Sub-processors
Last updated: October 3, 2026
The text of this page is in English. If it differs from any translation, the English version prevails.
These are the providers that process personal data on our behalf to run Rakolto. Your borrowers' documents are not among the data they receive: files go straight from the borrower's device to your own Google Drive or OneDrive.
Our sub-processors
| Provider | What it does | Data it receives | Where | Transfer safeguard |
|---|---|---|---|---|
| Google sign-in and Google Drive storage (your drive, your files) | Name, email address and profile image; Drive authorization token (encrypted); the files and folders Rakolto creates in your drive | United States and global | EU Standard Contractual Clauses (Google's data processing terms) | |
| Microsoft | OneDrive storage (your drive, your files) | Drive authorization token (encrypted); the files and folders Rakolto creates in your drive | United States and global | EU Standard Contractual Clauses (Microsoft's data protection addendum) |
| Brevo | Email delivery (sign-in codes, borrower requests and reminders, notices), until replaced by Resend | Recipient names and email addresses, and the content of each email | European Union | Processed in the EU; no transfer outside it for delivery |
| Resend | Fallback email delivery, planned to become the primary provider | Recipient names and email addresses, and the content of each email | United States | EU Standard Contractual Clauses (Resend's data processing agreement) |
| Neon | Database | Account information, loan and contact records, document metadata, and encrypted credentials | European Union (Frankfurt) | Processed in the EU |
| Vercel | Hosting and cookieless web analytics | Requests to the service (IP address, user agent) and the data the application handles in transit | European Union (fra1) and a global edge network | EU Standard Contractual Clauses (Vercel's data processing agreement) for processing outside the EU |
| Paddle | Payments, as our Merchant of Record: checkout, receipts, tax and refunds | Email address, billing details and payment information (held by Paddle, not by Rakolto) | United Kingdom, European Union and United States | Paddle's own safeguards, as an independent controller of payment data |
Changes to this list
We give customers at least 30 days' notice before adding or replacing a sub-processor. To receive that notice, email privacy@rakolto.com and ask to be added to the list. You may object to a change within the notice period.