Sub-processors
Last updated: 2026-08-21
This is the canonical, machine-readable list of all third parties that may process personal data on Elevay's behalf. It is generated from src/data/dpas.json in our application source — the page can never drift from the actual configuration.
Notification policy. We will notify subscribed customers at least 30 days in advance of any new sub-processor. Subscribe at contact@elevay.app.
CLOUD Act column. "yes" means the sub-processor is headquartered in a jurisdiction (mainly the United States) whose law allows extraterritorial data requests regardless of where data is stored. Data residency in the EU does not eliminate CLOUD Act exposure when the operator is US-headquartered. This distinction is documented openly because it matters for sovereignty-sensitive customers.
| Provider | Purpose | Data residency | Operator jurisdiction | CLOUD Act | DPA |
|---|---|---|---|---|---|
| Anthropic We pin to the eu.anthropic.com endpoint. Operator remains US-headquartered. Zero data retention requested by default; data is not used to train Anthropic models per their commercial terms. | LLM inference for chat, lead scoring, email drafting | EU (eu.anthropic.com — Frankfurt) | United States (Anthropic PBC) | yes | available |
| Apollo.io Used only when the user actively triggers enrichment. Sovereign fallbacks already shipped and keyless: SIRENE (FR registry). Further migration targets, not yet integrated: Dropcontact (FR), Cognism (UK). Le lien publie renvoyait une 404 (mesure du 2026-08-20) ; corrige. Lien verifie (HTTP 200) le 2026-08-20. | Contact and company enrichment (B2B firmographic data) | United States | United States | yes | available |
| Calendly Omission corrigee le 2026-08-20. Le formulaire du hero ne stocke rien cote Elevay : il transmet nom et adresse a Calendly par parametres d'URL. C'est un transfert de donnees personnelles vers un tiers americain, donc un traitement a declarer, meme sans base de donnees chez nous. | Meeting booking: the name and email address entered in the site demo form are passed to prefill the booking page | United States | United States (Calendly LLC) | yes | available |
| Crunchbase Company-level data only (no personal data beyond public executive names). Activated only when an API key is configured. Statut retrograde le 2026-08-20 : annonce sans lien. Aucune clef en production, donc aucun traitement en cours — a etayer avant activation. | Company intelligence (funding, investors) — optional | United States | United States | yes | to confirm |
| Deepgram Streams call audio for transcription only; no retention requested. Active only during live calls. Statut retrograde le 2026-08-20 : la page annoncait « available » sans aucun lien, donc sans rien qu'un lecteur puisse verifier. Aucun DPA distinct n'a ete trouve ; le lien pointe la page legale qui existe. A reprendre aupres du fournisseur. | Real-time speech-to-text for live call transcription | United States | United States (Deepgram Inc.) | yes | to confirm |
| EmailEngine (self-hosted) Open-source software run by Elevay on its own EU/CH infrastructure. Not a third-party sub-processor. | IMAP sync for connected mailboxes | Self-hosted on Elevay infra | Self (Elevay) | no (when self-hosted on EU/CH infra) | n/a |
| FullEnrich Asynchronous enrichment via signed webhooks; activated only when configured and triggered. Statut retrograde le 2026-08-20 : la page annoncait « available » sans aucun lien, donc sans rien qu'un lecteur puisse verifier. Aucun DPA distinct n'a ete trouve ; le lien pointe la page legale qui existe. A reprendre aupres du fournisseur. | Waterfall contact enrichment (EU mobile/email) | EU (France) | France (FullEnrich SAS) | no | to confirm |
| Google (OAuth + Gmail API) Structurally non-substitutable: the user's own mailbox lives at Google. The user has already accepted Google's ToS. Access is not read-only: connecting a mailbox in Settings grants gmail.send and gmail.modify in addition to gmail.readonly. | Authentication via Google; read access to user mailbox and calendar (gmail.readonly, calendar.readonly, calendar.events); when a mailbox is connected in Settings, also send and mailbox-sync access (gmail.send, gmail.modify) | Global (Google Cloud) | United States (Google LLC) | yes | available |
