Third-Party Service Providers List

This List helps applicants, members and other affected persons understand which external organisations support material 6membership operations.

It describes each provider’s principal function and the categories of information that may pass through or remain within that provider’s service.

The List should be read with the Privacy and Data Protection Notice, which explains the wider reasons for processing personal information.

This List focuses on providers that may process production website traffic, applicant information, membership records, transactional email, security information or official communications.

A development utility that does not receive production personal information may not require individual public listing.

A provider may later require listing if its use changes and it begins processing production personal information.

A provider may offer many products, but 6membership uses only selected products and configurations.

The fact that a provider offers analytics, artificial intelligence, advertising, identity verification or another product does not mean that 6membership has enabled that product.

This List describes the enabled or materially relevant 6membership use rather than every service available from the provider.

Listing a provider does not mean that 6membership guarantees every product, policy, security measure, employee, subprocessor or independent action of that provider.

Providers remain responsible for obligations imposed directly upon them by contract and applicable law.

The currently confirmed material providers are Vercel, Supabase, Resend, Cloudflare, Google through Gmail and Flutterwave.

Additional material providers will be listed only after their production purpose and data access have been established.

A provider may process personal information on documented instructions from 6membership to supply hosting, databases, storage, email delivery, security or another contracted service.

In that situation, 6membership ordinarily determines the principal membership-processing purposes and the provider performs the assigned technical function.

A provider may independently determine some processing purposes required to manage its account relationship, billing, fraud prevention, security, legal compliance, support or service improvement.

That independent processing is governed by the provider’s own legal obligations and privacy information.

A provider may act as a processor for customer content while acting independently for account, diagnostic, abuse-prevention or legal-compliance information.

The applicable role depends on the specific information and activity rather than the provider’s name alone.

Using a provider does not remove 6membership’s responsibility to select appropriate services, configure them carefully, limit access, provide required notices and respond to applicable privacy rights.

6membership must not blame a provider automatically for an error caused by an insecure or excessive 6membership configuration.

A provider remains responsible for its own systems, personnel, contractual duties, independent processing and compliance obligations.

Nothing in this List releases a provider from an obligation that applicable law imposes directly upon it.

A provider should be selected only for a defined operational purpose connected with website delivery, applications, membership administration, communications, security or legal obligations.

A provider must not receive production information merely because its integration is convenient or included in a template.

Relevant factors may include the service supplied, information categories, processing location, contractual terms, security measures, subprocessor arrangements, access controls, retention, deletion support, incident procedures and international-transfer mechanisms.

The level of assessment should reflect the sensitivity and volume of information involved.

A provider that may receive identity documents, applicant photographs, source-of-funds records or other sensitive information requires stronger assessment than a provider handling only ordinary public website assets.

Access should be limited to the smallest appropriate service and personnel group.

Where appropriate and available, 6membership will use contractual terms addressing confidentiality, security, authorised processing, subprocessors, deletion, incident notification and international transfers.

The applicable contract may include standard terms, a data-processing addendum, an order form or another binding arrangement.

Provider use may be reviewed when the provider changes its terms, subprocessors, product architecture, security position, data location or service purpose.

A provider may be restricted or replaced where material risk cannot be addressed appropriately.

Provider: Vercel Inc.

Service category: website hosting, deployment, content delivery, server-side functions, technical logs and related application infrastructure.

6membership uses Vercel to deploy and operate the public website and server-side application routes.

A request to the 6membership website may pass through Vercel infrastructure before the requested page or function is returned.

Server-side functions may communicate with authorised database, email and other backend services.

Vercel should not receive unrestricted application information merely because the website is hosted there.

Sensitive information should be sent only through the necessary protected route and must not be written unnecessarily into public deployment or diagnostic logs.

Vercel may process customer information to provide the hosted service under the applicable contractual arrangement.

Vercel may also process account, billing, support, diagnostic, security and abuse-prevention information for purposes it determines independently.

Vercel operates cloud and content-delivery infrastructure that may process requests across multiple locations.

The location of a visitor does not mean that every item of information remains exclusively within that visitor’s country.

International processing and transfer protections are governed by the applicable contractual and legal framework.

Privileged environment variables and secrets must be stored through approved server-side configuration and must not be exposed in the public browser bundle.

Production logs should avoid unnecessary identity documents, authentication secrets, complete payment credentials and unrelated application answers.

