List of Subprocessors
Version: v1.0 — Last updated: May 1, 2026
This list identifies the subprocessors engaged by DECALAB EURL to provide the Elron Service, operated on the elron.ai domain. It forms Appendix 3 to the DPA and is kept up to date. Customers receive advance notice of changes in accordance with Section 9 of the DPA.
1. Hosting and infrastructure
| Subprocessor | Purpose | Categories of data | Location | Safeguards |
|---|---|---|---|---|
| Google Cloud EMEA Limited (Google Cloud Platform) | Application hosting, database, file storage, and AI agent processing | All categories of Data | European Union | Google Cloud DPA; ISO 27001 / 27017 / 27018, SOC 1/2/3, and PCI-DSS certifications |
2. Email connectors
| Subprocessor | Purpose | Categories of data | Location | Safeguards |
|---|---|---|---|---|
| Google LLC (Gmail API, Google OAuth 2.0) | Reading, updating, and sending email through users’ connected Gmail accounts; OAuth authentication | OAuth tokens, email metadata and content, attachments | EU / United States | User OAuth and consented scopes; Google DPA; applicable SCCs; EU-US DPF |
| Microsoft Ireland Operations Limited (Microsoft Graph) — when enabled | Reading, updating, and sending email through users’ connected Microsoft 365 / Outlook accounts | OAuth tokens, email metadata and content, attachments | EU / United States | User OAuth; Microsoft Products and Services DPA; applicable SCCs; EU-US DPF |
3. Artificial intelligence
Decalab uses several AI providers and may route a request to a provider based on functionality, availability, or observed quality. Only the minimum necessary context is transmitted. Each provider is contractually prohibited from reusing Customer Data to train its models.
| Subprocessor | Purpose | Categories of data | Location | Safeguards |
|---|---|---|---|---|
| Mistral AI | AI request processing, including generation, classification, and extraction | Communication excerpts and the minimum necessary context | France | Mistral DPA; no-reuse commitment for model training |
| Google LLC / Google Ireland Limited (Gemini API) | Same as above | Same as above | European Union | Google DPA; no-reuse commitment |
| Anthropic, PBC (Claude) | Same as above | Same as above | EU / United States | Anthropic DPA; API zero-retention commitment; SCCs; EU-US DPF |
| OpenAI Ireland Ltd. / OpenAI, L.L.C. (GPT) | Same as above | Same as above | EU / United States | OpenAI DPA; API no-training commitment; SCCs; EU-US DPF |
4. Payments and billing
| Subprocessor | Purpose | Categories of data | Location | Safeguards |
|---|---|---|---|---|
| Stripe Payments Europe Ltd. | Payment processing, subscription management, and invoice generation | Customer identity, billing address, VAT number, payment identifiers, billing history | EU (Ireland), United States (Stripe group) | Stripe DPA; SCCs; PCI-DSS Level 1; EU-US DPF (Stripe Inc.) |
5. Transactional email
| Subprocessor | Purpose | Categories of data | Location | Safeguards |
|---|---|---|---|---|
| Resend, Inc. | Sending Service-related transactional emails, including confirmations, password resets, and product notifications | Recipient email and transactional content | United States (with EU servers depending on plan) | Resend DPA; SCCs; EU-US DPF |
6. Customer support
| Subprocessor | Purpose | Categories of data | Location | Safeguards |
|---|---|---|---|---|
| Intercom Inc. | In-app and email support messaging and customer conversation tracking | Email, name, user identifier, conversation history | United States (EU regional option depending on subscription) | Intercom DPA; SCCs; SOC 2 Type II; EU-US DPF |
7. Product analytics and improvement
| Subprocessor | Purpose | Categories of data | Location | Safeguards |
|---|---|---|---|---|
| PostHog Inc. | Anonymized Service usage analysis, friction identification, and A/B testing | Pseudonymized user identifier, interface events, technical metadata | EU (EU instance preferred) or United States | PostHog DPA; SCCs; ISO 27001; EU-US DPF |
8. Observability and monitoring
| Subprocessor | Purpose | Categories of data | Location | Safeguards |
|---|---|---|---|---|
| Sentry (Functional Software, Inc.) | Application error detection and diagnosis | Stack traces, technical session identifiers, IP address, user agent | United States | Sentry DPA; SCCs; EU-US DPF |
| Langfuse GmbH | AI agent observability and execution traces | Agent prompts and responses, with personal data redaction | EU (Germany) or United States depending on plan | Langfuse DPA; SCCs |
9. Customer-connected third-party services (informational — not Decalab subprocessors)
When the Customer enables an integration between Elron and a third-party service it already uses, including customer relationship management tools, property management software, collaborative suites, calendars, or other supported integrations, that third-party service is not a Decalab subprocessor under this DPA. It is provided directly to the Customer under a separate agreement between the Customer and the third-party provider. Decalab only processes Data transmitted through the integration to provide the functionality requested by the Customer (see Section 13 bis of the DPA).
The current list of supported integrations is provided to the Customer during subscription or upon request at privacy@elron.ai. The Customer is responsible for the data protection compliance of its direct relationship with each third-party provider, including notices, consent, legal basis, and international transfers.
Notice of changes
Any addition, replacement, or removal of a subprocessor will be notified by email to the Customer’s contact address and/or through an in-app notification at least 15 days before it takes effect. The Customer may raise a reasoned objection under Section 9 of the DPA.
Contact
Questions about this list: privacy@elron.ai
DECALAB EURL — 149 avenue du Maine, 75014 Paris, France