Last updated: 19 September 2026
Subprocessors
Plenora engages the third-party subprocessors listed below to provide the service. Some are used only for specific, optional features; the purpose column indicates when each is invoked.
| Subprocessor | Purpose | Location | Data processed |
|---|---|---|---|
| Scaleway SAS | Compute, managed PostgreSQL, object storage, transactional email (TEM) | EU (France) | All primary service data; recipient address and content of system emails |
| Stripe Payments Europe, Limited | Payment processing and subscription management | EU (Ireland); onward processing in the US under SCCs | Name, email, billing address, payment method |
| Google Ireland Limited / Google LLC | OAuth authentication (only when the user signs in with Google); Google Fonts (only when an imported PowerPoint presentation references a font hosted on Google Fonts; the stylesheet and font files are fetched server-side and re-served from plenora.io so the end user does not contact Google directly) | US | Name, email, profile picture (Google sign-in); requested font URL (Google Fonts, fetched from a Plenora server) |
| Cloudflare, Inc. | Authoritative DNS, CDN, and edge proxy for plenora.io | Global edge network | IP address, request metadata (transient) |
| Functional Software, Inc. (Sentry) | Application error tracking and sampled server-side performance monitoring. In the browser, session replay, profiling, tracing, and release-session tracking are disabled. On the server, sampled request tracing and profiling (10% by default) and release-session tracking are enabled. Processed when Plenora has Sentry configured for its deployment. | EU (Frankfurt) | Stack traces, error messages, request paths, diagnostic breadcrumbs, User-Agent, referer, IP address, and sampled server performance data |
| OpenAI, L.L.C. | Generation of suggested exercises and quiz options from presentation content. Used only when an authenticated user invokes an AI authoring feature; may be disabled per organisation. | US | Slide titles, body text, and speaker notes for the slides included in the request |
| Proton AG | Company mailboxes ([email protected] and [email protected]) | Switzerland (EU adequacy decision) | Sender address and content of emails sent to Plenora |
| Anthropic, PBC | Software development and operations tooling (Claude) used by Plenora AS staff. Not connected to the service: customer and participant data is not sent to Anthropic as part of providing Plenora. Personal data may reach it incidentally, for example an email address quoted from a support request while an issue is being diagnosed. | US | Incidental only: personal data that appears in support or incident material handled by staff |
| Slack Technologies, LLC (Salesforce) | Internal communication among Plenora AS staff. Not connected to the service: customer and participant data is not sent to Slack automatically. Personal data may reach it incidentally, for example a customer email address discussed during support or an incident. | US | Incidental only: personal data that appears in support or incident discussions among staff |
| Unsplash, Inc. | Photo search via the in-editor image picker. Search queries are forwarded server-side; search-result thumbnails and selected photos are loaded from Unsplash-hosted URLs by editor, presenter, display, and participant browsers. | US | Search query; IP address and ordinary image-request metadata when a browser loads a thumbnail or selected photo |
Notification of changes
We will update this page when we add or remove subprocessors. Customers with a Data Processing Agreement will be notified by email before a new subprocessor begins processing data, giving them the opportunity to object.
Data hosting
Primary application data (database, file uploads, session content) is hosted in the EU on Scaleway infrastructure, currently in France. Operational data flowing to subprocessors (error events, AI prompts when invoked, rate-limit counters, payment data, OAuth handshakes) is processed in the regions listed above. Plenora's primary database and object storage are encrypted at rest, and connections to the listed services use encrypted transport.