← Back
Sub-processors
Last updated: 2026-05-17
In line with GDPR art. 28 and partner-platform sub-processor obligations (DPA), Fleuret AI maintains the exhaustive list of its sub-processors below. Any addition or change is notified in writing to customers 30 days in advance, at the contractual email address.
Active sub-processors
| Vendor | Country | Purpose | Data processed | DPA |
|---|---|---|---|---|
| Scaleway SAS | 🇫🇷 France (Paris) | Application hosting, PostgreSQL database, LLM inference (gpt-oss, Kimi K2.5) on H100 GPUs | Customer data (workspaces, scans, findings, reports), tenant metadata | Link |
| Supabase, Inc. | 🇪🇺 EU (eu-west-3, Frankfurt) | Authentication, central database (profiles, billing, metadata), Edge Functions | User credentials, sessions, billing data | Link |
| Vercel, Inc. | 🇫🇷 fra1 (Paris) | Static frontend hosting fleuret.ai + serverless API functions | Navigation metadata. No sensitive customer data. | Link |
| Resend | 🇪🇺 EU | Transactional email (findings notifications, report-ready alerts) and the monthly digest to newsletter subscribers | Recipient email addresses, send metadata | Link |
| Make.com (Celonis) | 🇨🇿 Czech Republic (EU) | Airtable → Google Sheets sync for internal pipeline | No customer data. Internal commercial metadata only. | Link |
| Slack Technologies (Salesforce) | 🇺🇸 United States | Internal team communication | No customer data. Internal communications only. | Link |
| Granola | 🇺🇸 United States | Internal meeting notes | No customer data. Internal notes only. | Link |
| Google LLC (Google Analytics 4) | 🇺🇸 United States (EU endpoint) | Audience measurement on fleuret.ai. Loaded only after Google Analytics is accepted in the cookie banner: no request before. | Navigation metadata (page views, session duration, browser). No customer data. | Link |
| Microsoft Corporation (Clarity) | 🇺🇸 United States | Heatmaps and session recording (mouse movement, clicks, scroll) on fleuret.ai. Form fields masked by default. Loaded only after acceptance in the cookie banner. | Aggregated UI interactions. No form input captured. No product-platform customer data. | Link |
| PostHog Inc. (PostHog EU) | 🇪🇺 EU (US company) | Usage analytics on fleuret.ai (clicks, journeys, conversions), through the z.fleuret.ai proxy to PostHog's European instance. Loaded only after acceptance in the cookie banner. | Browsing events on the marketing site. No product-platform customer data. | Link |
| Google (Google Workspace) | 🇺🇸 United States | Team email and calendar. Demo bookings are stored there (calendar invitation, internal alert email). | Name, work email and company of people booking a demo. | Link |
| Google Ireland Limited (Google Ads) | 🇮🇪 Ireland (EU) | Ad conversion measurement: whether a demo request followed a click on a Fleuret ad. Enabled only after ad measurement is accepted in the cookie banner. No targeting, no remarketing (ad_personalization stays denied). | Ad click identifier and conversion event. No product-platform customer data. | Link |
| Attio Ltd | 🇬🇧 United Kingdom | CRM: receives demo requests (name, work email, company) and, if ad measurement was accepted, how the visit started. | Business contact details of demo requesters. No product-platform customer data. | Link |
Under evaluation (Q3 2026)
- Stripe (EU) · Customer billing + card payments
- Plain (EU) · Customer support (Q3 2026)
- Sentry (EU) · Application error monitoring
Data residency
- Customer data (workspaces, scans, findings, reports): stored exclusively in France (Scaleway Paris) and the EU region (Supabase eu-west-3).
- LLM inference: open-weight models (gpt-oss, Kimi K2.5) served on Scaleway GPU France. No third-party LLM API calls (OpenAI, Anthropic, Google).
- Frontend / API: Vercel fra1 region (Paris).
- Transactional email: Resend EU region.
- Backups: AES-256 encrypted, stored on Scaleway France (geographically separated zone).
GDPR safeguards
- All listed sub-processors have a signed DPA with Fleuret AI matching EU Standard Contractual Clauses.
- For non-EU sub-processors (Slack, Granola, internal data only), Fleuret applies GDPR-compliant transfer mechanisms (2021 SCCs + transfer impact assessment).
- No sub-processor processes personally identifiable customer data outside the EU.
Change notification
- Active customers: email at the contractual address, 30 days before the change takes effect.
- Distribution partners under MSA: extra notification to the partner's technical contact.
- Public: this page is updated.
Contact
- Sub-processor questions: privacy@fleuret.ai
- Responsible disclosure: security@fleuret.ai