Legal

Sub-Processor Register

Last updated: 9 April 2026

This Sub-Processor Register identifies all third-party service providers ("Sub-Processors") engaged by Manaia Tech ("Manaia", "we", "us") to process personal data on behalf of our customers ("Controllers") in connection with the Manaia home cybersecurity platform.

Legal Basis: This register is maintained in accordance with GDPR Article 28(2)(d), GDPR Article 28(3)(a), and the Australian Privacy Act 1988 (APP 8).

Notification of Changes: Customers will be notified of any additions or changes to this register via email to the registered account email address.

Objection Period: Customers have 30 days from notification to object to a new Sub-Processor on reasonable data protection grounds (see Data Processing Agreement, Section 5.4).

Primary Infrastructure

Amazon Web Services, Inc. (AWS)

Location: United States (headquarters); services primarily in Australia (ap-southeast-2, Sydney region)

Processing Activities: Cloud infrastructure hosting, data storage, compute, email delivery, encryption key management

Personal Data Categories: All categories processed by the Service (see DPA Section 4.1)

Data Transfer Mechanism: AWS Standard Contractual Clauses (SCCs); AWS Data Processing Addendum

Certifications: ISO 27001, SOC 2 Type II, PCI DSS Level 1

Details:

Amazon RDS (PostgreSQL) — Primary database for user accounts, profiles, devices, subscriptions
Amazon DynamoDB — IOC (Indicator of Compromise) storage for threat intelligence
Amazon ElastiCache (Redis) — Bloom filters for threat detection, API caching
Amazon S3 — Threat intelligence archival, GDPR export files, static assets
AWS Lambda — Serverless compute for all backend services
Amazon Cognito — User authentication, password management
AWS KMS — Encryption key management for PII envelope encryption
Amazon SES — Transactional email delivery
Amazon CloudFront — CDN for frontend delivery
Amazon ECS — DNS resolver container orchestration

Stripe, Inc.

Location: United States (headquarters); global infrastructure

Processing Activities: Payment processing, subscription billing, invoicing

Personal Data Categories: Email address, payment card information (not accessible to Manaia), billing address, transaction history

Data Transfer Mechanism: Stripe Standard Contractual Clauses (SCCs); Stripe Data Processing Agreement

Certifications: PCI DSS Level 1, SOC 2 Type II

Details:

Stripe processes all payment transactions on behalf of Manaia
Manaia does not have access to credit card numbers or CVV codes (tokenized via Stripe Checkout)
Billing data retained by Stripe for 7 years to comply with Australian tax law

Email & Communications

Amazon SES (Simple Email Service)

Location: United States (SES endpoints); email metadata may transit US infrastructure

Processing Activities: Transactional email delivery, bounce/complaint tracking

Personal Data Categories: Email addresses, email content (verification codes, password reset links, notifications)

Data Transfer Mechanism: AWS Standard Contractual Clauses (SCCs)

Certifications: ISO 27001, SOC 2 Type II

Details:

Account verification and password reset emails
Security alerts and subscription notifications
GDPR data export download links
Daily/weekly activity reports

Twilio, Inc.

Location: United States (headquarters); global infrastructure

Processing Activities: Voice call delivery for critical security alerts (Guardian Pro plan)

Personal Data Categories: Phone numbers (verified, masked in logs), voice call metadata (timestamp, duration, status)

Data Transfer Mechanism: Twilio Data Processing Agreement; Standard Contractual Clauses (SCCs)

Certifications: SOC 2 Type II, ISO 27001

Details:

Voice call alerts for critical and high-severity threat events (Guardian Pro only)
Phone numbers stored encrypted at rest in Manaia systems; sent to Twilio only at time of call
Rate limited to maximum 1 call per 4 hours per household
Call status webhooks validated via HMAC-SHA1 signature verification

Apple Inc. (Apple Push Notification service)

Location: United States (headquarters); global infrastructure

Processing Activities: Push notification delivery to iOS devices

Personal Data Categories: Device push tokens (opaque, Apple-managed), notification content (threat type, severity)

