A sub-processor is a third party that UPRASET (“Upra”) engages to process personal data on behalf of its customers in order to provide the Upra service. This page lists them, explains what each one does, and describes how we notify customers of changes. It forms part of the Privacy Policy and the Data Processing Agreement.
1. How we select sub-processors
- European first. Hosting, databases, backups, AI inference and transactional email run in the European Union, with Scaleway (France). We only use a provider outside the EEA where no equivalent EU option exists, and then with an adequacy decision or Standard Contractual Clauses plus additional safeguards.
- Least data. Each sub-processor receives only the data strictly necessary for its purpose.
- Contractual safeguards. Every sub-processor is bound by a written data-processing agreement with confidentiality, security, audit and deletion obligations at least as protective as ours.
- No training. AI providers are contractually prohibited from using customer data to train or improve their models.
- Due diligence. We review security documentation and certifications before onboarding and periodically thereafter.
2. Current sub-processors
| Sub-processor | Purpose | Location |
|---|---|---|
| Scaleway SAS | Website and application hosting, databases, backups | France (EU) |
| Scaleway SAS | AI model inference (Upra-managed models on European cloud) | France (EU) |
| Scaleway SAS (Transactional Email) | Transactional email delivery | France (EU) |
| Mollie B.V. | Payment processing | Netherlands (EU) |
| Exa Labs, Inc. | Web search for AI research and company/contact enrichment (search queries only) | United States (Standard Contractual Clauses) |
About Exa: Exa is a web-search API. It receives search queries (such as a company name or website domain) and returns public web results; it never receives email content, calendar events, documents or contact lists. Transfers to the United States are covered by the Standard Contractual Clauses.
Customers who bring their own AI model (Enterprise option) contract directly with that provider; it is then not an Upra sub-processor.
3. Infrastructure sub-processors
Infrastructure sub-processors host the Upra application, databases, files and backups. All production infrastructure is located in the European Union. Tenant isolation is enforced at the database layer and tested in continuous integration (see Security & Sovereignty).
4. Service-specific sub-processors
Service-specific sub-processors are only engaged when a customer uses the corresponding feature: payment processing when a paid plan is activated, transactional email for notifications, AI processing for AI features, and enrichment providers when enrichment is enabled in the workspace. Connected accounts (Google Workspace, Microsoft 365, WhatsApp, LinkedIn, SMS, Telegram) are chosen and authorised by the customer’s users; the corresponding providers act as independent controllers or processors under their own terms.
5. Changes and notification
Before adding or replacing a sub-processor that processes customer personal data, we update this page and notify workspace administrators by email at least 30 days in advance. Customers may object on reasonable data-protection grounds within that period; if we cannot address the objection, the customer may terminate the affected subscription and receive a pro-rata refund of prepaid fees. Removals and non-material updates (for example a change of address) are published without prior notice.
To receive change notifications at an additional address, write to support@upra.ai.
6. Contact
UPRASET
293/295 boulevard Saint-Denis
92400 Courbevoie
France
Privacy: support@upra.ai
Legal (DPA requests): support@upra.ai