Sub-processors and Cookies

How providers are chosen

Before a provider processes partner data, YembiPay reviews its security posture, binds it by contract to the stated purpose and to confidentiality, and confirms the location of processing. YembiPay remains responsible to its partners for the providers it uses.

Current providers

• Amazon Web Services. Hosting, database, object storage for certificates, and operational logs. Processes all platform data. Location: United States (us-east-1).
• Cloudflare. DNS, edge security, content delivery, and the browser-facing gateway for the partner dashboard. Processes HTTP request metadata and session cookies in transit. Location: global edge network.
• Sumsub. Identity verification for operators, directors, and beneficial owners. Processes identity documents and verification results. Location: European Union and United States.
• Stripe (Financial Connections). Verification that a registered bank account belongs to the onboarded organization. Processes account holder name and address, account status, and account type. Location: United States.
• Base network node providers. Submission and confirmation of on-chain transfers. Processes wallet addresses, token amounts, and transaction hashes, all of which are public on the network. Location: varies by provider; data is public.
• Stablecoin issuer contracts. Read-only address-list checks against the issuer's own block list before execution. Processes wallet addresses. Location: on-chain.

Providers for local rail payout, transactional email, and error monitoring are added to this list before they process partner data, with the corridor or function they serve. No such provider currently processes partner data.

Changes to this list

Registered organizations are notified by email to their registered operators at least 30 days before a new provider begins processing partner data, except where a change is required immediately to maintain security or availability, in which case notice follows as soon as possible. An organization may object in writing within that period; if the objection cannot be resolved, the organization may end the affected service under the Terms of Service. A data-processing agreement setting out these commitments in contractual form is available on request from privacy@yembipay.com.

Cookies

This site sets two cookies, both essential and both used only by the authenticated partner dashboard.

• Session cookie. Identifies an authenticated organization-bound browser session. Host-only, HttpOnly, same-site strict, short expiry.
• Request-forgery token. Protects dashboard actions against cross-site request forgery. Host-only, HttpOnly, same-site strict, short expiry.

No analytics, advertising, preference, or third-party cookies are set. No pixels, beacons, or third-party scripts load on the public site. Because no tracking occurs, no consent banner is shown and there is no cookie preference to manage. Blocking the two essential cookies prevents dashboard sign-in and has no other effect.