Cette liste prepare la transparence RGPD et DPA. Les regions, DPA, garanties de transfert et parametres de retention doivent etre verifies et archives avant vente large self-serve.
Authentication, database, storage, row-level security and backups.
Donnees possibles : user account, CRM records, workspace data, files, technical logs.
Region : Project region, backup region and support access must be verified before broad sale.
DPA : DPA to verify and archive.
Transferts : EU/third-country transfer mechanism to verify.
Core infrastructure provider.
Payments, subscriptions, billing portal, tax IDs and payment receipts.
Donnees possibles : billing identity, email, address, VAT ID, payment metadata, subscription status.
Region : Stripe account region and data transfer terms must be verified.
DPA : DPA and Stripe Tax settings to verify before live billing.
Transferts : International transfer terms to verify.
Checkout remains closed outside live mode.
Transactional and relationship emails.
Donnees possibles : recipient email, email content, delivery status, bounce or complaint events.
Region : Processing and retention region to verify.
DPA : DPA and provider tracking settings to verify.
Transferts : International transfer terms to verify.
Tracking must remain off unless documented consent or lawful basis exists.
Calls, SMS, voicemail and telephony metadata if explicitly enabled.
Donnees possibles : phone numbers, call metadata, SMS metadata, recording metadata, audio if enabled.
Region : Country routing, regulatory bundle, recording storage and retention to verify.
DPA : DPA and telecom compliance terms to verify before real use.
Transferts : International transfer terms to verify.
Real Twilio/SMS remains disabled by runtime flags and readiness checks.
AI assistance, summaries, preparation and analysis when enabled by the user.
Donnees possibles : CRM context, call notes, prompt excerpts, analysis output.
Region : Model, retention, training and regional processing settings to verify.
DPA : DPA and data-use settings to verify before broad sale.
Transferts : International transfer terms to verify.
Inputs must be minimized and no OpenAI call is made by legal documentation.
Hosting of the Live Coach media runtime and operational logs.
Donnees possibles : call and session identifiers, audio in transit, live transcript fragments, technical diagnostics.
Region : The effective service region, log region and backup behavior must be evidenced from the production account.
DPA : DPA acceptance and current subprocessors to verify and archive.
Transferts : International transfer mechanism and effective processing locations to verify.
The runtime is deployed, but feature flags may keep paid Live processing disabled.
Application hosting, edge delivery and operational logs.
Donnees possibles : IP address, request metadata, error logs, technical telemetry.
Region : Hosting region, log retention and support access to verify.
DPA : DPA to verify and archive.
Transferts : International transfer terms to verify.
Exact hosting legal identity must be completed before broad sale.
OAuth identity, Gmail and Calendar synchronization when connected by a user.
Donnees possibles : OAuth identity, access tokens, email excerpts, calendar events, meeting links.
Region : Effective product, account and support locations must be verified.
DPA : Applicable Google terms, DPA and sensitive-scope verification status to archive.
Transferts : International transfer terms and account configuration to verify.
Code exists; production app approval and activation are not proven by the repository.
OAuth identity, Outlook and Calendar synchronization when connected by a user.
Donnees possibles : OAuth identity, access tokens, email excerpts, calendar events, meeting links.
Region : Tenant, data boundary and support locations must be verified.
DPA : Microsoft DPA and application permission approvals to archive.
Transferts : International transfer terms and tenant configuration to verify.
Code exists; production tenant approval and activation are not proven by the repository.
Telephony metadata and signed webhooks when explicitly configured.
Donnees possibles : phone numbers, call metadata, provider identifiers.
Region : Provider account region and retention must be verified before activation.
DPA : DPA and webhook security configuration to verify.
Transferts : International transfer terms to verify.
Connector code does not prove a configured or operational integration.
Telephony metadata and signed webhooks when explicitly configured.
Donnees possibles : phone numbers, call metadata, provider identifiers.
Region : Provider account region and retention must be verified before activation.
DPA : DPA and webhook security configuration to verify.
Transferts : International transfer terms to verify.
Connector code does not prove a configured or operational integration.
Meeting or telephony metadata if a compatible application and licenses are configured.
Donnees possibles : meeting identifiers, participants, call metadata, media only if separately authorized.
Region : Account region, RTMS processing and retention must be verified before activation.
DPA : DPA, marketplace application and permission review to verify.
Transferts : International transfer terms to verify.
Normalization/authentication work exists; operational media delivery is not proven.
Aucun sous-traitant liste ici ne suffit a lui seul a valider la conformite. Les contrats, DPA, regions, transferts hors UE, parametres de retention et mesures de securite doivent etre controles avant activation live, notamment pour Stripe, Twilio, OpenAI et Resend.