Sub-processors
Dernière mise à jour : 29 septembre 2026
Merlain, nom commercial de DataAgents
These are the third parties that may process data on our behalf when you use Merlain. We list them so you can assess them before you connect a business system, and so a Data Processing Agreement can reference a concrete list rather than a category.
Where your data is hosted. The application services and the managed database that holds your account and business data run in the European Union, on Google Cloud’s europe-west4 region in the Netherlands. Authentication runs in the EU as well, on AWS’s eu-west-3 region in Paris. Data pipeline processing runs on OVH in France. We do not operate a US region.
A note on processing locations. Where this page says “See note”, the provider’s region is a deployment setting we are confirming rather than a value we can assert from memory. We would rather tell you it is being confirmed than publish a region that turns out to be wrong. Ask us and we will confirm the current region in writing for any provider on this list.
Infrastructure and hosting
| Provider | Purpose | Data | Location |
|---|---|---|---|
| Railway | Cloud hosting and managed database for the platform | Account data, billing metadata, customer business data | EU — Google Cloud europe-west4 (Netherlands) |
| Railway | Object storage for the data lake | Customer business data at rest | See note |
| OVH | Cloud hosting for data processing | Customer business data during processing | France |
| Cloudflare | Edge protection and content delivery | Request metadata, IP addresses | Global edge |
| Vercel | Hosting for this website | Website visitor request data | Global edge |
Authentication
| Provider | Purpose | Data | Location |
|---|---|---|---|
| Supabase | Authentication and session management for the Merlain application | Account identifiers, email addresses, authentication credentials, session tokens | EU — AWS eu-west-3 (Paris, France) |
AI model providers
Your business data is sent to these providers for inference so the product can answer questions about it. Merlain does not train models on your data.
| Provider | Purpose | Data | Location |
|---|---|---|---|
| OpenAI | Model inference and embeddings | Prompt content, which can include your business data | See note |
| Anthropic | Model inference | Prompt content, which can include your business data | See note |
| Google (Gemini) | Model inference | Prompt content, which can include your business data | See note |
| Baseten | Hosted model inference | Prompt content, which can include your business data | See note |
Payments
| Provider | Purpose | Data | Location |
|---|---|---|---|
| Stripe | Subscription billing and payment processing | Billing contact and subscription metadata. Card details never reach Merlain systems. | Global, under Standard Contractual Clauses |
Communications
| Provider | Purpose | Data | Location |
|---|---|---|---|
| Resend | Transactional and notification email | Recipient address and message content. Report emails can contain your business data. | See note |
| Slack | Alert and report delivery, and inbound chat | Alert content, including metric values | Your own Slack workspace |
| Microsoft Teams | Inbound chat | Chat content | Your own Microsoft tenant |
| WhatsApp (Meta) | Inbound chat | Chat content | Meta infrastructure |
| Telegram | Inbound chat | Chat content | Telegram infrastructure |
Analytics and monitoring
| Provider | Purpose | Data | Location |
|---|---|---|---|
| PostHog | Product and website analytics | Usage events, account identifiers, IP address | See note |
| Sentry | Error monitoring | Stack traces and request context | See note |
Changes to this list
We update this page when a sub-processor is added or removed. If you have a Data Processing Agreement with us, the notice period in that agreement applies. Write to dpo@merlain.ai to be notified of changes, or to raise an objection to a specific sub-processor.