Tebelis AI — Sub-processors
This list reflects the vendors and hosting regions used to provide the Service. It forms part of the DPA (Annex III) and is referenced by the Privacy Policy.
Last updated: 1 October 2026
Tebelis AI (173 rue de Courcelles, 75017 Paris, France) engages the following sub-processors to provide the Service. Each is bound by data-protection terms substantially equivalent to our DPA.
| Sub-processor | Service / purpose | Data processed | Hosting region | Transfer safeguard |
|---|---|---|---|---|
| Amazon Web Services (AWS) | Cloud hosting: application servers (Elastic Beanstalk), primary database (RDS PostgreSQL), file and object storage, and transactional email (Amazon SES) for verification, password reset and workflow notifications | All Customer Data at rest and in processing; for email, the recipient's name and address and the email content | EU region | Within EEA (EU region) |
| Cloudflare (Cloudflare, Inc., US) | DNS, CDN, TLS, and edge security (WAF) in front of the Service | Network/traffic metadata, IP addresses; data in transit | Global edge (incl. EU) | EU SCCs |
| Stripe (EU contracting entity Stripe Payments Europe, Ltd., Ireland) | Subscription billing and payment processing | Billing contact and subscription data; card details are handled by Stripe (Tebelis AI does not store card numbers) | EU contracting entity in Ireland; processing is global (including by Stripe, LLC in the US), so payment data is not EU-resident | EEA SCCs (Modules 1–3) + EU-US Data Privacy Framework; lead supervisory authority: Irish Data Protection Commission |
| Amazon Bedrock (AWS managed AI service — running Anthropic Claude models) | Managed AI features (for example the assistant, summaries and insights): processes prompts and workspace context to generate output | Prompts and the relevant Customer Data context sent for an AI request, including images and documents (such as PDFs) that a user attaches to an AI conversation or asks the AI to read; not used to train models. Bedrock does not share request content with the model provider. | EU (Amazon Bedrock EU cross-region inference: each request is processed in one of AWS's EU regions) | Within EEA (EU regions) |
| Sentry (Functional Software, Inc. dba Sentry — US) | Application error monitoring: captures crash and error events to alert on and diagnose faults (server, web app and mobile app) | Diagnostic/technical data: error messages, stack traces, breadcrumbs, app release, device/OS/browser metadata. Before an event is sent, the user's email address, IP address and username, and request bodies, cookies and headers, are removed from it. | EU (Frankfurt) data region | EU-region storage; for the US-incorporated vendor, EU SCCs + EU-US Data Privacy Framework (Functional Software, Inc. is DPF self-certified: EU-US, UK Extension and Swiss-US) |
| Expo (Expo, Inc. — US) | Mobile push-notification delivery for the field app (Expo push service), and delivery of app-code updates (EAS Update — the app checks for updated application code at launch) | Push: device push token, device platform, and the notification title/body in transit (short workflow references — e.g. a record code and hand-off status; no form contents). Updates: device IP, app runtime version, update channel and update id; no customer content | Global (US-based) | EU SCCs via Expo's data-processing terms |
| Google Firebase Cloud Messaging (Google Ireland Ltd / Google LLC) | Android push transport (FCM) — final delivery of push notifications to Android devices | Push routing token and the notification payload in transit | Global | EU SCCs + EU-US Data Privacy Framework (Google LLC is DPF-certified) |
| Microsoft (Microsoft Ireland Operations Ltd / Microsoft Corporation) | Single sign-on (Microsoft Entra ID), used only when a user chooses to sign in with Microsoft or the user's workspace requires Microsoft sign-in | The sign-in exchange only: Microsoft returns the signing-in user's email address, name and Microsoft account identifiers. No records, form contents, attachments or workspace context are sent to Microsoft. | Global; EU contracting entity in Ireland | EU SCCs + EU-US Data Privacy Framework (Microsoft Corporation is DPF-certified). Where the user's organisation has its own Microsoft tenant, Microsoft also acts under that organisation's own agreement with Microsoft. |
Bring-your-own AI keys: where a Customer connects its own AI provider, that provider is engaged by the Customer (not a Tebelis AI sub-processor), and that processing is governed by the Customer's agreement with it.
Other third-party services
Two further services, both run by the OpenStreetMap Foundation ("OSMF"), are not in the table above. They are public services used under OSMF's published usage policies, without a data-processing agreement, so they are not bound by data-protection terms in the way the sub-processors are. They are listed here for completeness:
| Service | When it is called | What is sent | Hosting |
|---|---|---|---|
| Nominatim — address lookup (server-side) | Only when a user asks for a project's site address to be located (the Locate button in the project's settings), to turn it into map coordinates. Never automatically. | The address typed into the site address field. The request is sent from our server, so OSMF sees our server's IP address and an identifying User-Agent, not the user's. No records, form contents, user names or account data. | OSMF infrastructure (UK / EU) |
| OpenStreetMap map tiles — embedded map (in the user's browser) | Automatically, when a user views a record with a geotagged photo, or opens the settings of a project that has map coordinates. Photo coordinates exist only for photos uploaded while the workspace had photo location capture turned on (off by default). | Loaded directly by the viewer's browser, so OSMF receives that user's IP address and browser User-Agent, and the coordinates shown on the map (a photo's GPS position or the project's site location). | OSMF infrastructure (UK / EU); map tiles are delivered through a global content-delivery network, so a tile request may be served from outside the EU |
A site address normally identifies premises rather than a person, although the field is free text. The embedded map loads in the user's browser rather than on our server, so OSMF receives the viewing user's IP address together with the coordinates shown on the map. No other account or record data is sent to OSMF.
Both services are optional. Photo coordinates are captured only while the workspace has photo location capture turned on (off by default), and a photo map is shown only for photos captured that way. The address lookup runs only when a user asks for it (the Locate button); coordinates can instead be entered by hand, or left empty, in which case the project shows no map and is not suggested as the nearest site in the mobile app. If your organisation has concerns about either service, contact us at [email protected].
Changes: we give prior notice of new or replacement sub-processors and an objection window as set out in DPA §6. To be notified of changes, email [email protected] to subscribe to sub-processor updates.