CorsalaCorsala
Document under legal review

Sub-processors

Last updated: 25 October 2026

Lire en français

This page publishes the list of Corsala’s sub-processors, as provided for by the data processing agreement (GDPR, Article 28) annexed to the Terms of Use. It is kept up to date: any change to the list appears here before the new provider processes the data of a Space.

The country shown is the one where the provider is established. The servers and the database are hosted in the European Union. For a provider established outside the Union, its entry states the safeguard that governs the transfer.

Sub-processors chosen by Corsala

These providers process data on behalf of Corsala in order to deliver the service. Corsala imposes on each of them data protection obligations equivalent to those of the data processing agreement and remains responsible to the Space for their performance.

  • Hetzner Online

    Role
    Hosting of the servers and the database
    Data concerned
    All data stored in Corsala: the Space’s database and files
    Country
    Germany (European Union)
    Transfer safeguard
    No transfer outside the European Union

  • IONOS

    Role
    Off-site, encrypted copy of the backups
    Data concerned
    Encrypted backups of the database and of the files uploaded to Corsala
    Country
    Germany (European Union)
    Transfer safeguard
    No transfer outside the European Union

  • Anthropic

    Role
    Artificial intelligence services: conversational assistant, document recognition (OCR) and writing assistance
    Data concerned
    Texts, documents and images that the user submits to an artificial intelligence feature, and the responses produced
    Country
    United States
    Transfer safeguard
    Outside the European Union: European Commission adequacy decision (for the United States, the Data Privacy Framework) where the provider is certified under it, failing which the Commission’s standard contractual clauses (Implementing Decision (EU) 2021/914)

  • OpenAI

    Role
    Fallback voice transcription, and image generation
    Data concerned
    Audio recordings to transcribe; descriptions and images supplied for an image generation
    Country
    United States
    Transfer safeguard
    Outside the European Union: European Commission adequacy decision (for the United States, the Data Privacy Framework) where the provider is certified under it, failing which the Commission’s standard contractual clauses (Implementing Decision (EU) 2021/914)

  • Groq

    Role
    Voice transcription (dictation of a quote, of a report or of a question to the assistant)
    Data concerned
    Audio recordings to transcribe
    Country
    United States
    Transfer safeguard
    Outside the European Union: European Commission adequacy decision (for the United States, the Data Privacy Framework) where the provider is certified under it, failing which the Commission’s standard contractual clauses (Implementing Decision (EU) 2021/914)

  • Google

    Role
    Image generation (Gemini), geocoding and address autocomplete (Google Maps Platform), and sign-in with a Google account
    Data concerned
    Descriptions and images supplied for an image generation; addresses entered for geocoding; name and e-mail address of the person who signs in with Google
    Country
    United States
    Transfer safeguard
    Outside the European Union: European Commission adequacy decision (for the United States, the Data Privacy Framework) where the provider is certified under it, failing which the Commission’s standard contractual clauses (Implementing Decision (EU) 2021/914)

  • Microsoft

    Role
    Sending of the platform’s e-mails (Microsoft Graph) and sign-in with a Microsoft account
    Data concerned
    Recipient addresses, subject and content of the e-mails sent by the platform; name and e-mail address of the person who signs in with Microsoft
    Country
    United States
    Transfer safeguard
    Outside the European Union: European Commission adequacy decision (for the United States, the Data Privacy Framework) where the provider is certified under it, failing which the Commission’s standard contractual clauses (Implementing Decision (EU) 2021/914)

  • Stripe

    Role
    Payment for AI tokens
    Data concerned
    Payer’s name and billing details, amount and reference of the purchase; card details are entered on Stripe’s payment page
    Country
    United States
    Transfer safeguard
    Outside the European Union: European Commission adequacy decision (for the United States, the Data Privacy Framework) where the provider is certified under it, failing which the Commission’s standard contractual clauses (Implementing Decision (EU) 2021/914)

  • WhatsApp (Meta Platforms)

