Subprocessors

Last updated: 2026-04-30

This page lists the third-party services that process customer data on behalf of Tenrion. We update it whenever we add, change, or remove a subprocessor.

What “subprocessor” means

A subprocessor is any third-party service we share customer data with in order to operate Tenrion. Some are obvious (the database hosting your contracts, the email service that sends signing links), others are less obvious (the geolocation lookup we use to record signer country in the audit log).

You retain control: when you delete a document, we delete it from every subprocessor on that document’s path. When you cancel your subscription and exercise your data-export / right-to-be-forgotten, the cleanup propagates to every subprocessor below.

Storage subprocessor: iDrive E2

We host customer documents on iDrive E2 (S3-compatible object storage). At signup you choose your data region; documents and templates for your account are stored only in that region. Regions:

Region	Datacenter	Best for
🇪🇺 EU	Paris, France	European Union customers (default)
🇬🇧 UK	London, United Kingdom	UK customers and post-Brexit privacy adequacy
🇺🇸 US	Virginia, United States	North American customers

Data shared: PDF and HTML document content, signed PDF blobs, attachments.
Encryption: at rest by default; in transit via TLS.
Privacy policy: https://www.idrive.com/idrive-privacy-policy

Email subprocessor: AWS SES

We use Amazon Web Services Simple Email Service (SES) to send all transactional email — signing invitations, reminder emails, account notifications.

Data shared: recipient names, recipient email addresses, signing link URLs, the document title (in subject lines).
Region: matches the customer’s data region.
Privacy policy: https://aws.amazon.com/privacy/

Payment subprocessor: Stripe (via abbpay)

We use Stripe for subscription billing and payment processing, proxied through our internal billing service abbpay.

Data shared: billing-address details, last-four card digits, subscription state. We never see or store full card numbers — Stripe tokenises them.
Region: Stripe operates from the United States with regional PCI-DSS-compliant nodes.
Privacy policy: https://stripe.com/privacy

AI document generation: Groq

We use Groq (running open-weight models including Qwen) to power the AI document drafting feature on /generate-document. The button is opt-in and only fires when a user clicks “Generate” or sends a chat message.

Data shared: the user’s prompt text and the current document HTML in the editor (when “improve this document” is requested).
What we DO NOT share: signed documents, recipient personal information, billing details. The AI feature only sees what the user types in the chat panel and the document they’re actively drafting.
Region: Groq operates from the United States.
Training: we use Groq’s API in non-training mode — content sent to Groq is not used to train their models.
Privacy policy: https://groq.com/privacy-policy/
Disable: AI generation can be turned off platform-wide via the AI_GENERATE_ENABLED environment flag.

Geolocation: db-ip.com

We use db-ip.com’s offline IP-to-country MMDB database for the signing audit log — when a recipient signs a document, we record the country they signed from. The lookup happens in-process on our servers using a downloaded MMDB file; no IP address is ever sent to db-ip.com during normal operation.

Data shared: none at request time. We download a monthly snapshot of their MMDB database via a subscriber URL.
Privacy policy: https://db-ip.com/privacy/

Hosting

The Tenrion application servers are hosted in Paris, France. Customer data in transit between Tenrion and any subprocessor is encrypted with TLS 1.2+.

Changes to this list

When we add, change, or remove a subprocessor, we’ll update this page. For material changes that affect data residency or sub-processing relationships, we’ll notify enterprise customers in advance per their DPA terms.

Questions

Email info@tenrion.com with any subprocessor questions or data processing concerns.