Sub-processors
SenangUrus runs on infrastructure provided by other companies. Every one of them that can reach personal data is listed here, with the data it can reach and where it processes it — the same list that appears in the annex to your Data Processing Agreement.
Last updated: 17 September 2026 · version 0.1
Current sub-processors
| Sub-processor | What they provide | Data they can reach | Processing location |
|---|---|---|---|
| Cloudflare, Inc. | DNS, content delivery, web application firewall and DDoS protection for our public websites | Visitor IP addresses, request metadata | Global edge network |
| Hostinger Operations UAB | Hosting for the customer sign-in portal and public applications | Identity, contact and authentication data | Malaysia (Kuala Lumpur) |
| Contabo GmbH (Contabo Asia) | Virtual servers and storage for the application and its databases | All categories of customer data in the platform | India (Mumbai) and Singapore |
| Google LLC | Web fonts on our public websites | Visitor IP address | United States / global |
| Google LLC (YouTube) | Customer story videos, loaded only after a visitor presses play, via youtube-nocookie.com | Visitor IP address and playback metadata | United States / global |
Processing location is stated as the country of the infrastructure in use. Where a provider operates a global network, the entry says so rather than naming one country.
Services being added to this register
We are completing a full data-location review, including every vendor that touches customer data even indirectly — mail, payments, backups, monitoring and support channels. They will appear in the table above, with locations, as each review closes. Ask our DPO for the current position on any of them today; we will not leave a question like this unanswered while the register is being finished.
| Service | Data involved |
|---|---|
| Transactional email and support mail | Identity, contact details and the content of messages |
| Subscription payment processing | Billing contact details and payment data |
| Encrypted backups and object storage | All categories of customer data |
| Monitoring, logging and error reporting | Technical logs that may include identifiers |
| Support messaging channels | Identity, contact details and message content |
How we manage sub-processors
- We remain liable to you for what a sub-processor does with your data — the obligation is not passed on with the work.
- Every sub-processor is bound by written terms that match our commitments to you, including the Security Principle, confidentiality and breach notification that reaches us within our own 24-hour clock.
- We give you at least 30 days' notice before adding or replacing a sub-processor, and this page is updated at the same time.
- You may object in writing on reasonable data protection grounds, and if we cannot deliver the Service without the change you may terminate the affected part.
- Sub-processors and their staff may not use one customer's data to serve another.
Changes to this list
We publish changes here and give customers at least 30 days' notice before a new sub-processor starts processing their data. If you want to be told by email as well, ask your account contact to add you to the notification list.
Ask us about any entry
[email protected] · (+6) 03-7890 3946
C-16-3A Zen Suites @ ZetaPark, Jalan Langkawi, Taman Danau Kota, 53100 Setapak, W.P. Kuala Lumpur, Malaysia
Need the DPA and this annex signed
Tell us your entity details and we will send the Data Processing Agreement with the sub-processor annex filled in for your deployment.