    Role
    Delivery of WhatsApp messages: messages from the platform to a person who gave their number with the consent box, and the numbers that Spaces connect to their workspace (linked device)
    Data concerned
    Phone number and content of the WhatsApp messages exchanged
    Country
    United States
    Transfer safeguard
    Outside the European Union: European Commission adequacy decision (for the United States, the Data Privacy Framework) where the provider is certified under it, failing which the Commission’s standard contractual clauses (Implementing Decision (EU) 2021/914)

  • Services de notification push des navigateurs

    Role
    Delivery of push notifications to the user’s browser or device; the service depends on the browser (Google, Apple, Mozilla or Microsoft, for example)
    Data concerned
    Title, text and link of the notification, and the technical address of the browser subscription
    Country
    Several countries, depending on the user’s browser
    Transfer safeguard
    Outside the European Union: European Commission adequacy decision (for the United States, the Data Privacy Framework) where the provider is certified under it, failing which the Commission’s standard contractual clauses (Implementing Decision (EU) 2021/914)

Services connected by the Space

The Space chooses to connect these services with its own account, on its own initiative, and remains responsible for them: they are not Corsala sub-processors. They are listed for information, with the data that the connection carries. The country and the transfer safeguard are given for information: the Space’s contract with the service applies.

  • Messagerie de l'espace (Gmail, Microsoft 365, serveur SMTP)

    Role
    Sending of the Space’s e-mails from its own address; with Microsoft 365, processing of the supplier invoices received in the mailbox that the Space designates
    Data concerned
    Addresses, subject, content and attachments of the e-mails sent by the Space
    Country
    Depending on the e-mail service chosen by the Space
    Transfer safeguard
    Outside the European Union: European Commission adequacy decision (for the United States, the Data Privacy Framework) where the provider is certified under it, failing which the Commission’s standard contractual clauses (Implementing Decision (EU) 2021/914)

  • SharePoint, calendrier et Bookings de l'espace (Microsoft 365)

    Role
    Filing of documents in the Space’s SharePoint, reading and writing of its calendar and of its Bookings reservations
    Data concerned
    File documents, calendar events and reservations
    Country
    Depending on the Space’s Microsoft 365 region
    Transfer safeguard
    Outside the European Union: European Commission adequacy decision (for the United States, the Data Privacy Framework) where the provider is certified under it, failing which the Commission’s standard contractual clauses (Implementing Decision (EU) 2021/914)

  • Google Drive de l'espace

    Role
    Filing of documents in the Space’s Google Drive, where the service only accesses the files that it created or that the user chose; and, for the media library, indexing of the photo and video folder that the Space designates, with a broader permission that allows reading an existing folder and creating the folder tree in it
    Data concerned
    File documents stored in the Space’s Drive; list and metadata of the files in the media library folder
    Country
    United States
    Transfer safeguard
    Outside the European Union: European Commission adequacy decision (for the United States, the Data Privacy Framework) where the provider is certified under it, failing which the Commission’s standard contractual clauses (Implementing Decision (EU) 2021/914)

  • Google Agenda de l'espace

    Role
    Reading of the busy slots of the calendar, creation of appointments with a Google Meet link, and reading of the day’s events of the person who connects their calendar
    Data concerned
    Busy slots, without the content of the events; appointments created (title, description, time, invitees); the person’s events for the day
    Country
    United States
    Transfer safeguard
    Outside the European Union: European Commission adequacy decision (for the United States, the Data Privacy Framework) where the provider is certified under it, failing which the Commission’s standard contractual clauses (Implementing Decision (EU) 2021/914)

  • Qonto

    Role
    The Space’s bank: bank reconciliation and supplier invoicing; with the E-invoicing connection, an approved platform that receives the invoices issued by the Space and hands it the invoices received
    Data concerned
    The Space’s bank transactions and supplier invoices; with e-invoicing, issued invoices (client’s identity and address, lines, amounts) and invoices received
    Country
    France
    Transfer safeguard
    No transfer outside the European Union

