Back to home

Subprocessors

Last updated: September 24, 2026

To provide the service, Databreizh relies on the providers listed below (GDPR, Article 28). This list is exhaustive: every entry matches a call that actually exists in the code, and a provider we do not use does not appear on it.

Hostinger International Ltd

Role :
Hosting of the application and the database
Where data is held :
France (serveurs) · Chypre (entité contractante)
Transfer basis :
Data hosted within the European Union

Resend

Role :
Transactional email (invitations, password reset, alerts)
Where data is held :
États-Unis
Transfer basis :
EU–US Data Privacy Framework, backed by standard contractual clauses

jsDelivr

Role :
Delivery of the API documentation portal
Where data is held :
Réseau de diffusion mondial
Transfer basis :
Standard contractual clauses (decision 2021/914)

Google Fonts

Role :
Fonts for social cards, fetched by our server
Where data is held :
États-Unis
Transfer basis :
No personal data transmitted: the call is made by our server, never by your browser

GitHub (GitHub, Inc.)

Role :
Distribution of signed collector releases
Where data is held :
États-Unis
Transfer basis :
No personal data transmitted: download only

dataplat/dbatools (index public)

Role :
Public catalogue of SQL Server builds
Where data is held :
États-Unis (hébergé par GitHub)
Transfer basis :
No personal data transmitted: download only

GlitchTip / Sentry

enabled by configuration

Role :
Application error monitoring
Where data is held :
[À COMPLÉTER — selon l’instance retenue]
Transfer basis :
Standard contractual clauses (decision 2021/914)

What is not on this list, and why

Four kinds of recipient exist without being our subprocessors:

  • The endpoints of the webhooks you configure: they receive what you decide, at the address you choose. They act on your instruction, not ours.
  • Your identity provider, if your organisation uses single sign-on: you choose it and you control it.
  • PDF reports are generated entirely on our own infrastructure, with networking disabled. No data reaches a third party in the process.
  • In an on-premises deployment, none of the providers above sees your data: the application runs on your infrastructure and we have no access to it.

Location and jurisdiction

The servers hosting the application and the database are located in France. Our hosting provider's contracting entity is established in Cyprus, therefore within the European Union. The infrastructure is accordingly subject to the law of a Member State.

No foreign authority has issued us an access request to date. Should one reach us, we would inform the affected customer as soon as possible unless legally barred from doing so, and would challenge its scope wherever the applicable law allows. Audit data is in any case encrypted at rest, with keys held outside the database.

Changes

Any addition or replacement of a subprocessor is notified to the customers concerned at least thirty days before it takes effect. During that notice period, a customer who objects may terminate without penalty.

Contact

For any question about this list or about transfers, write to contact@databreizh.fr