Access to the production project should be restricted to authorised personnel.

Provider: Supabase, Inc.

Service category: hosted PostgreSQL database and related backend infrastructure enabled for the 6membership project.

6membership uses Supabase to maintain structured application, membership, payment, refund, legal-acceptance, administrative and audit records.

Supabase may also support related backend functions or private storage where those products are deliberately enabled for the production project.

The exact fields stored depend on the relevant application and operational purpose.

Complete payment-card credentials, banking passwords and email OTPs must not be stored as ordinary membership database fields.

A Supabase project is deployed to a selected primary region.

The actual 6membership project region should be maintained accurately within the internal provider and infrastructure record.

A public statement must not claim that the project is hosted in Nigeria, Europe, the United States or another location unless that statement matches the active production configuration.

6membership must use appropriate database permissions, private server credentials, Row Level Security where relevant, restricted administrative roles and audit controls.

A Supabase secret or service-role key must remain server-only.

A public or publishable key must not be treated as permission to expose protected database tables.

Database dashboard and privileged API access should be restricted to authorised personnel.

A person permitted to review an application should not automatically receive unrestricted power to alter payments, refunds, policy records and audit logs.

Deletion from the active database will be handled according to the relevant retention, legal-hold, audit and backup rules.

Removal of one user-facing record may not require immediate destruction of every restricted audit, payment or security record where continued retention is lawful and necessary.

Provider: Plus Five Five, Inc., operating the Resend service.

Service category: transactional email preparation, delivery, routing information, status events and related email infrastructure.

6membership uses Resend to send operational and transactional email.

Messages may include email OTPs, application confirmations, information requests, payment notices, decisions, refund-status notices, membership records, renewal reminders, expiry notices, privacy communications and security alerts.

An email should contain only the information reasonably necessary for the communication.

Identity documents and highly sensitive financial evidence should not be attached to ordinary email merely for convenience.

Resend states that customer data is stored in the United States.

Resend also publishes a subprocessor list for services supporting its email platform.

Information transmitted through Resend may therefore be processed by Resend and authorised subprocessors in locations described by its applicable documentation.

A provider-accepted message is not guaranteed to reach the recipient’s inbox.

Delivery may be affected by an incorrect address, recipient-server rejection, spam filtering, account restrictions, mailbox capacity, network failure or another provider.

6membership may retain delivery status so that failed communications can be investigated.

Transactional delivery status may be processed to determine whether a message was sent, delivered, bounced, rejected or complained about.

Optional open or click tracking must not be enabled merely because the provider supports it.

Where tracking is enabled, the purpose, necessity and applicable consent or notice requirements must be assessed.

The Resend API key must remain server-only.

Approved sending domains and sender addresses should be protected against unauthorised use.

Email templates must not expose privileged links, passwords or secrets.

Provider: Cloudflare, Inc.

Service category: domain-name system management, network routing, security, transport protection, traffic handling and email routing.

6membership uses Cloudflare to support domain configuration and network protection for 6membership.com.

Cloudflare may process network requests before traffic reaches the website host.

Cloudflare Email Routing may receive and forward messages sent to configured 6membership email addresses.

The information processed depends on the enabled Cloudflare services and configuration.

Cloudflare is not authorised through this List to use private membership information for unrelated 6membership advertising.

Cloudflare operates a distributed global network.

Requests may be processed at network locations selected to deliver, secure and route the service.

Information may therefore be processed outside the visitor’s country.

Cloudflare may help identify malicious traffic, automated abuse, denial-of-service activity, suspicious requests and other network threats.

Security controls must remain proportionate and should not be used as an undisclosed behavioural advertising system.

Email sent to configured 6membership addresses may pass through Cloudflare before being forwarded to the authorised destination mailbox.

The message may include sender information, body content and attachments supplied by the sender.

A sender should not include passwords, complete payment credentials or unnecessary identity documents in an initial email.

Domain, DNS, routing and security access should be protected through strong authentication and restricted administrative roles.

Unauthorised changes could redirect visitors, email or verification traffic and must be treated as a serious security incident.

Provider: Google LLC and relevant Google affiliates providing Gmail and Google Account services.

Service category: authorised administrative mailbox, email receipt, email storage, search, security and account management.

