A new messaging and payment 'super app' named ZyMix, aimed at British students, utilises servers owned by a German-based subsidiary of Tencent Holdings. Tencent, a Chinese conglomerate, was added to the US Department of Defense's (DoD) list of Chinese military companies in January 2026 due to alleged affiliation with the People’s Liberation Army.
ZyMix is being promoted on university campuses as the UK’s first super app for 'gen Z', offering chat, payments, and community features. The DoD list prohibits the department from contracting with listed entities, though wider sanctions are not automatically applied.
A Tencent spokesperson stated that their inclusion on the list is a mistake and denies being a military company or supplier. ZyMix's privacy policy initially disclosed that Tencent (Frankfurt) stored user-generated content and messages. This mention was removed after a media inquiry, with the policy now stating data is primarily stored in the UK and EU, and that 'auxiliary infrastructure providers' in the EU receive only encrypted messages and limited technical data.
A ZyMix spokesperson clarified that their agreement is with Tencent Cloud Europe BV for auxiliary services, not for storing user data, and that Tencent is used for performance testing. Tarique Ghaffur, a security consultant for ZyMix, declined to provide information on suppliers due to 'commercial confidentiality'. Fraser Sampson, a professor of security and national governance, expressed scepticism regarding the use of commercial confidentiality to avoid basic policy questions.