CYN-NEX-DP-01 Rev A — Data residency position, POPIA section 72 (DRAFT)

Status: DRAFT A, 14 September 2026 — prepared from the build seat on the operator's instruction (Ashley Verhulp, 14 Sep 2026, "publish a POPIA §72 position"). Not issued. Becomes ISSUED only on the operator's declaration, after legal review, and its entry in CYN-COR-DR-00 with its SHA-256. Until then the page that renders this file says DRAFT on its face and nothing here is a representation to a customer or to the Information Regulator. Supersedes: nothing — first draft. Governing: CYN-COR-OC-00 Rev A, rule 1 (measure, don't assert), rule 4 (declare the scope), rule 7 (a control without primary evidence is not a control) and the Voice section. Every fact below carries its source.

1 · Where the data is — measured

No African region is used today. No customer has elected a region; the "customer-elected region" wording on /trust and /legal/subprocessors describes an option the hosting operator offers, not a configuration Nexus has exercised. [OPERATOR TO CONFIRM that wording stays or is narrowed.]

2 · What personal information crosses the border — from the schema

Telemetry (device readings, states, counters, rollups, statements) is operational data about equipment, not about identifiable natural persons, and is the overwhelming majority of what is stored. Personal information in the platform is limited to:

• account records — name, e-mail address, authentication factors and session metadata of tenant users and platform operators (auth.*, tenant_user_roles, tenant_users);
• notification recipients — e-mail addresses and delivery receipts (email_delivery_receipts, notification rule recipient columns);
• audit rows — actor identity and timestamp on administrative actions (alert_rule_audit_log, admin audit tables);
• support and enquiry submissions from the public site.

A juristic person is a data subject under POPIA (s1 "person"), so tenant company records are also personal information in the Act's sense.

3 · The position — DRAFT, for legal review

Section 72(1) of the Protection of Personal Information Act 4 of 2013 permits transfer of personal information to a third party in a foreign country where, among the listed grounds, (a) the recipient is subject to a law, binding corporate rules or a binding agreement that provides an adequate level of protection, effectively upholding principles for reasonable processing substantially similar to the Act's conditions and including substantially similar provisions on onward transfer; or (c) the transfer is necessary for the performance of a contract between the data subject and the responsible party.

Cyntech's draft position is that hosting in Ireland satisfies s72(1)(a) because:

1. the recipient (Supabase Inc., processing in eu-west-1) is subject to the General Data Protection Regulation (EU) 2016/679, whose conditions for lawful processing, security safeguards, data-subject rights and restrictions on onward transfer (Chapter V) are substantially similar to POPIA's eight conditions and to s72 itself; and
2. the processing is additionally governed by a binding agreement — the 2021 Standard Contractual Clauses, Module 2 (controller to processor) with the UK Addendum — which restricts purpose, mandates security measures, flows down onward-transfer restrictions and gives audit rights; and
3. for a tenant's own users, the transfer is also necessary for performance of the platform contract with that tenant (s72(1)(c)), the contract being the reason the account exists.

The position does not rely on data-subject consent (s72(1)(b)) and does not claim an adequacy finding by the Information Regulator, which has issued none. It does not claim that Ireland is "the same as" South Africa; it claims substantial similarity as s72(1)(a) requires, and that claim is one a reviewer can test against the GDPR text and the SCCs on file.

4 · What a security questionnaire will still ask — stated openly

• Residency versus protection. s72 is a protection test, not a location test. A procurement policy that requires in-country storage is a contractual requirement above the Act and this position does not meet it. Moving the tenant data to an African region is a separate decision (scope, cost and cut-over risk unmeasured in this pass).
• Lawful access by foreign authorities. Irish- and EU-law process applies to the hosting operator. Nexus holds no telemetry classified under South African critical-infrastructure legislation; [OPERATOR TO CONFIRM per petrochemical tenant].
• Operator access from South Africa. Platform operators read the database from South Africa; that is an access to the foreign-hosted copy, not a second transfer, and it is gated by a second authentication factor for administrative functions (measured on /security-centre).
• Backups. Where the off-site backup bucket sits determines whether a second transfer exists. Confirm before issue (§1, last row).

5 · Reopen if

• the hosting region, hosting operator or transfer instrument changes;
• the Information Regulator issues guidance or a decision on s72(1)(a) adequacy that bears on GDPR-jurisdiction processors;
• a tenant contract requires in-country storage;
• the off-site backup region is found to differ from eu-west-1.

6 · Not in this document

No price, no SLA, no claim of certification. Nothing here was measured about the hosting operator's internal controls beyond the instruments listed on /legal/subprocessors; those are the operator's representations, cited, not Cyntech's measurements.