Subprocessors
Last updated: June 5, 2026
The following sub-processors are engaged by OpenCream SAS (operating as Corial) to process Customer Data in connection with the provision of the Services. This list is maintained in accordance with our Data Processing Agreement (DPA), Section 3.4.
We will notify Customers at least 30 days in advance of any intended addition or replacement of sub-processors, giving Customers the opportunity to object in accordance with the DPA.
AI Inference Routing
Corial offers two tiers of AI inference routing, set per tenant:
- Default tier: AI requests are processed by Anthropic, Inc. (United States) and Google LLC (United States) via their respective APIs.
- EU residency tier: All AI inference — including text generation, voice transcription, document analysis, and grounded web lookups — is processed by Google LLC on Google Cloud Vertex AI in European Union data centres (Belgium, Netherlands, Frankfurt, Paris, Madrid, or Finland depending on model). Both Anthropic Claude and Google Gemini models are served from the EU under the Google Cloud Data Processing Addendum.
The EU residency tier is enabled per tenant by OpenCream platform administration. Existing customers on the default tier may request migration at any time. See our Trust page for details.
Current Sub-Processors
| Sub-Processor | Country | Purpose | Data Processed |
|---|---|---|---|
| Hetzner Online GmbH | Germany (EU) | Infrastructure hosting | All Customer Data (storage and compute) |
| Anthropic, Inc. | United States (default tier) / European Union via Google Cloud Vertex AI (EU residency tier) | AI inference (Claude language models) | Communication content, contact metadata (transient — not retained by provider) |
| Google LLC | United States (default tier) / European Union (EU residency tier) | AI inference (Gemini language models), voice transcription, multimodal document processing, Google Workspace integration | Communication content, voice notes, documents, contact metadata (transient for AI inference); email content for connected Google Workspace accounts |
| Mistral AI SAS | France (EU) | AI inference (Mistral language models) | Communication content for AI processing (transient — not retained by provider) |
| Resend, Inc. | United States | Transactional email delivery (password resets, invitations, system notifications) | Recipient email address, email subject and body for system notifications |
| Microsoft Corporation | United States | Microsoft 365 email and Teams integration (Microsoft Graph API; per-user OAuth) | Inbox and sent-items email content for connected Microsoft 365 accounts; Teams messages when Tenant uses Teams integration |
| Slack Technologies, LLC (Salesforce) | United States | Slack workspace integration (per-tenant OAuth) | Message content, channel and user identifiers (when Tenant uses Slack integration) |
| Telegram FZ-LLC | United Arab Emirates | Telegram bot interface for voice notes and chat | Message content, voice notes, user identifiers (when Tenant uses Telegram integration) |
| Bright Data Ltd. | Israel | Public web data enrichment (LinkedIn profiles, company data, search results) | Company names, contact names, public profile URLs (publicly available data only) |
| Apify Technologies s.r.o. | Czech Republic (EU) | Public web data scraping for lead research and event exhibitor lists | Company URLs, search queries, event URLs (publicly available data only) |
| Stripe, Inc. | United States (Ireland for EU customers) | Payment processing (when paid plans are active) | Billing email, payment method tokens (card numbers never touch our servers) |
| PostHog, Inc. | Ireland (EU) | Product analytics | Usage events, anonymised user identifiers, feature interaction data |
International Transfer Mechanisms
For sub-processors located outside the European Economic Area, the following safeguards are in place:
| Sub-Processor | Country | Transfer Mechanism |
|---|---|---|
| Anthropic, Inc. | United States (default tier only) | Standard Contractual Clauses (SCCs), Module 3 (Processor to Processor). Not applicable for EU residency tier. |
| Google LLC | United States (default tier only) | Standard Contractual Clauses (SCCs), Module 3. Not applicable for EU residency tier (Google Cloud DPA, EU data centres). |
| Resend, Inc. | United States | Standard Contractual Clauses (SCCs), Module 3 |
| Microsoft Corporation | United States | Standard Contractual Clauses (SCCs), Module 3 |
| Slack Technologies, LLC | United States | Standard Contractual Clauses (SCCs), Module 3 |
| Bright Data Ltd. | Israel | EU adequacy decision (pending verification); SCCs as supplementary safeguard |
| Telegram FZ-LLC | United Arab Emirates | Standard Contractual Clauses (SCCs), Module 2 (Controller to Processor) |
| Stripe, Inc. | United States | Standard Contractual Clauses (SCCs), Module 3 (Stripe Payments Europe Ltd serves EU customers from Ireland) |
Sub-processors located within the EU (Hetzner Online GmbH, Mistral AI SAS, Apify Technologies s.r.o., PostHog, Inc.) do not require additional transfer mechanisms.
Change Notification
To receive notifications of changes to this sub-processor list, please ensure your account email is current. Notifications are sent at least 30 days before any change takes effect. If you wish to object to a new sub-processor, please contact privacy@corial.app within the notification period.
Contact
For questions about our sub-processors or data processing practices:
OpenCream SAS
15 Avenue Marie-Amélie
60500 Chantilly, France
Email: privacy@corial.app
See also: Privacy Policy · Terms of Service · Trust · Data Processing Agreement