Sub-processors

Who processes your data, and where

Every company that processes customer data on our behalf, for your purchase file, and a data processing agreement you can sign before paying.

Last updated 8 October 2026

Read the full privacy policy Security measures and what each plugin sends

Data processing agreement

A DPA you can sign before paying

Pre-filled under Article 28(3) GDPR with TerraLab as processor. Complete the controller block, sign it and send it to our privacy contact. Its sub-processor list points to our sub-processors page, so it stays current without a new signature.

Download the DPA (PDF, September 2026)The same text as Markdown

The founders complete the SIREN and address lines before countersigning. Bespoke terms take a call.

Sub-processors

Every company that processes customer data for us

Nobody else touches it. Sales and internal tools that receive no plugin or account data are not listed.

Supabase
Database and authentication
Country
USA company, EU hosting
Hosting region
AWS Paris (eu-west-3)
Transfer mechanism
Data stays in the EU
Retention
Life of the account, plus 15 days after deletion. Encrypted backups expire within 12 months
Google Cloud Storage
Images and files
Country
USA company, EU hosting
Hosting region
Paris (europe-west9)
Transfer mechanism
Data stays in the EU
Retention
Life of the account, erased on deletion or earlier on request
Google Cloud Run
AI Segmentation inference
Country
USA company, EU hosting
Hosting region
Belgium (europe-west1)
Transfer mechanism
Data stays in the EU
Retention
In memory, no copy after the request. Upload staging empties after 7 days
Microsoft Azure OpenAI
AI Agent language model
Country
USA company, EU hosting
Hosting region
EU data zone (westeurope)
Transfer mechanism
Data stays in the EU
Retention
Prompts may be kept up to 30 days for abuse monitoring until our exemption is granted; never used to train models
Microsoft Azure Container Apps
AI Agent server
Country
USA company, EU hosting
Hosting region
West Europe (westeurope)
Transfer mechanism
Data stays in the EU
Retention
One diagnostic file per task, 90 days; Pro, 30 days, none at 0 days of history
Google Vertex AI
AI Edit image generation
Country
USA company
Hosting region
Worldwide (global endpoint)
Transfer mechanism
EU-US Data Privacy Framework
Retention
Not stored after the request (held in memory up to 24 hours). Google may log prompts up to 90 days for abuse monitoring, never to train models
Vercel
Website and API hosting
Country
USA company
Hosting region
Paris (cdg1)
Transfer mechanism
EU-US Data Privacy Framework
Retention
Hosting only, no customer file stored
PostHog
Product analytics
Country
USA company, EU hosting
Hosting region
Frankfurt
Transfer mechanism
Data stays in the EU
Retention
25 months at most
Loops
Transactional and product emails
Country
USA
Hosting region
United States
Transfer mechanism
EU-US Data Privacy Framework
Retention
Contact erased with the account
Upstash
Rate limiting
Country
USA company, EU hosting
Hosting region
Ireland
Transfer mechanism
Data stays in the EU
Retention
One counter per account or IP address, kept 65 seconds
Google Translate API
Website translation
Country
USA company
Hosting region
EU/US
Transfer mechanism
EU-US Data Privacy Framework
Retention
Not stored; page text only
Stripe
Payments
Country
USA company, EU entity
Hosting region
EU/US
Transfer mechanism
EU-US Data Privacy Framework
Retention
10 years for invoices, French accounting law

Purpose	Company	Country	Hosting region	Transfer mechanism	Retention
Database and authentication	Supabase	USA company, EU hosting	AWS Paris (eu-west-3)	Data stays in the EU	Life of the account, plus 15 days after deletion. Encrypted backups expire within 12 months
Images and files	Google Cloud Storage	USA company, EU hosting	Paris (europe-west9)	Data stays in the EU	Life of the account, erased on deletion or earlier on request
AI Segmentation inference	Google Cloud Run	USA company, EU hosting	Belgium (europe-west1)	Data stays in the EU	In memory, no copy after the request. Upload staging empties after 7 days
AI Agent language model	Microsoft Azure OpenAI	USA company, EU hosting	EU data zone (westeurope)	Data stays in the EU	Prompts may be kept up to 30 days for abuse monitoring until our exemption is granted; never used to train models
AI Agent server	Microsoft Azure Container Apps	USA company, EU hosting	West Europe (westeurope)	Data stays in the EU	One diagnostic file per task, 90 days; Pro, 30 days, none at 0 days of history
AI Edit image generation	Google Vertex AI	USA company	Worldwide (global endpoint)	EU-US Data Privacy Framework	Not stored after the request (held in memory up to 24 hours). Google may log prompts up to 90 days for abuse monitoring, never to train models
Website and API hosting	Vercel	USA company	Paris (cdg1)	EU-US Data Privacy Framework	Hosting only, no customer file stored
Product analytics	PostHog	USA company, EU hosting	Frankfurt	Data stays in the EU	25 months at most
Transactional and product emails	Loops	USA	United States	EU-US Data Privacy Framework	Contact erased with the account
Rate limiting	Upstash	USA company, EU hosting	Ireland	Data stays in the EU	One counter per account or IP address, kept 65 seconds
Website translation	Google Translate API	USA company	EU/US	EU-US Data Privacy Framework	Not stored; page text only
Payments	Stripe	USA company, EU entity	EU/US	EU-US Data Privacy Framework	10 years for invoices, French accounting law

Any new or replaced sub-processor is announced here 30 days before it takes effect. Customers with a signed DPA may object in writing within that period.

Questions

Security questionnaires and supplier files

Send them, or a signed DPA, to yvann.barbot@terra-lab.ai. We answer within two working days.

yvann.barbot@terra-lab.ai