How to read this. Each row is one part of running the service: what it can see, and who supplies it. Required means the service cannot run without it. Not in use means no supplier is engaged for it today — the row is listed anyway, because switching one on has to be a disclosed change and not a silent one.
| Role | What it can see | Provider |
|---|---|---|
| Application hosting Required | Runs the application: sign-in, file parsing, the dashboards. Uploaded files pass through it on their way to storage; it keeps nothing of its own. | Scaleway SAS (France) — Serverless ContainersRegion: Paris, France (EU) |
| Database Required | Holds everything except the uploaded file copies: accounts, workspaces, parsed figures, audit trail, sessions, waitlist. | Scaleway SAS (France) — Managed Database for PostgreSQLRegion: Paris, France (EU) |
| Email delivery Required | Delivers password-reset links, inactivity warnings and scheduled report packs, so it sees the addresses they are sent to. | Scaleway SAS (France) — Transactional EmailRegion: Paris, France (EU) |
| Support mailbox Required | The inbox behind support@orkestar.eu — the address on these pages for privacy requests, security reports and support. Whatever you write to it, including any personal data your message contains, is stored in this mailbox. | OVHcloud (France) — Zimbra mailbox for support@orkestar.euRegion: European Union (OVHcloud data centres) |
| Object storage Required | Holds the files you upload. They are reached through signed, expiring links, never public ones. | Scaleway SAS (France) — Object StorageRegion: Paris, France (EU) |
| Error monitoring Not in use | Not in use. If we ever switch one on, it would receive error reports — what failed and where, configured to exclude your email and IP address — and this page changes first. | None — no error-monitoring provider is engaged |
Who is not on this list
No analytics provider, no advertising network, no customer-data platform, no session-recording tool, no chat widget, no CDN that sees your requests, and no AI or model provider. None of those is present in the product, which is why none appears above. The cookie notice is the same fact seen from the browser.
What each of them is held to
Every supplier above is engaged under a written contract that binds it to process data only on our instructions, to keep it confidential, to apply appropriate security, and to delete or return it at the end of the engagement. Where a supplier processes data outside the region named above, a lawful transfer mechanism has to be in place before it is engaged.
Changes to this list
Before a new sub-processor starts handling customer data, this page is updated and account holders are notified by email with at least 30 days' notice. If you object on reasonable data protection grounds, tell us within that window: we will look for an alternative, and if there is none you may end your subscription for the affected service without penalty.
To be told about changes, or to raise an objection, write to support@orkestar.eu.