Sub-processors
Five vendors process client data for QX products. Customer records are stored in Singapore. ID images are checked in the EU. Customer names for EDD Intel, web traffic and BCP map views go to US companies.
The client institution is the data controller, Qirin X is the processor, and the vendors below are sub-processors. Where data is stored is set out per installation in the security page. List as of 5 October 2026.
Vendors
Section titled “Vendors”| Vendor | Data it receives | Purpose | Where stored or processed | Vendor’s certifications | Data processing terms |
|---|---|---|---|---|---|
| Supabase | All customer records: application forms, uploaded documents, risk scores, screening results, audit logs; staff sign-in accounts | Database, file storage, sign-in and server functions for 1 Core System, Risk Core and Trading Core | AWS ap-southeast-1, Singapore | SOC 2 Type 2; ISO 27001; HIPAA | DPA v1, 1 Aug 2026: Standard Contractual Clauses; data stored and mainly processed in the chosen region; 30 days’ notice of new sub-processors |
| Didit (Didit Identity, Inc., US) | ID card or passport images, selfie and liveness frames, data read from the ID | ID document check, face match and liveness in KYC Core | AWS eu-west-1, Ireland; Google Maps for proof-of-address geocoding only (data residency) | SOC 2 Type 2; ISO/IEC 27001:2022; iBeta Level 1 PAD | DPA, 23 Sep 2026: Standard Contractual Clauses or adequacy decision; retention set by the institution, 1 month to 10 years; 30 days’ notice of new sub-processors |
| Anthropic (Anthropic, PBC, US) | Customer name in Thai and English only. Addresses and other fields stay in the database, where matching runs | Public web search for adverse media in EDD Intel | US company; region not published on the vendor’s pages | SOC 2 Type I and II; ISO 27001:2022; ISO/IEC 42001:2023 | DPA, 24 Feb 2025, part of the Commercial Terms: Standard Contractual Clauses; deletion within 30 days of termination |
| Netlify (Netlify, Inc., US) | Web traffic only: visitor IP address and pages requested. No customer records: the screens are static and data goes from the browser straight to the database | Hosting the web screens and websites | US company, global edge network | SOC 2 Type 2; ISO 27001; ISO 27018 | DPA, 9 Jun 2026: EU-US Data Privacy Framework, Standard Contractual Clauses as fallback; sub-processors |
| Google Maps Platform (Google LLC, US) | Staff device IP address and the map area viewed. No names, check-ins or notes | Base map on BCP Core staff pages; OpenStreetMap above the daily cap | Google data centres worldwide | ISO/IEC 27001; ISO/IEC 27017; SOC 2 and SOC 3 | Google Maps Platform Terms |