Data Transfer Mechanism: Apple Developer Program License Agreement

Certifications: ISO 27001, SOC 2 Type II

Details:

Push tokens are device-specific and rotated by Apple — they cannot identify a user without access to Manaia systems
Notification content includes threat type and severity only — no PII, browsing history, or account data

Google LLC (Firebase Cloud Messaging)

Location: United States (headquarters); global infrastructure

Processing Activities: Push notification delivery to Android devices

Personal Data Categories: Device push tokens (opaque, Google-managed), notification content (threat type, severity)

Data Transfer Mechanism: Google Cloud Data Processing Amendment

Certifications: SOC 2 Type II, ISO 27001

Details:

FCM tokens are device-specific and managed by Google — they cannot identify a user without access to Manaia systems
Notification content includes threat type and severity only — no PII, browsing history, or account data

AI Processing

Anthropic PBC (via Amazon Bedrock)

Location: United States (Anthropic headquarters); processing via AWS Bedrock in ap-southeast-2 (Sydney) where available

Processing Activities: AI-powered safety insights, risk scoring, conversation starters for parents, threat analysis, and interactive chat assistant

Personal Data Categories: Aggregated household statistics (query counts, threat counts, blocked categories), profile metadata (age group, relationship type), threat event summaries. No raw DNS query logs, email addresses, names, or device identifiers are sent.

Data Transfer Mechanism: AWS Bedrock Data Processing Agreement; Anthropic Terms of Service (API usage — no training on customer data)

Certifications: SOC 2 Type II (Anthropic); ISO 27001, SOC 2 Type II (AWS Bedrock)

Details:

Daily safety insights generation — aggregated threat statistics and behavioural patterns (Guardian Pro)
Weekly narrative summaries — household activity overview (Guardian and above)
Conversation starters — AI-generated discussion prompts for parents about online safety (Guardian and above)
Risk scoring — deterministic 0-100 score per profile based on daily query statistics
Interactive chat assistant — streaming AI responses for security questions and account guidance
All inputs are pre-processed through PII redaction before being sent to AI models
Anthropic does not use API inputs to train models (per Anthropic API Terms)

Breach Monitoring

Troy Hunt (Have I Been Pwned)

Location: Australia (operator); API infrastructure global (Cloudflare)

Processing Activities: Email address breach monitoring — checks whether user-provided email addresses appear in known data breaches

Personal Data Categories: Email addresses (sent individually via authenticated API call)

Data Transfer Mechanism: HIBP API Terms of Use; data minimisation (single email per request, no bulk export)

Certifications: N/A (independent security researcher service)

Details:

Available on Guardian, Guardian Pro, and Grandparent Shield plans only
Users explicitly add email addresses to monitor — not automatic
HIBP returns breach metadata (breach name, date, data classes) — not the breached data itself

Error Monitoring

Functional Software Inc. (Sentry)

Location: United States (Sentry cloud); Android app uses self-hosted Sentry in AWS ap-southeast-2 (Sydney)

Processing Activities: Application error tracking and performance monitoring

Personal Data Categories: Error stack traces, function names, runtime metadata, device model, OS version. No PII (email, names, customer data) is sent to Sentry.

Data Transfer Mechanism: Sentry Data Processing Agreement

Certifications: SOC 2 Type II

Details:

Backend services use Sentry cloud (US) — error stack traces and Lambda metadata only
Android app uses self-hosted Sentry in AWS ap-southeast-2 (data stays in Australia)
No PII transmitted — error data contains only operational metadata
DSN-gated: crash reporting is disabled if Sentry DSN is not configured

Threat Intelligence Feed Providers

Important:

Threat intelligence feeds do not receive any personal data from Manaia. Data flows are unidirectional: Manaia fetches threat indicators from feed providers; no user data is sent to feed providers.

abuse.ch (URLhaus & ThreatFox)

Location: Switzerland

Processing Activities: Provision of malware distribution URL lists and domain-based threat indicators