Subprocessors
Lutril uses a small set of third-party subprocessors to deliver the Service. Each processes customer data only for the purpose listed below, under a data processing agreement, and customer workspace data stays in the EU whenever available for the deployed stack.
| Vendor | Entity · Region | Purpose |
|---|---|---|
| OVHcloud | OVH SAS · France (EU datacenters) | Primary hosting and infrastructure: compute, database, and storage workloads for production. |
| Cloudflare | Cloudflare, Inc. · EU-focused edge controls | Network edge protection: CDN, TLS termination, WAF, and DDoS mitigation. |
| PostHog | PostHog, Inc. · EU Cloud (eu.i.posthog.com) | Website analytics for lutril.com, loaded only after the visitor consents. Not used inside the Access Governance platform and never given customer workspace data. |
Customer-enabled integrations
The systems below process data only when a customer administrator connects them, under the customer's own agreements with those vendors and the scopes the administrator approves. They are not Lutril subprocessors; they are listed here for transparency.
| Vendor | Entity · Region | Purpose |
|---|---|---|
| Slack | Slack Technologies, LLC | Access request and review notifications delivered into the customer's own Slack workspace. |
| Microsoft | Microsoft Corporation (Teams, Entra ID) | Access request notifications in the customer's Teams tenant; identity and sign-in data synchronized from the customer's Entra ID. |
| Google LLC (Google Workspace) | Identity, directory, and sign-in data synchronized from the customer's Google Workspace under admin-approved scopes. | |
| HRIS & SaaS connectors | Per customer configuration | Employee lifecycle events and application account data from the systems the customer chooses to connect. |
Before adding or replacing a subprocessor, Lutril notifies customer administrators in accordance with the applicable DPA, with an opportunity to object.
To receive change notifications or ask about a listed vendor, contact privacy@lutril.com.