Security
Hosting and subprocessors
Last updated · October 7, 2026
Three subprocessors. The current list is maintained on the subprocessors page.
Hosting and subprocessors
| Subprocessor | Role | Location | Data concerned |
|---|---|---|---|
| OVHcloud (OVH SAS) | Hosting: compute, database, storage, backups. ISO 27001 and SOC 2 Type II certified. | France (EU) | All platform data, at rest and in processing |
| Cloudflare, Inc. | DNS resolution for our domain, and nothing else. | United States | DNS queries. No application data, no storage, no decryption of traffic. |
| PostHog, Inc. | Audience measurement on the lutril.com marketing site, after consent. | EU cloud | Public site visits. No workspace data. |
- No AI provider. Lutril uses no language model provider as a subprocessor. No workspace data is sent to one, and no platform process calls one.
- TLS is terminated by our own reverse proxy on OVHcloud infrastructure, with certificates we manage. No third party decrypts your traffic.
- No workspace data leaves the European Union. Nothing is transferred, replicated or backed up outside it.
- The applications you connect are not Lutril subprocessors. Google Workspace, Microsoft Entra ID, Slack, your HR system and your SaaS tools process your data under your own agreements with those vendors, within the scopes your administrator approves.
- Before adding or replacing a subprocessor we notify you in advance, with a right to object.