Arno Sub‐Processor Register

Owner: DPO/Compliance
Effective date: 31st August 2025
Next review: Quarterly (or on vendor change)

Arno is an NDPC-approved Data Controller/Processor of Major Importance (DCPMI) under NDPA 2023 / GAID 2025. This can be verified on the NDPC register. View our NDPC certification here

    This register lists third‐party processors Arno uses today. Each vendor signs a Data Processing Agreement(DPA) and is subject to a Transfer Impact Assessment (TIA) where data leaves Nigeria/Kenya. Our technical
and organisational measures (TOMs) include TLS 1.2+, AES‐256 at rest with KMS, RBAC/MFA for admin roles,
quarterly access reviews, and a 30‐day backup window.​​