Sub-processors
Last updated: 2026-09-29
We use the following sub-processors to run Couac. We'll announce changes here at least 30 days before they take effect.
| Provider | Purpose | Location | Safeguards |
|---|---|---|---|
| PulseHeberg | Hosting of the application server, Postgres database, Redis (rate limiting) and encrypted backups | France (Toulon) | DPA, French sovereign hosting |
| OVHcloud | Object storage for screenshots and attachments | France (Paris, eu-west-par region) | DPA, French sovereign hosting |
| Cloudflare | DNS, CDN proxy and Turnstile captcha | EU + global edge | DPA + SCCs |
| Amazon SES | Transactional email delivery (magic link, notifications) | France (eu-west-3 region, Paris), AWS group (United States) | DPA, Standard Contractual Clauses (SCCs), Data Privacy Framework |
| Stripe | Payment processing and subscription billing | United States / Ireland (Stripe Payments Europe) | Standard Contractual Clauses, PCI-DSS Level 1 certified |
| Mistral AI | Transcription of video microphone audio to complete the feedback description. The microphone can be disabled before recording. | European Union by default; potential transfers governed by Mistral’s DPA. | Data processing agreement; training disabled; zero data retention enabled for stateless transcription API calls. Safeguards to be reviewed before feature activation. |