Messages routed to certain official 6membership addresses may be delivered into an authorised Gmail mailbox.

The mailbox may be used to review applications, administrative requests, privacy requests, security reports, complaints and other official correspondence.

Google states that content created, uploaded, sent or received through its services, including email, may be stored with the relevant Google Account.

The information Google processes depends on the service, account configuration and applicable Google terms and privacy settings.

Google may process mailbox content to provide the selected email service.

Google may also process account, security, diagnostic, abuse-prevention and service information under its own applicable terms and privacy policy.

The precise legal role may depend on whether the mailbox uses a consumer Google Account, Google Workspace or another Google arrangement.

Google operates services and infrastructure internationally.

Email content and associated information may be processed outside Nigeria or the sender’s country according to the applicable service arrangement and transfer framework.

Only authorised persons should have access to the administrative mailbox.

Access should use strong authentication and should be removed promptly when no longer required.

Shared passwords should be avoided where individual authorised accounts or delegated access are available.

Email should not be treated as the default channel for unrestricted identity documents, financial statements or highly sensitive evidence.

Where sensitive evidence must be supplied, an approved private upload route should be used where available.

Messages containing sensitive information should be retained only for the necessary operational and legal period.

Provider for the Nigerian merchant payment arrangement: Flutterwave Technology Solutions Limited, together with relevant Flutterwave affiliates, acquiring institutions, payment schemes and payment-method partners involved in the selected transaction.

Service category: hosted payment checkout, payment gateway and API services, transaction processing, payment verification, webhooks, refunds, chargebacks, settlement and reconciliation support.

6membership has selected Flutterwave as its production payment integration for eligible public membership applications and related authorised payment actions.

Flutterwave may present or support the checkout interface, route the selected payment method, return transaction identifiers and statuses, notify 6membership of payment events and process authorised refunds.

The private 6clement Joshua consideration route does not require an initial membership payment unless a later separate approved process states otherwise.

The precise information depends on the payment method, country, currency, risk review and provider requirements.

6membership should retain only the payment references and status information reasonably necessary for application review, membership administration, refunds, accounting, fraud prevention and legal compliance.

Complete card numbers, card security codes, banking passwords, payment PINs and OTPs must not be stored as ordinary 6membership database fields or requested through email, social media or administrator messages.

Where Flutterwave or another authorised payment participant collects protected payment credentials through its controlled interface, that participant handles the credentials according to its own payment-security, regulatory and contractual obligations.

6membership may receive limited payment-method metadata, transaction references, status information and masked details required for reconciliation and support.

A browser redirect, screenshot, applicant message or unverified webhook does not establish that payment succeeded.

Before payment value is recognised, 6membership must verify the transaction through an authorised server-side Flutterwave process and confirm the expected transaction reference, amount, currency, status and relevant customer or application relationship.

Incoming webhooks must be authenticated using the current Flutterwave-supported signature mechanism, processed through a server endpoint and protected against duplicate or replayed actions.

Flutterwave secret credentials must remain in protected server-side configuration and must never be exposed in client code, public repositories, policy pages or browser-visible responses.

An internally approved refund is not the same as a refund accepted, processed or completed by Flutterwave.

6membership records should distinguish refund approval, provider submission, provider acceptance, processing, success, failure and reversal according to the available provider response.

Refund and chargeback timing may depend on the payment method, Flutterwave, the payer's financial institution, payment schemes and compliance review.

Duplicate refund requests and repeated webhook events must not create repeated provider instructions or inconsistent application records.

Flutterwave provides payment infrastructure and may process information under the merchant arrangement while also performing independent fraud-prevention, regulatory, security, account, settlement and legal-compliance functions.

Banks, card schemes, mobile-money operators, acquiring institutions, issuing institutions and other payment participants may process transaction information independently according to the selected method and applicable law.

Flutterwave Incorporated and relevant affiliates operate across multiple jurisdictions. Transaction information may therefore be processed in Nigeria and other locations used by Flutterwave, its affiliates and authorised payment participants.

The provider's current privacy notice, merchant terms and applicable transaction rules govern Flutterwave's own processing responsibilities.

A listed provider may engage another organisation to support hosting, infrastructure, monitoring, security, communications, support or another part of its service.

That organisation may be described as a subprocessor, subcontractor, affiliate, infrastructure provider or service provider.

