Skip to main content
neuronxcrm
Sign in
Book a call

Subprocessors

Version 1.0 · Updated 2026-09-08

Version: 1.0
Last updated: 8 September 2026

This page lists the main subprocessors and technical providers Kraken Labs uses to deliver neuronxcrm, including their role, data concerned, and location.

It complements:

  • the neuronxcrm Privacy Policy;
  • the Data Processing Agreement (DPA) made available to professional customers.

1. General principles

Kraken Labs only uses providers that offer sufficient guarantees of security and GDPR compliance.

  • Subprocessors that may process personal data on our behalf are contractually bound, with confidentiality and security obligations at least equivalent to our own.
  • Environments are chosen and configured to minimise personal data actually transmitted (minimisation, encryption, isolation).

2. Main technical subprocessors

2.1. Scaleway

  • Role: infrastructure hosting (servers, databases, object storage, backups) for neuronxcrm.
  • Data concerned: account and platform usage data; tenant CRM content; technical and security logs; encrypted backups.
  • Location: France, Paris region (European Union).
  • Key measures: private storage buckets with encryption; 30-day backup lifecycle deletion; MFA-protected admin access.

2.2. Scaleway Transactional Email (TEM)

  • Role: primary transactional email delivery for platform notifications (invitations, password reset, magic links, system messages) and tenant automation email.
  • Data concerned: recipient email addresses and message metadata/content required to deliver transactional email; delivery webhooks (queued, delivered, dropped, spam).
  • Location: France, Paris region (European Union).
  • Key measures: used only for transactional/platform and automation email, not for selling personal data; one TEM webhook per sending domain.

2.3. Brevo

  • Role: fallback transactional email delivery while Scaleway TEM remains the primary sender. Brevo SMTP is used when TEM is unset or a TEM send fails.
  • Data concerned: recipient email addresses and message metadata/content required to deliver transactional email.
  • Location: service operated with EU-oriented processing for Kraken Labs’ transactional mail configuration.
  • Key measures: used only for transactional/platform email, not for selling personal data.

2.4. Google (Gmail API and Gemini)

  • Role:
    • Gmail API — optional customer-enabled mailbox sync and send;
    • Gemini — optional AI features for metadata proposal from media ingestion.
  • Data concerned: when enabled by the customer/user — Google account email, OAuth tokens, mailbox content (messages, threads, attachments), and prompts/media submitted to AI features.
  • Location: according to Google’s terms for the relevant APIs/services.
  • Key measures: OAuth consent; credentials stored in a secured credentials store; Gmail disconnect cascades deletion of synced mailbox data; Google user data Limited Use commitments in the Privacy Policy; AI metadata proposals require human approval before installation.

2.5. GitHub

  • Role: source-code management for neuronxcrm development.
  • Data concerned: application source code, infrastructure scripts, technical documentation — not production personal data, production logs, secrets, or database backups.
  • Location: global service; transfers concern technical artefacts only.

2.6. Anysphere Inc. (Cursor) — development tooling

  • Role: AI-assisted development environment used internally to write and improve neuronxcrm code.
  • Data concerned: primarily source code and technical artefacts; production personal data is not transmitted by default.
  • Location: service published by Anysphere Inc. (United States), used under privacy configurations limiting retention/reuse where available.

3. Local tools and workstations

Kraken Labs also uses local tools on encrypted workstations (for example office software, Docker, diagramming tools) under a strict encryption and non-synchronisation policy for sensitive project materials.

4. Updates to this list

The list of subprocessors may evolve when infrastructure or providers change.

Material changes to subprocessors that may process personal data are documented in contractual documentation and, where applicable, in the DPA. Where a change may significantly affect processing of Customer personal data, Customers are informed according to contractual modalities.

No new subprocessor involving personal-data processing is used without appropriate security, confidentiality, and compliance guarantees at least equivalent to those described here and in the applicable DPA.