This register identifies material providers used by PaperPlane. A provider is a subprocessor only where it processes Business-customer personal data on our behalf. Payment and user-selected source providers may instead act as independent controllers under their own legal duties and agreements.
Subprocessors
| Provider | Service and data | Main location | Transfer basis |
|---|---|---|---|
| Scaleway SAS | Kubernetes compute, load balancing, container registry, PostgreSQL/OpenSearch infrastructure, object storage, database backups, secrets management and transactional email; account, document, security and operational data | EU for core service and storage; Paris, France (fr-par) for transactional email | EEA processing |
| OpenAI Ireland Ltd | Configured embeddings and AI chat; document text passages, questions, selected retrieval context and generated output | Provider infrastructure may include processing outside the EEA | Applicable adequacy mechanism and/or EU Standard Contractual Clauses plus supplementary measures under the provider DPA |
OpenAI is used for semantic indexing and archive answers in the current production configuration. Core document files remain in Scaleway object storage, but relevant extracted text is transmitted for the selected AI operation. Optional AI metadata extraction transmits a limited portion of text only when enabled. PaperPlane must not be described as having an unconditional EU-only processing boundary while this provider configuration remains active.
Other recipients and user-directed providers
| Provider/category | Role and purpose |
|---|---|
| Mollie B.V. | Regulated payment provider for checkout, mandates, subscription payments and refunds. Mollie processes payment and anti-fraud data under its own legal obligations; we receive payment identifiers and status. |
| Google LLC / Google Ireland Ltd | User-selected Google Drive and Gmail source. PaperPlane requests read-only scopes and offline access to import selected content. Google processes the account and source data under the user’s Google agreement. |
| Microsoft group companies | User-selected SharePoint/OneDrive and Outlook source through Microsoft Graph. Microsoft processes the source account under the user’s Microsoft agreement. |
| Dropbox group companies | User-selected Dropbox source. Dropbox processes the source account under the user’s Dropbox agreement. |
| A-Trust GmbH | Potential qualified electronic-signature provider. No production transfer occurs while the qualified-signature feature is disabled. The register will be updated before production activation. |
| Customer-selected IMAP/SFTP/FTP provider | The customer instructs PaperPlane to connect to the entered server. That provider is selected and controlled by the customer. |
Provider privacy information is available at Scaleway (opens an external site), OpenAI (opens an external site), Mollie (opens an external site), Google (opens an external site), Microsoft (opens an external site), Dropbox (opens an external site) and A-Trust (opens an external site).
Changes and objections
We will update the review date when a material provider changes. Business customers that have registered for legal notices receive at least 30 days’ advance notice of a new or replacement subprocessor where it materially affects their data. Objections based on reasonable data-protection grounds can be sent to hello@codeandcomments.at during that period, as described in the DPA.