6membership may contract directly with the listed provider while the listed provider selects its own authorised subprocessors.

The provider remains responsible according to its applicable contract and law for the subprocessors it engages.

Provider subprocessor lists may change as infrastructure and services develop.

6membership may review material changes where the applicable contract provides notice or where the change creates a significant new risk.

A provider may publish and maintain its own current subprocessor list.

This 6membership policy does not reproduce every provider subprocessor because that could become inaccurate when the provider updates its infrastructure.

The provider’s current official list should be consulted where detailed subprocessor information is required.

Where a new subprocessor creates a material data-protection risk that cannot reasonably be addressed, 6membership may seek clarification, adjust the service, restrict affected processing or replace the provider.

A provider should receive only the information reasonably required for its enabled service.

Website-hosting access does not automatically justify access to every identity document, payment review and administrative note.

Application routes, email templates, logs and database records should be designed to avoid unnecessary duplication of sensitive information.

A Membership ID or Application Reference may be used instead of repeating complete identity information where the reference is sufficient.

Real applicant information should not be copied into development, demonstration or testing systems merely for convenience.

Synthetic or appropriately anonymised test information should be used where reasonably possible.

Provider support personnel may require limited diagnostic information to investigate a technical problem.

6membership should avoid sending complete production records where a narrower log, reference or redacted example is sufficient.

Administrative access to each provider should be limited according to operational role.

A person authorised to manage website deployment should not automatically receive database, mailbox and private-document access.

The listed providers operate infrastructure, companies, support teams or subprocessors in more than one country.

Personal information may therefore be accessed, transmitted, routed or stored outside Nigeria and outside the affected person’s country.

Where applicable law restricts an international transfer, 6membership will use an available legal mechanism appropriate to the circumstances.

Possible mechanisms may include an adequacy decision, contractual clauses, an approved certification framework, consent in limited circumstances or another legally recognised safeguard.

Relevant factors may include the provider, destination, information type, service purpose, security measures, contractual safeguards and legal environment.

Additional technical or organisational safeguards may be applied where reasonably necessary.

6membership will not claim that all information remains in Nigeria or another single country unless the actual provider configuration and contracts support that claim.

A selected database region does not necessarily mean that every email, network request, support record and provider account record remains in that same region.

Where applicable law grants the right, an individual may request information about material transfer safeguards through the privacy contact channel.

Provider administrative accounts should use strong unique credentials and multi-factor authentication where available.

Credentials must not be shared casually or transmitted through insecure messaging channels.

Database secret keys, email API keys, provider tokens and privileged credentials must remain server-side.

Secrets must not be committed to a public repository, displayed in browser code, stored in public documents or included in screenshots.

Production communications with providers should use encrypted transport appropriate to the service.

Private documents should use restricted storage and time-limited access methods where appropriate.

Material provider account, deployment, database, mailbox and administrative actions may be logged.

Logs should identify the action and relevant account while avoiding unnecessary sensitive content.

Provider access should be removed promptly when a person no longer requires it.

Passwords, tokens and keys may be rotated where access may have been exposed.

A suspected provider-account, secret, routing, database or mailbox compromise must be investigated promptly.

Affected credentials may be disabled or rotated and relevant provider support channels may be engaged.

Information should remain within a provider only for the period reasonably required for the enabled service, security, legal obligations, dispute handling and applicable backup processes.

When information is no longer required in an active provider system, 6membership may delete it, anonymise it, restrict it or allow it to expire according to the applicable retention schedule.

A provider may retain limited security, billing, abuse-prevention, diagnostic or legal-compliance records under its own applicable obligations.

Deletion from the 6membership application does not necessarily remove every independent provider account or security record immediately.

Deleted information may remain temporarily in encrypted backups or disaster-recovery systems until the applicable provider backup cycle expires.

Backup information should not remain available for ordinary production use.

When a provider is replaced or discontinued, 6membership should identify information requiring export, migration, deletion, preservation or restricted retention.

Access tokens, routing records and credentials should be revoked when no longer required.

Deletion may be delayed where information is subject to a legal hold, payment dispute, security incident, complaint, court process or lawful authority request.

A person seeking access, correction, deletion, restriction, objection or another applicable privacy right should ordinarily contact 6membership through the official privacy channel.

The request should identify the relevant application, membership, email or other record where available.

