List
| Sub-processor | Role | Data concerned | Location | Safeguards |
|---|---|---|---|---|
| OVH SAS 2 rue Kellermann, 59100 Roubaix, France | Hosting of the service infrastructure (virtual private server) | All service data: console accounts and data sent by the collector | European Union [TO BE CONFIRMED: data centre] | Hosting provider’s data processing agreement; no transfer outside the European Union planned |
| OpenAI [TO BE VERIFIED: contracting entity and address] | Language model for the AI assistant, only if the assistant is enabled and used | The user’s question and the extracts needed for the answer: inventory, events, check results, which may contain user names, host names and IP addresses | United States | European Commission standard contractual clauses (Decision 2021/914) [TO BE VERIFIED: EU–US framework] |
What is not on this list
Transactional emails (address verification, password reset, notifications) are sent by a mail relay operated by Pepiva on the same infrastructure, without a third-party provider. The collector runs on the customer’s infrastructure and sends directly to the console.
The self-hosted edition uses none of these sub-processors on Pepiva’s behalf: the console, its database and its backups stay with the customer. If the customer configures an AI provider there with its own key, that provider falls under the customer’s own contractual relationship.
Changes
Pepiva notifies the administrators of each customer organisation by email at least thirty days before adding or replacing a sub-processor, and updates this page and its date. The customer may object to the change within fifteen days, under the conditions of section 7 of the Data Processing Agreement.