A messaging and payment super app marketed at British students utilizes servers owned by a Chinese company placed on a US military blacklist due to alleged affiliations with the People's Liberation Army. ZyMix is being promoted on university campuses as the UK's first super app designed for generation Z, combining chat, payments, and community features. The application maintains a contract with a German-based subsidiary of Tencent Holdings, a Chinese conglomerate located in Shenzhen.
Tencent Holdings was added in January 2026 to the US Department of Defense's list of Chinese military companies, formally recognized as the section 1260H list. According to the Department of Defense citation, the gaming and social media conglomerate is indirectly affiliated with the Chinese People's Liberation Army. This blacklist forms part of a broader US effort to counteract Beijing's attempts to increase military power through technology from Chinese firms, universities, and research programs. The Department of Defense is prohibited from entering into, renewing, or extending contracts for goods, services, or technology with any entity on the list, though wider sanctions are not automatic.
A Tencent spokesperson stated that the inclusion on the list is a mistake, asserting that the company is not a military company or supplier. The spokesperson added that the listing has no impact on the business, unlike sanctions or export controls, and that the firm will work with the Department of Defense to address any misunderstanding.
Chinese presence in UK higher education has drawn scrutiny, with MI5 recently warning British universities to sever ties with the China General Technology Research Institute over alleged covert funding channels directed toward UK-linked academics to improve technical espionage capabilities for China's ministry of state security.
The connection between Tencent's infrastructure and ZyMix surfaced in the app's privacy policy during its launch. The legally required document initially stated that Tencent stored user-generated content and messages. Following inquiries, the privacy policy was revised to remove mentions of Tencent. The updated policy specifies that personal data is stored and processed primarily in the United Kingdom and the European Union, while noting that some service providers operate in other locations, including the United States. Auxiliary infrastructure providers hosted in the European Union receive encrypted user messages and limited technical data, such as technical statistics and licence validation upon application startup.
A ZyMix spokesperson explained that as a newly launched startup, the privacy notice is being updated alongside service development to clarify that Tencent, Twilio, and other providers are utilized solely for performance testing. The agreement is specifically with Tencent Cloud Europe BV for auxiliary services rather than user data storage, and the company maintains compliance with UK data protection laws. The revised privacy policy instructs users seeking supplier identities to submit requests to the company.
Tarique Ghaffur, a former assistant commissioner at the Metropolitan Police who acts as a security consultant for ZyMix, responded to inquiries by stating that requests cannot be fulfilled due to commercial confidentiality, contractual obligations, and legal privileges. Fraser Sampson, a professor of security and national governance and former UK biometrics and surveillance camera commissioner, expressed skepticism regarding commercial confidentiality arguments and policy amendments made without prior notice. Sam Dunning, director of the UK-China Transparency NGO, raised concerns regarding the level of due care exercised prior to the product launch.
The ZyMix app is currently in its beta stage and developers maintain full compliance with UK data, privacy, and financial regulations. The platform targets the university market by offering payments ranging from £200 to £400 a month to individuals acting as campus brand ambassadors. Staff positions requiring Mandarin proficiency have also been advertised in the UK, including an operations manager role specifying daily communication with a China team. Recruitment efforts on WeChat by a separate company indicated that product, research and development, design, and testing teams operate in Greater China with branches across Taipei, Shenzhen, Guangzhou, Hangzhou, Chengdu, and Zhengzhou. Ghaffur stated that Flicknmix, the UK publisher of the ZyMix app, operates without subsidiaries or branch offices in China, while a ZyMix spokesperson characterized the venture as British born.
