Legal
Sub-processors
Every third party that processes customer data on our behalf, what each one receives, and where it processes it. Any addition is published here at least 30 days before it starts processing.
Last updated 30 August 2026
| Sub-processor | Purpose | Data processed | Region |
|---|---|---|---|
| Google Cloud Platform | Application hosting and document storage | Uploaded documents, questionnaires, generated answers | europe-west9 (Paris) |
| Neon | Managed PostgreSQL database | Account details, answers, document text and embeddings | AWS eu-central-1 (Frankfurt) |
| Google (Gemini API) | Generating questionnaire answers | Question text and the retrieved excerpts used to answer it | United States |
| Anthropic | Fallback answer generation (configurable, not currently in use) | Question text and the retrieved excerpts used to answer it | United States |
| OpenAI | Text embeddings for retrieval | Document excerpts and question text | United States |
| Stripe | Payment processing | Billing details, email address | United States |
| Resend | Transactional email | Email addresses, notification content | United States |
| Google Analytics | Counting visits to public pages, for visitors who consent | Page address with single-use tokens removed, IP address, user agent | United States (EU-US Data Privacy Framework) |
| Cloudflare | DNS, CDN and DDoS protection | Request metadata (IP address, user agent) | Global edge network |
International transfers
Your documents are stored in the EU: object storage in Paris, database in Frankfurt. To answer a question, the relevant excerpts, not the whole document, are sent to Google and OpenAI in the United States. Those transfers rely on Standard Contractual Clauses. Neither provider trains models on data submitted through their APIs.
If EU-only processing is a requirement for you, get in touch before uploading anything.
See also our Data Processing Agreement, Privacy Policy and security overview.