  • Super PDP

    Role
    Approved e-invoicing platform that the Space connects with its own account: filing of issued invoices, receipt of invoices received, lifecycle statuses and e-reporting
    Data concerned
    Issued invoices (Factur-X or XML: client’s identity and address, identification numbers, lines, amounts), invoices received, statuses and e-reporting data
    Country
    France (European Union)
    Transfer safeguard
    No transfer outside the European Union

  • Plateforme agréée compatible AFNOR (choisie par l'espace)

    Role
    Approved platform that the Space chooses among those that implement the AFNOR XP Z12-013 API: filing of issued invoices, receipt of invoices received, statuses and e-reporting
    Data concerned
    Issued invoices (client’s identity and address, identification numbers, lines, amounts), invoices received, statuses and e-reporting data
    Country
    Depending on the platform chosen by the Space
    Transfer safeguard
    Outside the European Union: European Commission adequacy decision (for the United States, the Data Privacy Framework) where the provider is certified under it, failing which the Commission’s standard contractual clauses (Implementing Decision (EU) 2021/914)

  • TronStride (Aigentrix)

    Role
    Accredited e-invoicing service provider in the Emirates that the Space connects for its Emirati entity: filing of invoices in the PINT AE format, tracking of their statuses and receipt of invoices
    Data concerned
    Issued invoices in the PINT AE format (client’s identity and address, tax numbers, lines, amounts), transmission statuses, invoices received
    Country
    Provider accredited in the United Arab Emirates
    Transfer safeguard
    Outside the European Union: the European Commission’s standard contractual clauses (Implementing Decision (EU) 2021/914)

  • Mollie

    Role
    Collection of deposits and payments from the Space’s clients, on the Space’s Mollie account
    Data concerned
    Amount, reference and status of the payments made by the Space’s clients
    Country
    Netherlands (European Union)
    Transfer safeguard
    No transfer outside the European Union

  • Stripe (compte de l'espace)

    Role
    Card payments on the Space’s own Stripe account: payment sessions, payment links, invoice payments
    Data concerned
    Amount, reference and status of the payments made by the Space’s clients; card details are entered on Stripe’s payment page
    Country
    United States
    Transfer safeguard
    Outside the European Union: European Commission adequacy decision (for the United States, the Data Privacy Framework) where the provider is certified under it, failing which the Commission’s standard contractual clauses (Implementing Decision (EU) 2021/914)

  • Instagram et Facebook (Meta Platforms)

    Role
    Publishing and management of the Space’s social networks, messages and comments received, and advertising forms (leads)
    Data concerned
    Facebook Pages and professional Instagram accounts chosen by the Space, posts, comments, messages, statistics, and answers to advertising forms
    Country
    Several countries, including outside the European Union
    Transfer safeguard
    Outside the European Union: European Commission adequacy decision (for the United States, the Data Privacy Framework) where the provider is certified under it, failing which the Commission’s standard contractual clauses (Implementing Decision (EU) 2021/914)

  • Conversions API de Meta (Meta Platforms)

    Role
    Feedback of the Space’s commercial milestones (qualified request, study paid, quote signed) to its Meta advertising campaigns, through the Space’s server relay
    Data concerned
    The prospect’s e-mail address and telephone number hashed (SHA-256), hashed prospect identifier, Meta click identifier, and for each milestone its date, value and currency
    Country
    Several countries, including outside the European Union
    Transfer safeguard
    Outside the European Union: European Commission adequacy decision (for the United States, the Data Privacy Framework) where the provider is certified under it, failing which the Commission’s standard contractual clauses (Implementing Decision (EU) 2021/914)

  • Google Ads (conversions hors ligne)

    Role
    Sending to Google Ads of the Space’s commercial milestones that follow an ad click, directly through the API with the Space’s Google Ads credentials, or through the Space’s server relay
    Data concerned
    Google click identifier, the prospect’s e-mail address and telephone number hashed (SHA-256), and for each milestone its date, value and currency; cancellation of a milestone that is no longer confirmed
    Country
    United States
    Transfer safeguard
    Outside the European Union: European Commission adequacy decision (for the United States, the Data Privacy Framework) where the provider is certified under it, failing which the Commission’s standard contractual clauses (Implementing Decision (EU) 2021/914)

