and customers may object on reasonable data protection grounds.
For the current named provider list, certificates, and DDQ responses, write to sales@verifix.ae.