Subprocessors and providers
Documents submitted to the API or to the validator are entrusted to no provider: they are processed in memory on our infrastructure hosted in France, never kept, never logged. The providers below operate around the service — hosting, network, email, payment collection — with, for each of them, what they see and what they do not.
This English text is provided for convenience. In case of any discrepancy, the French version prevails.
| Provider | Role | Location |
|---|---|---|
| OVHcloud | Hosting of the API and the website (virtual private server). Documents submitted there are processed in memory and never written to disk. | France (European Union) |
| Cloudflare, Inc. | Domain DNS, proxy and cache in front of the public site, routing of inbound mail. Only the website goes through its network. The API (api.factlint.com), which receives the documents, is deliberately kept outside that proxy: no invoice document passes through Cloudflare. | United States, points of presence worldwide |
| Resend, Inc. | Sending of transactional email: address verification, account security. Receives account email addresses only, never a document. | United States |
| Google Ireland Limited | Sign-in and account creation for customers who choose the “Sign in with Google” button. Optional: the email-and-password account remains available, and without that choice Google is never involved. Involved at sign-in only, never with a document. Google passes us an account identifier and an email address, and nothing else: no name, no picture, no address book — the scope requested is limited to those two values. No Google script is loaded by this site, here or anywhere else: the hand-off is a redirect. | Ireland (European Union); transfers to the United States within the Google group |
| Lemon Squeezy, LLC | Collection of card-paid subscriptions, as a reseller (Merchant of Record): Lemon Squeezy is the seller, applies the VAT of the buyer’s country and issues the receipt. Controller of its own processing of purchase data: payment happens on its pages, and Factlint never sees a means of payment. Factlint keeps subscription identifiers only, which allow neither charging nor refunding. | United States |
| PayPal (Europe) S.à r.l. et Cie, S.C.A. | Collection of subscriptions paid through PayPal, on behalf of Factlint. Unlike Lemon Squeezy, PayPal is not the seller: it collects on behalf of Factlint, which sells, issues the invoice and remains responsible for the applicable VAT. PayPal is the controller of its own processing of payment data: payment happens on its pages, and Factlint never sees a means of payment. | Luxembourg (European Union); possible transfers to the United States within the PayPal group |
This list is kept up to date whenever a provider changes. Transfers outside the European Union are flagged in the “Location” column; none of them concerns the content of submitted documents. Two payment providers appear because the means of payment is chosen at subscription time: depending on which one is used, the seller is not the same, and the “Role” column says which.