Sub-processors

Who else touches your data.

SeguraDoc uses a short list of companies to run the service. This page names each one and what it receives, and says how we tell you before the list changes.

Last updated 30 September 2026

01

Who processes data for us

These companies process data on our behalf. Each is bound by a contract that limits what it may do with it.

ProviderPurposeWhat it receives
OVH (France)Hosting: the servers the service runs onEverything the service stores or processes: account data, filtering history, mailbox credentials (encrypted), and documents while they are rebuilt
CloudflareNetwork and security in front of the website, the dashboard and the APIThe traffic between you and SeguraDoc, including what you upload
SMTP2GOSending our emailsYour email address and the emails we send you, such as sign-in links and notices
Mistral AI, OpenAI or Venice.ai (one at a time)Text recovery from scanned pages; the document summary; the message passRendered page images; the text of a PDF you send us yourself; sender name, domain, subject, a body excerpt and text read from pictures in the message
abuse.ch (URLhaus)Malware-link lookupLinks found inside a document
StripeCard payments and subscriptionsEmail address, payment details you enter with them
BlockBeeCrypto paymentsPayment address and transaction data
GoogleOptional sign-inYour Google account's email and name, if you use it
MicrosoftMailbox access for Microsoft 365The consent you grant; Microsoft issues the token
SentryError reportingTechnical error details
Tawk.toLive chat on the public siteWhat you type into the chat
StorylaneEmbedded product demoDemo view events

The AI row names the three providers the AI work may run on. Only one of them receives data at any time, and moving between them is not a change to this list.

02

Before this list changes

We email account holders at least 30 days before we add a company to this list or replace one on it, saying who it is, what it will receive and from when. If you object, write to [email protected] before that date.

Removing a company needs no notice, and we update this page when we do. The date at the top tells you when the list last changed.

03

What is not on the list

Your own mail provider is not a sub-processor. It already holds your mail; we act on the mailbox with the access you grant us.

Work we run ourselves, on the servers above, is not listed again: rebuilding documents in our sandbox, reading text in pictures, and screening mail.

Where data leaves the European Economic Area, it is protected by the European Commission's Standard Contractual Clauses or an equivalent safeguard. The privacy policy says what we hold and for how long.

Read next

What we hold about your mail and documents, and for how long.

Privacy policy