  • Stape (relais serveur)

    Role
    Server relay (Google Tag Manager server container) that the Space hosts with Stape: it receives the commercial milestones sent by Corsala and forwards them to Meta and to Google Ads
    Data concerned
    The milestone data: the prospect’s e-mail address and telephone number hashed (SHA-256), hashed prospect identifier, click identifiers, and for each milestone its date, value and currency
    Country
    Depending on the region of the container chosen by the Space
    Transfer safeguard
    Outside the European Union: European Commission adequacy decision (for the United States, the Data Privacy Framework) where the provider is certified under it, failing which the Commission’s standard contractual clauses (Implementing Decision (EU) 2021/914)

  • TikTok

    Role
    Publishing and management of the Space’s TikTok account
    Data concerned
    TikTok account chosen by the Space, published videos, comments and statistics
    Country
    Several countries, including outside the European Union
    Transfer safeguard
    Outside the European Union: European Commission adequacy decision (for the United States, the Data Privacy Framework) where the provider is certified under it, failing which the Commission’s standard contractual clauses (Implementing Decision (EU) 2021/914)

  • LinkedIn

    Role
    Publishing on the Space’s LinkedIn account and prospecting extension
    Data concerned
    LinkedIn account chosen by the Space, posts and professional profiles followed by the Space
    Country
    Several countries, including outside the European Union
    Transfer safeguard
    Outside the European Union: European Commission adequacy decision (for the United States, the Data Privacy Framework) where the provider is certified under it, failing which the Commission’s standard contractual clauses (Implementing Decision (EU) 2021/914)

  • Airtable

    Role
    Import of the Space’s bases (prospects, files, service library) into Corsala: read-only, with the Space’s personal access token
    Data concerned
    The Space’s access token and the identifiers of the bases and tables read; Corsala reads the records chosen by the Space and writes nothing to Airtable
    Country
    United States
    Transfer safeguard
    Outside the European Union: European Commission adequacy decision (for the United States, the Data Privacy Framework) where the provider is certified under it, failing which the Commission’s standard contractual clauses (Implementing Decision (EU) 2021/914)

  • Site WordPress de l'espace

    Role
    Sending, as drafts on the Space’s WordPress site, of the articles prepared in Corsala, which the Space reviews and publishes on its own site
    Data concerned
    The Space’s username and application password; title, text and images of the articles sent as drafts
    Country
    Depending on the site host chosen by the Space
    Transfer safeguard
    Outside the European Union: European Commission adequacy decision (for the United States, the Data Privacy Framework) where the provider is certified under it, failing which the Commission’s standard contractual clauses (Implementing Decision (EU) 2021/914)

Public sources queried

These public services are queried to complete an address or to display a map. They receive no data from the Space other than the data indicated.

  • Base Adresse Nationale (api-adresse.data.gouv.fr)

    Role
    Address autocomplete and verification in France
    Data concerned
    Text of the address entered
    Country
    France (European Union)
    Transfer safeguard
    No transfer outside the European Union

  • Tuiles OpenStreetMap

    Role
    Map background displayed in the browser
    Data concerned
    IP address of the browser and map area requested, with no other data from the Space
    Country
    Several countries (content delivery network of the OpenStreetMap Foundation)
    Transfer safeguard
    Outside the European Union: European Commission adequacy decision (for the United States, the Data Privacy Framework) where the provider is certified under it, failing which the Commission’s standard contractual clauses (Implementing Decision (EU) 2021/914)

Prior notice and right to object

Corsala informs the Space of any addition or replacement of a sub-processor before it processes the Space’s data, within a reasonable time, by updating this page and by notifying the head of the Space.

The Space may object to the change, on reasonable grounds relating to data protection, within that time. If no solution is found, the Space may stop using the service and export its data under the conditions of the Terms of Use.

Data processing agreement

For any question about this list, or to exercise the right to object, write to support@corsala.com.

Data processing agreement · Back to sign-up