Data Processing Agreement (DPA)

This Agreement is between you (the Controller) and DDM Technology (Pty) Ltd (the Processor), trading as DDM Flow.

How to request a signed DPA

For business customers required to maintain a signed DPA for POPIA, GDPR, or vendor-due-diligence reasons, email dpa@ddmtech.co.za with:

• Your registered company name + VAT number
• The signatory's name, role, and contact email
• Any jurisdiction-specific clauses you require

We turn signed DPAs around within 5 business days.

What our DPA covers

• Categories of personal data processed (invoice, client, payment, bank)
• Purposes of processing (issuing + collecting invoices)
• Sub-processors (Supabase, Vercel, Resend, Paystack, Yoco, Anthropic, Sentry, PostHog)
• Security measures: encryption in transit (HTTPS) and at rest; row-level security on every table; optional two-factor sign-in (TOTP), checked by the server on every request once it is on; and an audit log of changes to invoices, quotes, credit notes, payments, refunds, expenses and bills, clients, suppliers, items, projects and time, journal entries, VAT periods, API keys, business settings and team members, naming who made each change (a person, an API key, a connected app or a scheduled job). Not yet in the audit log: the line items of invoices, quotes, credit notes, expenses and recurring invoices, journal lines, bank transactions and the chart of accounts.
• Data subject rights handling (export, deletion within 30 days of request)
• Breach notification — immediately. Section 21(2) of POPIA requires an operator to notify the responsible party as soon as it has reasonable grounds to believe personal information has been accessed or acquired without authorisation. There is no grace period, and this replaces the "72 hours" this page previously stated.
• International transfers — the database and every processor listed below operate outside South Africa. Transfers are made under the standard contractual safeguards those providers publish.

Sub-processors

We engage the following sub-processors. Each has its own equivalent DPA in place with us:

• Supabase — database, auth, storage (hosted in the EU)
• Vercel — hosting + serverless functions
• Resend — transactional email delivery
• Paystack + Yoco — payment processing
• Anthropic — Claude AI models, reached through the Vercel AI Gateway. Used for the AI assistants, receipt and document reading, expense categorisation, invoice design matching, tone classification of your clients' replies, nightly cash-flow alerts and tax explanations. Anthropic does not train on API data. There is no zero-data-retention agreement in place — an earlier version of this page said there was, which was incorrect: routing through the Gateway does not by itself create one. See section 3 of the Privacy Policy.
• Sentry — error monitoring
• PostHog — product analytics

Need something specific?

Email dpa@ddmtech.co.za or read more on our Trust page.