Service providers and sub-processors
Last updated: October 26, 2026
Hatton Technologies uses cloud infrastructure and specialist services to operate Softra. This notice describes the services involved and the personal data they process.
1. Infrastructure and delivery
Cloud hosting and edge delivery process requests, network metadata and data in transit. Managed data, authentication and file storage handle workspace records, account credentials and uploaded documents. Transactional email services process recipients and message content for account, HR and service communications. Monitoring services process minimized diagnostic records. AI assistance services process the authorized context needed for a requested task.
2. Service functions
| Service | Function | Data processed |
|---|---|---|
| Amazon Web Services | Independent encrypted backup and recovery | Workspace record and file copies; backup manifests |
| Paystack | Subscription payments and transaction verification | Billing identity, payment references and payment-provider metadata |
| Optional identity sign-in | Account identifier, email, name and profile image |
Independent backup copies are stored in the United States using the us-east-2 service region. For processing particulars relevant to your organization, contact privacy@softraglobal.com.
3. Customer-enabled integrations
Integrations enabled by the customer receive the authorized record subset. This includes salary journals exported to SiQox. An integration provider may act under its own agreement with the customer rather than as Softra’s sub-processor. Disconnecting an integration does not erase records its recipient must retain.
4. International processing and retention
Service delivery and recovery may involve processing outside your country, including cloud processing and off-site backup storage in the United States. International transfers are subject to applicable data protection law and the safeguards required for the relevant processing.
Customers are responsible for record-keeping and location requirements that apply to their operations. International hosting does not automatically meet local record-location requirements. Authorized exports assist customer record keeping but do not replace the customer’s legal obligations.
Recovery copies are access-controlled and may remain subject to provider lifecycle periods and retention locks after deletion from the active service. No fixed backup-erasure deadline is promised. Restoration must account for applicable deletion instructions and lawful holds before recovered records are returned to use.
5. Changes and objections
Customers may request sub-processor change notices through privacy@softraglobal.com. Softra aims to give at least 30 days’ notice before a new sub-processor begins processing Customer Personal Data. An objection should identify the relevant service and reasonable data-protection grounds so the parties can consider an alternative or the affected service’s termination under their agreement.
6. Related documents
Data Processing Addendum, Privacy Notice, Security Overview.