6membership may verify the requester before retrieving, changing or deleting information held through a provider.

Verification should be proportionate to the sensitivity of the requested record.

Where necessary, 6membership may use provider controls or request provider assistance to search, export, correct, restrict or delete relevant information.

A provider may require account authentication and enough technical information to identify the affected record.

Where a provider independently controls particular account or service information, the individual may need to exercise the relevant right directly with that provider.

6membership will provide reasonable direction where the distinction is known and relevant.

A request may be limited where information must be retained for legal obligations, security, fraud prevention, another person’s rights, payment disputes, audit integrity or legal claims.

Applicable mandatory rights and complaint routes remain preserved.

A provider may notify 6membership of an incident, vulnerability, unauthorised access event, outage or service degradation.

6membership will assess whether production information or critical operations were affected.

The investigation may consider the affected provider, systems, information categories, persons, timeframe, access, likely consequences and available containment measures.

Containment may include disabling an integration, rotating credentials, restricting access, changing routing, restoring backups, replacing a provider or temporarily suspending an affected function.

Affected persons and competent regulators will be notified where applicable law requires notification.

Notice may identify the provider and incident where doing so is accurate, lawful and useful.

A provider outage may temporarily affect the website, database, email, verification or administrative communications.

6membership will take reasonable steps to restore the affected service but cannot guarantee that every external provider will remain continuously available.

6membership will avoid claiming that information was stolen, unaffected or permanently deleted before the available evidence supports that conclusion.

Updates may change as the provider and 6membership complete the investigation.

Before a material provider receives production personal information, 6membership should assess its purpose, information access, security, location, contractual terms, subprocessors and deletion capabilities.

Flutterwave is the selected production payment provider and is identified in section 9 of this List.

Before Flutterwave is replaced, supplemented by another customer-facing payment integration or used for a materially different payment purpose, 6membership should assess the proposed change and update this List where appropriate.

A provider name appearing in an unfinished interface, test environment or design does not authorise live payments or the transfer of production payer information.

Before an external identity-verification provider receives photographs or identity documents, the provider must be assessed and added to this List.

The entry should explain whether biometric processing, liveness checks or automated matching are used.

An analytics or marketing provider must not be added silently.

The Cookie and Tracking Technologies Policy and consent interface must be updated before optional tracking technologies are activated where required.

When one provider replaces another, information should be migrated securely and old access should be revoked.

The retired provider may remain listed temporarily where it still retains information under a backup, legal or transition period.

An urgent security or continuity situation may require temporary use of a replacement provider.

The provider must still be assessed as soon as reasonably possible and material public information must be updated without unnecessary delay.

This List should reflect providers that actually support the production or material administrative service.

A provider should be removed when it no longer processes relevant information, subject to any transition or retention period that remains applicable.

A provider under consideration should not be described as active before it is connected.

This prevents applicants from receiving inaccurate information about where their information is processed.

A material provider change may include adding a payment provider, identity-verification provider, analytics provider, document-storage provider or administrative communication service.

A minor technical change inside an existing provider may not require a separate public entry where the processing purpose remains materially unchanged.

Where a provider change materially affects existing personal information, international transfers, sensitive processing or individual rights, 6membership may provide additional notice through the website, application flow or registered email address.

Updating this List does not retrospectively authorise an earlier unlawful or undisclosed disclosure.

A provider change must have an appropriate legal and operational basis when the processing begins.

Material provider changes, effective dates and public notices will be recorded through the Policy Updates, Effective Dates and Change Log.

A person may ask which listed provider is relevant to a particular application, email, membership or website interaction.

6membership may provide additional information where reasonably available and legally appropriate.

Requests concerning access, correction, deletion, restriction, objection, portability or international-transfer information should be submitted through the official privacy channel.

A person who identifies a suspected provider misconfiguration, exposed secret, unauthorised database access, malicious redirect or email-routing compromise should report it promptly through the security channel.

The report should avoid publishing the exposed information publicly.

A person may complain where they believe information was supplied to an unlisted provider, used outside the stated purpose or retained improperly.

The complaint should identify the affected interaction and provider where known.

Nothing in this List removes a mandatory right to contact an applicable privacy regulator, consumer authority, court or other competent body.

The version displayed through the official 6membership Legal & Trust Center is the current public provider list.

A copied or cached version may become outdated after a provider change.