Sub-processors
Who processes your data, and where
Every company that processes customer data on our behalf, for your purchase file, and a data processing agreement you can sign before paying.
Last updated 8 October 2026
Data processing agreement
A DPA you can sign before paying
Pre-filled under Article 28(3) GDPR with TerraLab as processor. Complete the controller block, sign it and send it to our privacy contact. Its sub-processor list points to our sub-processors page, so it stays current without a new signature.
The founders complete the SIREN and address lines before countersigning. Bespoke terms take a call.
Sub-processors
Every company that processes customer data for us
Nobody else touches it. Sales and internal tools that receive no plugin or account data are not listed.
| Purpose | Company | Country | Hosting region | Transfer mechanism | Retention |
|---|---|---|---|---|---|
| Database and authentication | Supabase | USA company, EU hosting | AWS Paris (eu-west-3) | Data stays in the EU | Life of the account, plus 15 days after deletion. Encrypted backups expire within 12 months |
| Images and files | Google Cloud Storage | USA company, EU hosting | Paris (europe-west9) | Data stays in the EU | Life of the account, erased on deletion or earlier on request |
| AI Segmentation inference | Google Cloud Run | USA company, EU hosting | Belgium (europe-west1) | Data stays in the EU | In memory, no copy after the request. Upload staging empties after 7 days |
| AI Agent language model | Microsoft Azure OpenAI | USA company, EU hosting | EU data zone (westeurope) | Data stays in the EU | Prompts may be kept up to 30 days for abuse monitoring until our exemption is granted; never used to train models |
| AI Agent server | Microsoft Azure Container Apps | USA company, EU hosting | West Europe (westeurope) | Data stays in the EU | One diagnostic file per run, 90 days; Pro, 30 days, none at 0 days of history |
| AI Edit image generation | Google Vertex AI | USA company | Worldwide (global endpoint) | EU-US Data Privacy Framework | Not stored after the request (held in memory up to 24 hours). Google may log prompts up to 90 days for abuse monitoring, never to train models |
| Website and API hosting | Vercel | USA company | Paris (cdg1) | EU-US Data Privacy Framework | Hosting only, no customer file stored |
| Product analytics | PostHog | USA company, EU hosting | Frankfurt | Data stays in the EU | 25 months at most |
| Transactional and product emails | Loops | USA | United States | EU-US Data Privacy Framework | Contact erased with the account |
| Rate limiting | Upstash | USA company, EU hosting | Ireland | Data stays in the EU | One counter per account or IP address, kept 65 seconds |
| Website translation | Google Translate API | USA company | EU/US | EU-US Data Privacy Framework | Not stored; page text only |
| Payments | Stripe | USA company, EU entity | EU/US | EU-US Data Privacy Framework | 10 years for invoices, French accounting law |
Any new or replaced sub-processor is announced here 30 days before it takes effect. Customers with a signed DPA may object in writing within that period.
Questions
Security questionnaires and supplier files
Send them, or a signed DPA, to yvann.barbot@terra-lab.ai. We answer within two working days.
yvann.barbot@terra-lab.ai