| Infomaniak Omission corrigee le 2026-08-20 : actif en production (INFOMANIAK_API_TOKEN + INFOMANIAK_DRIVE_ID). Operateur et infrastructure suisses, hors UE mais sous decision d'adequation, et sans exposition au Cloud Act. | File storage (Drive) for documents ingested by the product | Switzerland | Switzerland (Infomaniak Network SA, Geneva) | no | available |
| Inngest Sovereign migration target: BullMQ + Redis on Scaleway/Infomaniak (already partially in place in the worker app). Statut retrograde le 2026-08-20 : la page annoncait « available » sans aucun lien, donc sans rien qu'un lecteur puisse verifier. Aucun DPA distinct n'a ete trouve ; le lien pointe la page legale qui existe. A reprendre aupres du fournisseur. | Background job queue and workflow orchestration | United States | United States (Inngest Inc.) | yes | to confirm |
| Kaspr Used only when the user actively triggers phone enrichment. CNIL enforcement precedent (2024) tracked in our vendor reviews. Lien verifie (HTTP 200) le 2026-08-20. | Phone-number enrichment (FR-focused) | EU (France) | France (Kaspr SAS, Cognism group) | no | available |
| Lusha Israel holds an EU adequacy decision. Activated only on explicit enrichment requests. Lien verifie (HTTP 200) le 2026-08-20. | Phone-number and email enrichment (fallback) | United States / Israel | Israel (Lusha Systems Ltd.) | no | available |
| Microsoft (Entra + Graph + Outlook) Structurally non-substitutable: the user's own mailbox lives at Microsoft. The user has already accepted Microsoft's ToS. | Authentication via Microsoft, read-only access to Outlook mailbox + Graph calendar | Global (Microsoft 365) | United States (Microsoft Corp.) | yes | available |
| Microsoft Azure OpenAI Service Omission corrigee le 2026-08-20. /api/health en production repond llm=azure : c'est CE fournisseur qui voit le contenu client, pas OpenAI ni Anthropic, tous deux relegues au repli. Sous LLM_PROVIDER=azure les EMBEDDINGS y passent aussi (lib/ai/ai-provider.ts:184), ce que la fiche OpenAI decrivait encore comme sien. REGION MESUREE le 2026-08-21, plus supposee : elevay-foundry.openai.azure.com resout vers swedencentral.cloudapp.azure.com et l'endpoint repond `x-ms-region: Sweden Central`. Les deploiements sont en DataZoneStandard EU (verifie le 2026-08-18 sur la souscription sponsorship), donc l'inference reste dans la zone de donnees europeenne. La fiche disait auparavant « a confirmer dans le portail » : la reponse etait mesurable sans portail. Alternative souveraine : Mistral AI (FR), deja cablee via le routeur. | PRIMARY large-language model in production: drafting, classification, extraction, and text embeddings | EU — Sweden Central (resource elevay-foundry), deployments in DataZoneStandard EU | United States (Microsoft Corp.) | yes | available |
| Mistral AI Activated via LLM_PROVIDER=mistral. EU-capital and EU-hosted, no extraterritorial US exposure. | EU-sovereign LLM alternative (router-enabled) | EU (Mistral La Plateforme, FR) | France (Mistral AI SAS) | no | available |
| OpenAI Fiche corrigee le 2026-08-20 : elle annoncait les embeddings comme passant par ici, ce qui n'est plus le chemin de production. /api/health repond llm=azure, et sous ce reglage les embeddings partent chez Azure OpenAI (lib/ai/ai-provider.ts:184). OpenAI reste cable en repli. Transferts via CCT + mesures supplementaires (minimisation, aucun champ d'identite directe). Cible de migration souveraine : Mistral Embed (FR). | Text embeddings and LLM fallback | United States (no EU inference endpoint available) | United States | yes | available |
| Pappers EU-sovereign, preferred for FR lookups. The Hunter.io, Datagma and Firmable integrations named here previously were removed on 2026-08-17: their API keys were never configured, so no personal data ever reached them. Statut retrograde le 2026-08-20 : la page annoncait « available » sans aucun lien, donc sans rien qu'un lecteur puisse verifier. Aucun DPA distinct n'a ete trouve ; le lien pointe la page legale qui existe. A reprendre aupres du fournisseur. | Secondary enrichment (French company registry lookups) | France | France | no | to confirm |
