Subprocessors, UltiSuite

Scope

This page lists only external subprocessors that may receive personal data outside the UltiSuite infrastructure you use.

Software components running on your own infrastructure (Authentik, Nextcloud, database, object storage, etc.) are not subprocessors within the meaning of the GDPR: they are part of your UltiSuite deployment.

The list below is generated dynamically according to integrations actually enabled on this instance.

Hosting

UltiSuite infrastructure is hosted with the provider configured for this instance (PRIVACY_HOSTING_PROVIDER variable, typically OVH in France / EU).

The hosting provider and declared region appear dynamically below via the disclosure API.

Personal data remains within this perimeter unless an external integration listed below is enabled.

Enabled external subprocessors

Only external services configured on this instance appear below.

Contact

For any question about subprocessors, contact your UltiSuite organization administrator.

Dynamic list

Loading subprocessors list…

Suite apps

Each app has its own section via URL anchor, for example #ultidocs.

Ultimail

mail, composition, attachments, linked contacts and mail search.

Ultimail processes emails, headers, recipients, drafts, attachments and preferences necessary for the service.
Message content is not used for advertising or sold to third parties.
Mail data is hosted on OVH infrastructure used by UltiSuite.

UltiDrive

storage, organization, sharing and file preview.

UltiDrive processes files, file names, metadata, sharing rights and technical histories useful to the service.
Files are retained as long as the account, workspace or organization maintains them, unless law requires otherwise.
Access and sensitive operations may be logged for security and audit.

UltiDocs

collaborative documents, rich editing, comments and writing aids.

UltiDocs processes document content, technical collaboration history, selections, comments and editing preferences.
Personal dictionaries and editing settings remain linked to the account or browser depending on user configuration.
Writing-aid processing runs in the UltiSuite environment hosted at OVH, without a third-party service provider.

UltiCal

calendar, invitations, availability and shared events.

UltiCal processes titles, locations, times, participants, responses, event notes and reminders.
Availability may be visible according to account or organization settings.
Calendar data is hosted at OVH with the rest of the suite.

UltiMeet

meetings, rooms, invitation links and video conferencing.

UltiMeet processes meeting information, participants, room settings and connection technical data.
Audio/video streams are used to provide communication and are not exploited for advertising.
Technical logs may be retained for security, diagnosis and service quality.

UltiCards

contacts, address books, records and correspondent discovery.

UltiCards processes names, email addresses, phones, organizations, notes and relationship metadata.
Contacts support addressing, search, suggestions and address book management.
Contact data is not resold or used for advertising targeting.

UltiAI

assistant, completion, writing aid and intelligent automations.

UltiAI processes prompts, provided contexts and results necessary for the user's request.
UltiSuite does not use an external service provider for UltiAI; declared infrastructure is OVH.
Data is not used to train an advertising or third-party model.

Administration

organization console, accounts, policies, security and global settings.

The console processes identities, roles, organization settings, security policies and administration logs.
Audit logs help protect accounts, prove certain actions and diagnose incidents.
Administrators may access certain metadata according to their rights and organization settings.

UltiSuite account

profile, authentication, preferences, sessions and personal settings.

The account processes identity, email, preferences, sessions, security settings and sign-in logs.
This data is used to authenticate the user, maintain security and personalize the experience.
The user may request access, rectification, deletion or export under applicable conditions.