Pennylane
Accounting · pennylane.com · last read 2026-10-12
Identity
| Legal entity | Pennylane SAS |
|---|---|
| HQ | FR |
| Parent company | — |
| Ultimate ownership | — |
| EU contracting entity | Pennylane GmbH (and 1 other EU entity by country) |
| LEI | — |
| US CLOUD Act reach | Not determined from the sources read |
| Source | pennylane.com · 2026-10-08 |
Data location
| Region | EU data location | Minimum plan | Source | Observed |
|---|---|---|---|---|
| EU | EU by default | — | pennylane.com | 2026-10-08 |
EU: The security page says hosting and backups are on "AWS en Irlande". It states this as the platform's hosting for everyone, with no customer choice, plan or cost mentioned.
Subprocessor chain
30 third parties · 0 with a country outside the EEA · all read 2026-10-08
| Subprocessor | Country | Purpose |
|---|---|---|
| Amazon Web Services EMEA SARL | EU | Hébergement des Données du Client; Fourniture des Fonctionnalités IA - Amazon Bedrock (uniquement si Fonctionnalités IA activées) |
| Argalis | EU | Formation |
| Bird B.V. | EU | Messagerie SMS |
| Chift SRL | EU | Connecteur intégré |
| Concentrix SAS France (Webhelp) | EU | Support applicatif |
| Confluent | EU | Infrastructure de données |
| CPE conseils partenaires entreprises | EU | Migration de données |
| Cryptolog International (Universign) | EU | Vérification de l'identité dans le cadre de la plateforme agréée (PA) pour la facturation électronique |
| Gocardless SAS | EU | Paiement et prélèvements |
| Intercom R&D Unlimited Company | EU | Support applicatif |
| IT Systèmes (FlexFlow) | EU | Fourniture des services de migration (optionnel) |
| Klippa App B.V. | EU | OCR (reconnaissance optique de caractère) |
| LearnWorlds (CY) Ltd | EU | Plateforme d'académie en ligne |
| LPI Conseil SAS (Teledec) | EU | Transmission de données |
| MBD - Majorel Business Développement | EU | Support |
| Microsoft Ireland Operations, Ltd. | EU | Fourniture des Fonctionnalités IA - Azure IA (si Fonctionnalités IA activées) |
| Mindee | EU | OCR (reconnaissance optique de caractère) |
| Netapp France SAS Ocean | EU | Infrastructure de données |
| Notion Labs | EU | Outil de gestion interne, Formulaire de vérification d’identité, user research, support |
| Outscale (filiale de Dassault système) | FR | Hébergement des données de la plateforme agréée (PA) pour la facturation électronique |
| Permutation Labs SAS (Dust) | EU | Assistance IA pour le support |
| Philo labs (Birdie.so) | EU | Support applicatif |
| Pusher | EU | Notification et messagerie in-app |
| S3NS (Thalès Cloud Sécurisé SAS) | FR | Hébergement des données de la plateforme agréée (PA) pour la facturation électronique |
| Scalingo | FR | Hébergement des données de la plateforme agréée (PA) pour la facturation électronique |
| Seven communications GmbH & Co. KG (Seven.io) | EU | Messagerie |
| Taktile GmbH | EU | Vérifications anti-fraude automatisées avant l’entrée en relation |
| Vercel | EU | Hébergement et déploiement |
| Yousign SAS | EU | Archivage à valeur probante (fonctionnalité accessible selon le plan sélectionné) |
| Zendesk | EU | Support applicatif |
The count outside the EEA is arithmetic over the country column, not a judgement about lawfulness. A transfer outside the EEA can be perfectly lawful; whether this one is depends on your use, not on the vendor.
Processing terms
From the vendor's data processing agreement · read 2026-10-09 · assets.ctfassets.net
| Term | What the agreement says |
|---|---|
| Notice of new subprocessors | At least 30 days before the new subprocessor starts processing, to customers who subscribe to notifications via the subprocessor list URL |
| Notice of new subprocessors | No prior authorization or notice required; Pennylane may subcontract all or part of its obligations without informing the customer beforehand (general subcontracting clause, Article 21) |
| If you object to one | Customer must give written reasons to [email protected] within 30 business days of notice, or authorisation is deemed granted. If no agreement is reached after discussion, the customer may terminate the agreement (CGSU) with immediate effect by written notice within 30 days. This is the sole remedy. |
| Breach notification | without undue delay after becoming aware |
| Audit | Customer may audit with at least 30 days' prior written notice, bearing all associated costs (auditor fees, travel, legal fees); scope limited to GDPR compliance processes for the Solution; documents made available only via Pennylane's dedicated tools without copying; audit report to be provided to Pennylane free of charge |
| Audit | security audits by customer or independent auditor at customer's cost; max one audit per year, max 3 business days; 30 days' written notice |
Terms as the agreement states them. Where it is silent on a term, there is no row; that is not a statement that the vendor does not offer it.
Assurance
| Scheme | Status | Scope | Source | Observed |
|---|---|---|---|---|
| RGPD · GDPR | Claimed | Tous nos traitements de données à caractère personnel | pennylane.com | 2026-10-08 |
| ISO 27001 · ISO27001 | Claimed | sans exception à la norme, pour tous ses produits, opérations et sites | pennylane.com | 2026-10-08 |
Claimed means the vendor asserts the scheme on its own page and offers nothing further. Available on request means the report or certificate exists but sits behind a request, a login or an NDA. Neither is a certificate we have seen. That is a distinction an auditor makes, so we make it too.
Official registers
- ACN qualified cloud (Italy): checked 2026-10-12, no entry under Pennylane; Pennylane GmbH; Pennylane SAS
- DORA critical ICT third-party providers (ESAs): checked 2026-10-12, no entry under Pennylane; Pennylane GmbH; Pennylane SAS
- Data Privacy Framework List (US): checked 2026-10-12, no entry under Pennylane; Pennylane GmbH; Pennylane SAS
- EU Cloud Code of Conduct (GDPR Art. 40): checked 2026-10-12, no entry under Pennylane; Pennylane GmbH; Pennylane SAS
- FedRAMP Marketplace (US): checked 2026-10-12, no entry under Pennylane; Pennylane GmbH; Pennylane SAS
- SecNumCloud qualified services (ANSSI, France): checked 2026-10-12, no entry under Pennylane; Pennylane GmbH; Pennylane SAS
What the authority publishes, not what the vendor claims. An entry covers the offering it names and nothing else: a FedRAMP authorisation for a government edition says nothing about the commercial service. No entry is not a finding about security - most vendors never apply - and an entry filed under a name not listed above would not have been found.
Support window
Not yet collected. This row will say not declared only once we have read a lifecycle or security page and found no period stated — see support windows.
Vulnerability reporting: no security.txt at the well-known path (read 2026-10-11)
Documents
| Document | Disclosure | Transcription | HTTP | Observed |
|---|---|---|---|---|
| certifications | Public | full | 200 | 2026-10-08 |
| dpa | Public | full | 200 | 2026-10-09 |
| residency | Public | full | 200 | 2026-10-08 |
| subprocessors | Public | full | 200 | 2026-10-08 |
History
Nothing has moved since we started watching this vendor on 2026-10-08. Changes appear here only after a human has reviewed them.