All subprocessors (data processors) authorized by Tuteliq to process customer data. All have signed Data Processing Agreements and maintain security equivalent to Tuteliq. Tuteliq does not store customer data. We delete it immediately after processing. Subprocessors also do not store customer data; they only process it in real time under the same zero-storage model. We notify customers 30 days in advance of any change.
Last updated: August 5, 2026 · Effective date: August 5, 2026
Current subprocessors
1. Google Cloud Platform (GCP)
Google Cloud EMEA (Ireland) Limited
Purpose: Cloud infrastructure and hosting
Location: Frankfurt, Germany (eu-central-1 region)
Data processed: Real-time API processing, temporary incident storage
What they access
- API requests (content being analyzed)
- Processing logs (temporary, milliseconds only)
- Incident reports (temporarily, before encryption and return)
What they do not access
- Customer encryption keys (customer controlled)
- Historical customer data (not retained)
- Decrypted incidents (encrypted with customer's key)
- Customer account credentials
Data retention
- Real-time processing: no persistent storage
- Processing logs: deleted within 24 hours
- Incidents: encrypted and returned to customer (not stored by GCP)
- Backup data: encrypted, customer controlled
Security certifications
- SOC 2 Type II certified
- ISO 27001 certified
- EU GDPR compliant
- Data residency in EU (Frankfurt)
2. Upstash
Upstash, Inc.
Purpose: Redis caching and rate limiting
Location: EU (Google Cloud, Belgium)
Data processed: Ephemeral cache entries, rate limit counters, API key hashes
- Rate limit counters keyed to hashed identifiers
- Short-lived cache entries used during request handling
- Customer content submitted for analysis
- Customer encryption keys
- Incident data
- Payment or billing details
- Cache entries: seconds to minutes, automatically expired
- Rate limit counters: rolling window, automatically expired
- No persistent storage of customer content
- GDPR compliant
- Data residency in EU (Belgium)
3. Supabase
Supabase Inc.
Purpose: Database and hosting for the customer account dashboard, including billing and subscription state
Location: Frankfurt, Germany (EU region)
Data processed: Account information, billing records, subscription data
- Account names and contact information
- Billing data (not payment card details)
- Subscription information
- Usage records
- Audit logs
- Customer content (encrypted immediately)
- Incident data (encrypted with customer key)
- Customer's private data
- Account data: duration of subscription + 30 days
- Billing data: 7 years (legal requirement)
- Request logs: 30 days
- Aggregated usage analytics: 90 days
- Backups: encrypted, retention per Supabase policy
4. Stripe
Stripe Payments (Europe) Ltd
Purpose: Payment processing and billing
Location: Ireland (EU) with US operations (PCI compliant)
Data processed: Billing data, payment information, subscription management
- Billing address and contact info
- Payment method (tokenized, Stripe PCI compliant)
- Subscription data
- Invoice records
- Refund/dispute information
- Full credit card numbers (tokenized only)
- Customer content data
- Personal data beyond billing
- Payment data: tokenized, never fully stored
- Billing records: retained per tax requirements (7 years)
- Customer data: deleted 90 days after cancellation
- PCI DSS Level 1 certified
- GDPR with EU representative
Adding new subprocessors
- Pre-approval (internal): security assessment, data flow review, DPA verification, compliance check.
- Customer notification: 30 days advance notice via email, sent from support@tuteliq.ai, detailing name, purpose, location, and security measures.
- Customer right to object: a 30-day objection period. No objection means automatic approval. An objection means the customer may terminate (30 days notice, no penalty), and Tuteliq may not proceed if the customer objects.
- Subprocessor agreement: must sign a DPA with security standards, data minimization, restricted purposes (service provision only), and security equivalent to Tuteliq.
- Documentation: added to this list, customer notification sent, DPA archived, compliance confirmed.
Subprocessor security requirements
Security standards
- SOC 2 Type II or ISO 27001 certified (or equivalent)
- Data encryption in transit (TLS 1.3, TLS 1.2 minimum)
- Data encryption at rest (AES-256 or equivalent)
- Access controls (RBAC, MFA for sensitive access)
- Incident response procedures
- Security audit compliance
Data handling
- Process data only as instructed by Tuteliq
- Delete customer data within specified timeframe
- Never retain data for secondary purposes
- No training on customer data
- No sharing with third parties
- Confidentiality agreement with staff
Compliance
- GDPR Article 28 compliance
- Data Protection Impact Assessment
- Breach notification procedures
- Data subject rights support
- Regular security assessments
- Sub-subprocessor management
Sub-subprocessors
Some subprocessors use their own subprocessors. Tuteliq requires visibility and approval of all sub-subprocessors.
Google Cloud Platform sub-subprocessors
Sub-subprocessor
Purpose
Details
Google subsidiary services
Cloud operations
Included in GCP DPA
Regional providers
Redundancy
Data stays in EU
Data transfer mechanisms
EU/EEA to non-EU transfers
Current status: minimal transfers outside EU/EEA.
Stripe: primarily processes in Ireland (EU); US operations are covered by a Data Processing Addendum (DPA), Standard Contractual Clauses (SCCs), and supplementary safeguards.
Mechanism: Standard Contractual Clauses (Article 46, GDPR Chapter 5).
Security incident involving a subprocessor
Subprocessor's responsibility
- Notify Tuteliq within 24 hours
- Provide incident details
- Assess customer data exposure
- Propose remediation steps
Tuteliq's responsibility
- Assess impact on customers
- Determine if breach notification is needed
- Notify affected customers (within 24-48 hours)
- Provide incident summary and remedy
Customer impact is likely minimal: Tuteliq deletes customer data immediately, and subprocessors don't store it any longer.
Audit and review
Annual review cycle
- Q1: initial assessment of all subprocessors
- Q2: third-party security audit of subprocessor compliance
- Q3: performance and security review
- Q4: certification verification and renewal
Review items
- Current security certifications
- Compliance with DPA terms
- Data handling practices
- Staff training and turnover
- Third-party audit results
What Tuteliq does not use
- No advertising networks inside the application or dashboard.
- No customer content is sent to third-party LLM APIs beyond the sub-processors listed above.
- Customer content is never used to train any model, Tuteliq's own or any sub-processor's.
- No cross-border transfer of incident content outside the EU under normal operation.
Contact for subprocessor questions
Subprocessor information
Email: legal@tuteliq.ai Response: 5-10 business days
Security/compliance questions
Email: dpo@tuteliq.ai Response: 10 business days
Objection to a new subprocessor
Email legal@tuteliq.ai with subject "Subprocessor Objection", within 30 days of notification. Reason for objection required.
Summary
Tuteliq's subprocessor commitment
- Minimal subprocessor use (only where necessary)
- All subprocessors sign Data Processing Agreements
- All maintain security equivalent to Tuteliq
- All comply with GDPR Article 28 requirements
- Zero storage of customer data by subprocessors
- Customer notification for new subprocessors
- Customer right to object to new subprocessors
- Annual security review and audit
Your rights
- View this current list
- Receive notification of new subprocessors (30 days advance)
- Object to new subprocessors within 30 days
- Terminate service if you object (30 days notice, no penalty)
- Request security documentation
- Request audit evidence
Notification of changes
We notify customers at least 30 days before adding or replacing a sub-processor by:
- Updating this page with the change date.
- Emailing the workspace owner.
- Posting an entry on the in-app changelog.
To subscribe to change notifications, email dpo@tuteliq.ai with subject "Subprocessor notifications".