Loracta uses a limited set of subprocessors to deliver the platform. This page is generated from the authoritative platform subprocessor source and shows both always-on and feature-conditional providers.
§ 01
Overview
Current source version
Subprocessor source version: 2026-05-27. Conditional providers are engaged only when the relevant customer feature, integration, or deployment setting is enabled.
Each provider is bound by appropriate contractual terms, including a data-processing agreement where required. Transfers outside the EU/EEA rely on adequacy decisions, EU Standard Contractual Clauses, and supplementary measures as noted below.
§ 02
Current list
AI — large language models (chat / assistant)
| Provider | Purpose | Region | Transfer mechanism |
|---|---|---|---|
|
OpenAI, L.L.C.
Conditional |
Hosted large-language-model inference for chat/assistant flows when the operator selects OpenAI as the chat provider.
Engaged only when the platform/tenant configures OpenAI as the chat provider. Data: User chat messages, Retrieved content snippets, System prompt text |
United States | EU SCCs (2021/914) + supplementary measures; data-processing addendum. |
|
Anthropic, PBC
Conditional |
Hosted large-language-model inference for chat/assistant flows when the operator selects Anthropic as the chat provider.
Engaged only when the platform/tenant configures Anthropic as the chat provider. Data: User chat messages, Retrieved content snippets, System prompt text |
United States | EU SCCs (2021/914) + supplementary measures; data-processing addendum. |
AI — speech-to-text transcription
| Provider | Purpose | Region | Transfer mechanism |
|---|---|---|---|
|
AssemblyAI, Inc.
Conditional |
Speech-to-text transcription with speaker diarization for uploaded audio/video, when the tenant's ASR data-residency policy permits cloud processing.
Engaged only when the tenant's `asr_data_residency` setting is `cloud_us` or `cloud_any` AND diarization is required. Data: Uploaded audio/video media, Resulting transcripts and speaker labels |
United States | EU SCCs + DPA. |
|
Groq, Inc.
Conditional |
Hosted Whisper-compatible speech-to-text inference for non-diarized transcription when the tenant's ASR residency policy permits cloud processing.
Engaged only when the tenant's `asr_data_residency` setting is `cloud_us` or `cloud_any` AND diarization is not required. Data: Uploaded audio/video media, Resulting transcripts |
United States | EU SCCs + DPA. |
Payments and donations
| Provider | Purpose | Region | Transfer mechanism |
|---|---|---|---|
| Stripe Payments Europe, Ltd. |
Payment processing for subscriptions, donations, and Connect-based tenant payouts.
Data: Donor / customer name and email, Payment card information (handled by Stripe; never received by Loracta), Donation amount and currency, Transaction metadata |
European Union (Ireland) with US-based group entities | Intra-group SCCs; Stripe DPA. |
Transactional email delivery
| Provider | Purpose | Region | Transfer mechanism |
|---|---|---|---|
| SMTP delivery provider (configured per environment) |
Transactional email delivery (verification codes, password resets, magic-link rights requests, system notifications).
Specific provider depends on the deployment environment; the active provider is disclosed on request. Data: Recipient email address, Message subject and body |
European Union (preferred); falls back per operator configuration | Operator selects a provider with SCCs/DPA in place. |
Object storage (media, transcripts, derived artifacts)
| Provider | Purpose | Region | Transfer mechanism |
|---|---|---|---|
| S3-compatible object storage (MinIO or hosted equivalent) |
Persistent storage for uploaded media (audio, video, images, PDFs), transcripts, generated TTS audio, and thumbnails.
Data: Uploaded media files, Derived artifacts (transcripts, thumbnails, TTS) |
European Union (preferred); per operator configuration | Operator selects a storage provider with SCCs/DPA in place. |
User-initiated content import
| Provider | Purpose | Region | Transfer mechanism |
|---|---|---|---|
|
Google Ireland Limited (Google Drive)
Conditional |
Assisted document import from a user-connected Google Drive account via OAuth.
Engaged only when a user explicitly connects their Google Drive account to assist with imports. Data: Google account email and basic profile, Drive file listings and the specific file contents imported by the user |
European Union (Ireland) | Google Workspace DPA; SCCs for any onward US transfer. |
Error reporting and logging
| Provider | Purpose | Region | Transfer mechanism |
|---|---|---|---|
| Functional Software, Inc. (Sentry) |
Application error reporting, performance monitoring, and profiling.
Data: Application errors and stack traces, Request URL (path), HTTP method, status code, Aggregated performance traces |
United States | EU SCCs + DPA; Loracta configures Sentry with `send_default_pii=False` and redacts cookies, POST bodies, and sensitive headers before send. |
| Grafana Labs / self-hosted Loki |
Structured application log aggregation.
Data: Structured log lines (request id, tenant id, log level, message), IP addresses are truncated before logging (see `app/utils/observability.py`) |
European Union (preferred); per operator configuration | Self-hosted or operator-selected hosted Loki with DPA. |
§ 03
Notice of changes
Material additions or replacements are announced through the workspace inbox or another durable channel at least 14 days in advance where feasible. Customers may object on reasonable data-protection grounds under the DPA.
↳
Version history
We update this page when the underlying processing, service terms, or legal references change materially.
3 Jun 2026
v2.1
Switched from static prose to the authoritative platform subprocessor source.