Trust and procurement
For a business’s procurement or security review of ThumaTrade: the documents that bind us, each at its latest published version, and where the service’s health is published. Every document is also in the ThumaTrade portal, under Promises and privacy, where it is accepted for the business.
The documents
| Document | Latest version |
|---|---|
| Service Level Agreement — ThumaTrade | 2026-08-13 |
| Data Processing Agreement — for businesses | 2026-10-08 |
| Security Overview | 2026-08-13 |
| Thuma Express General Terms of Use | 2026-10-11 |
Each opens as a page laid out for A4: print it, or save it as a PDF, to send it on. A new version can take effect some days after it is published, on the notice the document gives; the portal shows which version applies to your business.
How the service is running
Live status and every incident, with its updates: status.thumaexpress.com.
Sub-processors
As listed in Annex 3 of the Data Processing Agreement, version 2026-10-08, as published.
| Who | What they do | Where |
|---|---|---|
| Amazon Web Services | Hosting, database, object storage, email delivery | South Africa (af-south-1); email delivery may route via other AWS regions |
| Stripe | Card payments and subscriptions | Ireland / United States |
| Twilio | One-time codes and messages by SMS and WhatsApp | United States, with regional routing |
| Maps, addresses and route estimates; push notifications to devices | United States | |
| Amazon Rekognition | Automated identity document and face checks, where enabled | South Africa (af-south-1) |
| Anthropic, PBC | Reading documents sent to ThumaBooks and writing the words of a Brief, under zero data retention: nothing is kept once the model has answered, and nothing is used to train a model (the ThumaBooks AI Policy) | United States |
Smile Identity was on this list and should never have been. It was named as an identity sub-processor in Kenya and South Africa on the strength of an integration that was designed and then abandoned in favour of Amazon Rekognition, which runs in our own AWS account in South Africa. No customer's identity information has been sent to Smile Identity: no released version of the Platform has contained a client capable of sending it, and the API credential such a client would require has never existed in any Thuma environment. Removing the row is a correction of this document, not a change of supplier — see the note above about what this annex is for.
We use no advertising or analytics processor that receives your customers' details, and we do not sell or share them.