Trust · Sub-processors · Last reviewed 2026-10-09
Who processes data on our behalf, and where.
Lebon Consulting (Pty) Ltd uses the third parties below to run the xverified platform and to verify identities. Each is bound by a written agreement with security and confidentiality terms. Providers marked "Per engagement" are used only when the client has agreed to them in the engagement letter. We update this page before a new provider goes live, and clients under contract are notified of changes.
01Infrastructure
Hosting, identity and email.
| Provider | Purpose | Data | Location | Scope |
|---|---|---|---|---|
| Microsoft Azure (Microsoft South Africa) | Hosting, database, document storage and backups for the platform and the API. | All client and case data. | South Africa North (Johannesburg) | Always |
| Microsoft Entra ID | Sign-in and multi-factor authentication for practice and client users of the enterprise portal. | User names, email addresses, sign-in logs. | Microsoft global service; tenant data homed in South Africa / EU | Always |
| Microsoft 365 (Exchange Online) | Transactional email: notifications, letters and reports sent by the platform. | Recipient addresses and the content of the message. | Microsoft South Africa data centres | Always |
| Google Firebase (Google LLC) | Sign-in for beneficiaries and individual users of the public xverified app. | Email address, authentication identifiers. | Google global service (may include the EU and USA) | Always |
| Vercel Inc. | Hosting of this marketing website only. No client or case data is served from it. | Website request logs (IP address, user agent). | USA / global edge | Always |
02Verification and enrichment
Providers that see personal information for a trace.
| Provider | Purpose | Data | Location | Scope |
|---|---|---|---|---|
| BitVenture (South Africa) | Department of Home Affairs identity verification and family lineage lookups through DHA's authorised channel. | ID number, names, date of birth of the person being verified. | South Africa | Always |
| TransUnion (South Africa) | Credit bureau header data for current contact details and footprints. | ID number and names of the person being traced. | South Africa | Always |
| VerifyNow (South Africa) | Contact-number enquiry: identifies the ID number and names behind a phone number when a client supplies only a contact number. | The contact number supplied by the client. | South Africa | Per engagement |
| Anthropic PBC | AI-assisted drafting of case summaries from case documents, reviewed by a person before use. Enabled only when the client has agreed to it in the engagement letter. | Case documents and family map for the case being summarised. | USA (section 72 POPIA transfer, with client consent) | Per engagement |
| Apollo.io | Business contact enrichment for company directors when tracing a former employer or a company that owes a benefit. | Director name and company name. | USA | Per engagement |
03Public registers
Sources we query, which are not sub-processors.
These are public bodies or registers we consult; they do not process data on our behalf, and queries are made within each body’s own terms.
- Department of Home Affairs (HANIS) — via the authorised verification channel above
- Financial Sector Conduct Authority — retirement fund registers and the Section 13 unclaimed benefits search
- Master of the High Court — deceased estate and trust registers
- Companies and Intellectual Property Commission (CIPC) — company and director records
- Government Gazette and deceased estate notices
- JSE share registrars and transfer secretaries (per engagement)
- Payments Association of South Africa dormancy indicators (per engagement)
Questions about any provider on this page go to the Information Officer, info@lebonconsulting.co.za. How the data is protected is described on the security and compliance page.