Subprocessors
The full list of providers that can technically access data processed by the service.
Last updated: August 3, 2026
1. Why this page exists
Running an online service means relying on providers: a host, an email delivery service, data providers. Each of them can technically access some of the data you entrust to us. You are entitled to know which ones, and article 28 GDPR requires us to tell you.
Each provider below is bound by a GDPR-compliant processing agreement, receives only the data needed for its task, and is not permitted to use it for any other purpose.
Technical providers are named. Data enrichment providers appear as a category, and their named list is sent to you on request: section 3 explains why, and how to obtain it.
This list covers the CRM agent platform. The contact enrichment product, sold separately, uses a wider set of providers and has its own documentation.
2. List of subprocessors
| Provider | Role | Data involved | Location | Outside EU |
|---|---|---|---|---|
| Vercel · Vercel Inc. | Web application hosting and page rendering | Data passing through the interface, technical logs | European Union (Frankfurt region) | Yes |
| Scaleway · Scaleway SAS | Database and file storage | Accounts, CRM connections, audit reports, proposed actions | France | No |
| Trigger.dev · Trigger.dev Ltd | Background job execution (audit, agents) | CRM data processed during a run, run logs | European Union | No |
| Brevo · Sendinblue SAS | Transactional email delivery (verification, notifications) | User email address, first and last name | European Union | No |
| Stripe · Stripe Payments Europe Ltd | Payment and billing | Billing data. No CRM data | Ireland, United States | Yes |
| Data enrichment providers (8) | Finding business email, phone and role information to complete an incomplete record | First name, last name, company, domain name or professional profile URL of the records to enrich. No other CRM data | France, European Union | No |
3. Data providers: named list on request
Enrichment providers appear in the table above as a category rather than by name. We owe you a straight explanation: which providers we query, and in what order, is the core of our know-how. Publishing it would hand our competitors a list they would otherwise have to build themselves.
That choice takes nothing away from what you are told. The GDPR requires us to make our subprocessors known to the customer whose data we process, so that they can object — not to publish them on the internet.
The complete named list, with each provider's location, is sent on request to hello@jipup.com, under a confidentiality undertaking. It is provided to customers and to prospects under evaluation alike, with no purchase required, within fifteen days.
What the table above guarantees without your having to take our word for it: those providers are established in France and the European Union, they receive only what is needed to identify a person in a professional context and never the rest of your CRM, and each is bound by a contract meeting article 28 GDPR. Your right to object applies exactly as it does for the named providers.
4. Transfers outside the European Union
Providers marked "Outside EU" above are established outside the European Union, or may access data from there for operational and support purposes. Those transfers rely on the standard contractual clauses adopted by the European Commission, supplemented where relevant by the additional measures and adequacy mechanisms applicable to the provider concerned.
The application data itself — accounts, audit reports, proposed actions — is stored in France.
5. Public data sources
Some processing queries public databases. These are not subprocessors under the GDPR — no personal data is sent to them beyond a company identifier — but we list them so the origin of information added to your records is transparent.
- API Recherche d'entreprises (annuaire-entreprises.data.gouv.fr) — Legal identification of French companies (SIREN, SIRET, APE code)
6. Your CRM is not a subprocessor
Your CRM (HubSpot in particular) is the source of your data and your own provider, with whom you have your own contract. We connect to it on your instruction, within the permissions you grant. Our relationship with your CRM does not replace yours.
7. Changes to this list
We notify active account holders by email before adding a new subprocessor with access to personal data, under the terms of our data processing agreement, which gives you a right to object on reasoned grounds.
For any question about a provider on this list, write to hello@jipup.com.