List of Subsequent Subprocessors - Octopussian
Last updated: April 28, 2026
Purpose
This document lists the subsequent subprocessors that Octopussian (SAS, RCS Paris 981 982 358) uses to deliver its Services, in accordance with Article A.6 of the DPA (Annex A of the Terms and Conditions).
Changes
Any change to this list (addition, replacement, or removal of a subprocessor) will be communicated to Account Holders by email or in-app notification, with thirty (30) days' prior notice. During this period, the Customer may raise reasoned objections based on GDPR compliance, under the conditions set out in Article A.6 of the Terms and Conditions.
If a legitimate objection cannot be resolved by Octopussian, the Customer may terminate the affected Service without penalty from either party, effective as of the date the change takes effect.
Subprocessors
| Subprocessor | Service provided | Processing location | Transfer mechanism (if outside the EU) |
|---|---|---|---|
| OVHcloud (OVH SAS, France) | Hosting of application servers, databases, backups, and object storage (S3) | European Union (France) | N/A |
| Stripe (Stripe Payments Europe Ltd, Ireland; Stripe, Inc., United States) | Payment processing, fraud prevention, strong authentication, billing | European Union, with incidental transfers to the United States for compliance and fraud prevention purposes | EU-US Data Privacy Framework (adequacy decision (EU) 2023/1795) and, supplementarily, Standard Contractual Clauses Modules 1 and 2 via the Data Transfers Addendum (stripe.com/legal/dta) |
| Mistral AI (Mistral AI SAS, France) | Artificial intelligence features (knowledge bases, summaries, rephrasing) | European Union | Standard Contractual Clauses applicable if a subsequent subprocessor outside the EU is engaged |
| Brevo (Sendinblue SAS, France) | Transactional email delivery | European Union | Standard Contractual Clauses applicable if a subsequent subprocessor outside the EU is engaged |
| ipregistry (Elaunira SARL, operating the ipregistry service, Cagnes-sur-Mer, France) | IP geolocation for security purposes | European Union | Standard Contractual Clauses applicable if a subsequent subprocessor outside the EU is engaged |
| bunny.net (BunnyWay d.o.o., Slovenia) | Static content delivery (CDN) | European Union | N/A |
| EmailListVerify (CyberPanda s.r.o., Slovakia) | Syntactic and deliverability verification of email addresses entered at registration | European Union | Standard Contractual Clauses applicable if a subsequent subprocessor outside the EU is engaged |
| Certigna (Dhimyotis SAS, France) | Qualified electronic seal for electronic signatures (cryptographic hashes only) | European Union | N/A |
| Alfasign (Alfatrust Certification S.A., Romania) | Qualified electronic timestamping for electronic signatures (cryptographic hashes only) | European Union | N/A |
| Stape (Stape Europe OÜ, Estonia) | Server-side tagging for transmitting analytics and advertising data to partner platforms (Google Analytics 4, Meta, LinkedIn) — only for visitors to the marketing website who have consented to tracking | European Union | Stape Europe OÜ's DPA, which contractually governs its own subprocessors |
Note on software components running on Octopussian's infrastructure
Some Services rely, for certain features (including video conferencing), on third-party software components that are deployed and run exclusively on Octopussian's infrastructure, hosted within the European Union. These software components have no access to the Customer's personal data; any technical identifiers exchanged with their publishers (license numbers, opaque identifiers) do not allow the identification of any data subject. As such, these publishers do not qualify as subsequent subprocessors within the meaning of the GDPR.