# Locate your data, and know who can read it

> Hosting in France, the sub-processor list, how long messages are kept, and the exact limits of a support session.
> https://facteur.eu/en/help/donnees-et-souverainete

An email testing service receives reset links, one-time codes and sometimes real
addresses. Here is where all of that sits, and who can reach it.

## Where your data is hosted

In **France**, with OVHcloud. Database, raw message storage and application services:
all in the same place.

## Who else touches it

The sub-processor list is published on the site, with **thirty days' notice** before any
addition. What you will not find on it:

- no behavioural analytics tool;
- no ad network;
- **no support tool hosted outside the European Union**;
- no third-party data warehouse;
- no remote font, no CDN, no third-party script on the site.

The usage data your billing rests on is computed and kept in our own database.

## How long your messages stay

The number of days depends on your plan. The purge removes the row **and the raw
file**, and it cannot be turned off. See
[Quotas and retention](quotas-et-retention).

## Download the DPA

Online, without having to ask. The sub-processor register too.

## What a support session lets us see

Diagnosing a problem sometimes means seeing your account as you see it. That is called a
support session, and here are its limits.

**You always know one is open.** A permanent banner nobody can dismiss, with a button to
end the session. If it is not there, there is no session.

| | |
|---|---|
| Reason | Required, recorded **before** the session opens, even if it is never used |
| Duration | One hour at most |
| Reading | Free, to diagnose |
| Writing | **Refused by default** |
| Always refused | Password, address, two-factor authentication, account deletion, SSO configuration, the shape of the organization. **No consent unlocks these** |

**If we need to change something, we ask you.** A dialog appears in your application,
with the reason exactly as we wrote it. An owner or an administrator answers from **their
own session**, never from the support session. Your consent lasts one hour at most, and
you can withdraw it at any moment from the banner without ending the session.

A refusal does not let us ask again in the same session.

**Everything is logged** in an append-only register: opening, reason, write request,
consent, refusal, withdrawal. "Why did somebody sign in to this account?" can be
answered six months later without writing to us.

## Authorise us in advance, or not

When you [ask a question from the application](https://app.facteur.eu/support), an
optional checkbox authorises us to open a support session on your organization in order
to **reproduce and diagnose** the problem you describe. It saves us writing to ask, and
it changes nothing about the limits above.

Two things to know:

- **That authorisation only lives as long as the request.** It applies to the one you
  ticked it on, and stops as soon as that request is resolved or closed. There is nothing
  for you to undo. Reopening the request restores it.
- **Not ticking it prevents nothing.** We will ask you in the thread.

## Exercise your rights

Access, rectification, erasure, portability.

Deleting [your account](https://app.facteur.eu/settings/profile) and deleting
[the organization](https://app.facteur.eu/settings/organization) are both done from the
application, immediately: see [Account and security](compte-et-securite) and
[Your organization](organisation). For anything else, the contact address is on the
site.