Subprocessors
Draft document — to be reviewed by a lawyer.
To provide the service, WYRLO relies on the providers below (those marked “Coming soon” are not used yet). For each one: its role, the data it processes, where it is processed and its data processing terms.
Vercel
- Role
- Hosting the interface (public website and customer area).
- Data concerned
- No trace data is analysed or stored at Vercel. Passing through its functions: account data and credentials entered at sign-in or sign-up, invited people’s email addresses, the API key when it is created, and traces shown in the customer area (masked if masking is enabled). IP addresses and request logs: [retention period at Vercel TO BE VERIFIED].
- Processing location
- Functions: cdg1 region (Paris). Static files: Vercel’s global network. US company (Vercel Inc.): transfers covered by its data processing addendum, which applies to the Pro and Enterprise plans [plan used by WYRLO: TO BE VERIFIED].
- Data processing terms
- Vercel data processing addendum
Supabase
- Role
- Database, authentication and functions (ingestion API, nightly loop).
- Data concerned
- Accounts, organisations, invitations, API keys (fingerprint and visible start of the key), traces (masked before storage if masking is enabled, which is the default), nightly loop analyses, activity log.
- Processing location
- Database: eu-west-3 region (Paris). Functions (ingestion API, nightly loop): eu-west-3 region (Paris) when the call sets the region with the x-region header, as the SDKs and the nightly loop do; without this header, the region closest to the caller. Contracting entity: Supabase Pte. Ltd. (Singapore). Its privacy notice mentions possible transfers to the United States and Singapore for some service data.
- Data processing terms
- Supabase data processing addendum
Resend
- Role
- Sending authentication and security emails: sign-up confirmation, sign-in link, password reset, email change, verification code and, if enabled, security alerts [activation: TO BE VERIFIED].
- Data concerned
- Recipient email address and email content.
- Processing location
- United States (storage), by Plus Five Five, Inc. (Resend). Transfers covered by standard contractual clauses and the EU–US Data Privacy Framework, according to its data processing addendum.
- Data processing terms
- Resend data processing addendum
Cloudflare
- Role
- Anti-bot check (Turnstile) on the sign-in, sign-up and forgot password forms.
- Data concerned
- Technical signals needed for the check: IP address, TLS fingerprint, User-Agent header, site key and origin.
- Processing location
- Cloudflare, Inc. (United States); processing location [TO BE VERIFIED].
- Data processing terms
- Turnstile Privacy Addendum
OVHcloud
- Role
- Inference server (inference.wyrlo.io): reranking, verification, injection detection, masking. Server configured, not in service yet [go-live date: TO BE VERIFIED].
- Data concerned
- Trace texts (question, passages, answer), processed without storage [TO BE VERIFIED]; access logs [14-day period: TO BE VERIFIED].
- Processing location
- France, OVH SAS (Roubaix); server data centre [TO BE VERIFIED].
- Data processing terms
- OVH SAS data processing annex (PDF, in French)
Mistral AI
- Role
- AI models via API.
- Data concerned
- Trace excerpts during processing, if WYRLO uses it [no decision taken yet].
- Processing location
- Mistral AI (Paris, France); inference is guaranteed to stay in the European Union only through its EU endpoint.
- Data processing terms
- Mistral AI data processing addendum
Stripe
- Role
- Subscription payments.
- Data concerned
- Billing data.
- Processing location
- [TO BE VERIFIED]
- Data processing terms
- [TO BE VERIFIED]
Customers are informed of any change of subprocessor [notice period and method: TO BE COMPLETED].
[Any transfers of data outside the European Union and the related safeguards: TO BE VERIFIED for each provider.]
See also the privacy policy and the data processing agreement.