| PostHog Pinned to EU Cloud. Loaded ONLY after explicit analytics consent (lib/consent.ts gates the SDK init); no cookie or storage key is written before that. Session replay masks every input and any element marked [data-sensitive] or .ph-no-capture. Sovereign alternative: Matomo Cloud (FR) or Plausible (EE) for fully EU-capital operator. | Product analytics: page views, click/scroll autocapture, session replay, and JavaScript error capture | EU (eu.i.posthog.com — Frankfurt) | United States (PostHog Inc.) | yes | available |
| Resend Sovereign migration target: Brevo (FR) or Mailjet (FR). | Transactional email (invites, password reset, alerts) | United States | United States (Resend Inc.) | yes | available |
| Sentry PII scrubbing enabled (sendDefaultPii=false, beforeSend hook). DSN must point to de.sentry.io for EU residency. | Error reporting and performance monitoring | EU (de.sentry.io — Frankfurt) when configured, US by default | United States (Functional Software Inc.) | yes | available |
| Stripe Required for card processing. EU customers are contracted under Stripe Payments Europe Ltd (Dublin). Sovereign alternative for SEPA-only: Mollie (NL), GoCardless. | Payment processing and subscription billing | United States (data flows) / Ireland (EU billing entity, Stripe Payments Europe Ltd) | United States with EU subsidiary (Ireland) | yes | available |
| Supabase Data residency in Frankfurt; operator is US-headquartered so US CLOUD Act applies. Sovereign migration target: Scaleway Managed DB (FR) or Infomaniak Postgres (CH). | Primary PostgreSQL database — customer CRM data, mailbox content, conversation history | EU (AWS eu-central-1, Frankfurt) | United States (Supabase Inc., Delaware) | yes | available |
| Twilio Pinned to the ie1 (Ireland) region. Recording is opt-in (default off) and recordings are deleted after the retention window (90 days by default). | Outbound voice calls, phone numbers, opt-in call recording | EU (region ie1, Dublin) for voice media when configured | United States (Twilio Inc.) | yes | available |
| Unipile Omission corrigee le 2026-08-20 : cable et actif en production (UNIPILE_API_KEY + UNIPILE_DSN) depuis ~35 jours. Traite des donnees personnelles de tiers (interlocuteurs LinkedIn), ce qui en fait l'un des sous-traitants les plus sensibles de la liste. Editeur et hebergement francais, sans exposition extraterritoriale americaine. Le DPA n'est pas publie : il s'obtient par formulaire. | LinkedIn and email account aggregation: messages, conversations, and contact profiles | France (Scaleway) | France (Unipile, 168 rue de la Rotonde, 42153 Riorges) | no | on request |
| Upstash Holds short-lived operational state, not durable customer records. | Redis cache (rate limiting, transient state) | EU (configured region) | United States (Upstash Inc.) | yes | available |
| Vercel Sovereign migration target: Clever Cloud (FR), Scaleway Serverless, or Infomaniak Cloud Server. | Application hosting, edge functions, scheduled crons | Global (US primary, EU edges available) | United States (Vercel Inc.) | yes | available |
| Winnr Software LLC Omission corrigee le 2026-08-20 : actif en production (WINNR_API_TOKEN), api.winnr.app/v1. POINT D'ATTENTION REEL, pas une formalite : ce fournisseur detient les identifiants SMTP des boites d'envoi, et il ne publie NI DPA NI liste de sous-traitants NI pays d'immatriculation (verifie le 2026-08-20). Un DPA signe doit lui etre demande avant tout envoi pour un client. | Provisioning of the tenant sending fleet: mailboxes, SMTP credentials, DKIM/SPF/DMARC, warmup | Not published | Not published (the site names Winnr Software LLC without a country of incorporation) | unknown | none published |
| Zeliq Asynchronous enrichment via signed webhooks; activated only when configured and triggered. Statut retrograde le 2026-08-20 : la page annoncait « available » sans aucun lien, donc sans rien qu'un lecteur puisse verifier. Aucun DPA distinct n'a ete trouve ; le lien pointe la page legale qui existe. A reprendre aupres du fournisseur. | Contact enrichment (async) | EU (France) | France (Zeliq SAS) | no | to confirm |
Subscribe to sub-processor change notifications
Email contact@elevay.app with subject "subscribe sub-processor notifications" to receive 30-day advance notice of any new sub-processor.
See the Privacy Policy for legal bases, retention and data subject rights, and the Security page for technical controls.