List of Subsequent Subprocessors - Octopussian
Last updated: April 28, 2026
Purpose
This document lists the subsequent subprocessors that Octopussian (SAS, RCS Paris 981 982 358) engages in order to provide its Services, in accordance with Article A.6 of the DPA (Annex A of the Terms and Conditions).
Changes
Any change to this list (addition, replacement, or removal of a subprocessor) will be notified to Account Holders by email or in-app message, with thirty (30) days' prior notice. During this period, the Customer may raise reasoned objections based on GDPR compliance, under the conditions set out in Article A.6 of the Terms and Conditions.
If a legitimate objection cannot be resolved by Octopussian, the Customer may terminate the affected Service without penalty on either side, effective as of the date the change takes effect.
Subprocessors
| Subprocessor | Processing activity | Processing location | Transfer mechanism (if outside the EU) |
|---|---|---|---|
| OVHcloud (OVH SAS, France) - dpa | Hosting of application servers, databases, backups, and object storage (S3) | European Union (France) | N/A |
| Stripe (Stripe Payments Europe Ltd, Ireland; Stripe, Inc., United States) - dpa | Payment processing, fraud prevention, strong authentication, billing | European Union with incidental transfers to the United States for compliance and fraud prevention purposes | EU-US Data Privacy Framework (adequacy decision (EU) 2023/1795) and, supplementarily, Standard Contractual Clauses Modules 1 and 2 via Data Transfers Addendum (stripe.com/legal/dta) |
| Mistral AI (Mistral AI SAS, France) | Artificial intelligence features (knowledge bases, summaries, rephrasing) | European Union | Standard Contractual Clauses applicable where a subsequent subprocessor outside the EU is used |
| Brevo (Sendinblue SAS, France) - dpa | Transactional email delivery | European Union | Standard Contractual Clauses applicable where a subsequent subprocessor outside the EU is used |
| ipregistry (Elaunira SARL, operating the ipregistry service, Cagnes-sur-Mer, France) - dpa | IP geolocation for security purposes | European Union | Standard Contractual Clauses applicable where a subsequent subprocessor outside the EU is used |
| bunny.net (BunnyWay d.o.o., Slovenia) - dpa | Static content delivery (CDN) | European Union | N/A |
| EmailListVerify (CyberPanda s.r.o., Slovakia) - dpa | Syntactic and deliverability verification of email addresses entered during sign-up | European Union | Standard Contractual Clauses applicable where a subsequent subprocessor outside the EU is used |
| Certigna (Dhimyotis SAS, France) | Qualified electronic seal for electronic signature (cryptographic fingerprints only) | European Union | N/A |
| Alfasign (Alfatrust Certification S.A., Romania) | Qualified electronic timestamping for electronic signature (cryptographic fingerprints only) | European Union | N/A |
| Stape (Stape Europe OÜ, Estonia) | Server-side tagging for the transmission of analytics and advertising data to partner platforms (Google Analytics 4, Meta, LinkedIn) — only for visitors to the commercial website who have consented to tracking | European Union | DPA of Stape Europe OÜ, which contractually governs its own subprocessors |
Note on software components running on Octopussian's infrastructure
The Services rely, for certain features (including video conferencing), on third-party software components that are deployed and run exclusively on Octopussian's infrastructure, hosted within the European Union. These software components have no access to the Customer's personal data; any technical identifiers exchanged with their publishers (license numbers, opaque identifiers) cannot be used to identify any data subject. As such, these publishers are not subsequent subprocessors within the meaning of the GDPR.