Processor
Lampion
Sylvain Lejamble, sole trader (EI), SIREN 947 709 275
Managed PostgreSQL database service
Hosted in France, Scaleway infrastructure
Data Processing Agreement within the meaning of Article 28 of the GDPR (General Data Protection Regulation).
This agreement supplements Lampion's Terms of Service and applies to any processing of personal data carried out by Lampion on behalf of the Customer as part of the managed PostgreSQL service.
Last updated: October 18, 2026
Identification of the parties to this agreement.
Lampion
Sylvain Lejamble, sole trader (EI), SIREN 947 709 275
Managed PostgreSQL database service
Hosted in France, Scaleway infrastructure
The Customer
Any individual or legal entity using the Lampion service and determining the purposes and means of processing the data stored in its PostgreSQL databases
Lampion acts as a processor within the meaning of Article 4(8) of the GDPR. The Customer remains the controller for all data it stores in its PostgreSQL instances. Lampion does not determine the purposes or means of processing the Customer's data.
Scope and duration of this agreement.
This DPA defines the conditions under which Lampion, as processor, undertakes to process personal data on behalf of the Customer as part of the provision of the managed PostgreSQL database service.
Processing is strictly limited to what is necessary for:
This agreement takes effect on the date the Customer registers for the Lampion service and remains in force for the entire duration of the service's use. It automatically ends when the Customer's account is closed, subject to the deletion obligations set out in section 8.
Description of the processing operations carried out by Lampion.
As part of the managed PostgreSQL service, Lampion carries out the following processing operations:
Hosting of PostgreSQL data on secure infrastructure (Neon compute + Scaleway S3 object storage)
Continuous backups via WAL (Write-Ahead Log) and periodic snapshots on S3 object storage
Collection of system metrics (CPU, memory, connections, storage) for supervision and alerting
Technical operations: PostgreSQL updates, compute scaling, restoration in the event of an incident
Lampion does not access the content of the data stored in the Customer's databases, except in the event of an explicit technical support request requiring diagnostics.
Types of personal data processed.
The categories of data processed depend exclusively on what the Customer chooses to store in its PostgreSQL databases. Lampion imposes no restriction on data types, but distinguishes two levels:
Any data the Customer inserts into its PostgreSQL instances: identification data, contact data, financial data, health data, or any other category depending on the Customer's activity. The Customer is solely responsible for the lawfulness of storing this data and for its classification.
Email address, organization name, connection logs, IP addresses, API tokens (API keys). This data is processed by Lampion as controller for the management of the service.
The data subjects concerned by the processing are determined by the Customer. They may be the Customer's own users, customers, employees, partners, or any other category of individuals whose data is stored in the PostgreSQL databases.
List of authorized sub-processors within the meaning of Article 28(2) of the GDPR.
The Customer authorizes Lampion to use the following sub-processors. Any change to this list will be notified to the Customer with 30 days notice, in accordance with Article 28(2) of the GDPR.
| Sub-processor | Purpose | Location | Data processed | Transfer outside the EU |
|---|---|---|---|---|
| ScalewayScaleway SAS | Cloud hosting of the fr-par-1 region (Kubernetes, compute, S3 object storage) | France (Paris, DC2 — Vitry-sur-Seine) | All PostgreSQL database data, backups, logs | None |
| OVH CloudOVH SAS | Hosting of the fr-gra-1 data plane (compute, storage, object storage), opening planned for Q1 2027 | France (Gravelines) | PostgreSQL databases, backups and logs of projects placed in fr-gra-1 | None |
| Grafana CloudRaintank, Inc., dba Grafana Labs (USA) | Observability (metrics, system logs, alerting) | EU (Germany); transfers to the USA possible | System metrics and infrastructure logs, which may contain technical identifiers (IP addresses, account identifiers) as well as the email address and name of console users. Never the content of Customer databases | SCC + DPF |
| ResendPlus Five Five, Inc., dba Resend (USA) | Sending transactional emails (invitations, alerts) | USA | Email addresses of Lampion account users | DPF + SCC |
| StripeStripe Payments Europe, Limited (Ireland) | Subscription billing and payment | EU (Ireland); onward transfer to Stripe, LLC (USA) | Organization billing identity, billing email, payment method (no Customer database content) | DPF; SCC as a fallback |
Transfers outside the EU. No Customer database content leaves the EU. Transfers to the USA made by Grafana Labs, Resend and Stripe only concern account data and technical data, and rely on two mechanisms: the DPF (EU-U.S. Data Privacy Framework), the European Commission adequacy decision of July 10, 2023, under which all three companies publicly state that they are certified; and the SCC (Standard Contractual Clauses of the European Commission, Implementing Decision (EU) 2021/914), incorporated into their data processing agreements.
If the Customer objects to a new sub-processor, the Customer may terminate the service without penalty within 30 days of the notification.
Physical location of all data.
France — Paris (fr-par-1)
Scaleway SAS (iliad group)
DC2, Vitry-sur-Seine (Paris area), France
Scaleway (host): ISO/IEC 27001 and HDS (French health data hosting certification), for its infrastructure. Lampion's own certifications (ISO/IEC 27001, HDS) are on the 2027 roadmap.
All PostgreSQL database data (active data, WAL backups, S3 snapshots) is stored exclusively in France, in Scaleway's DC2 datacenter (fr-par-1 region, Vitry-sur-Seine). The fr-gra-1 region (OVH Cloud, Gravelines) opens in Q1 2027.
No Customer database content leaves the EU (European Union). Account data (email addresses, billing identity) and technical data (infrastructure logs) may be processed outside the EU by the sub-processors listed in section 5, under the transfer mechanisms stated there (DPF, SCC).
For a detailed per-project location report, see the endpoint /v1/projects/{id}/residency.
Technical and organizational measures within the meaning of Article 32 of the GDPR.
Lampion implements the following technical and organizational measures to ensure data security:
Every PostgreSQL connection goes through the Lampion proxy, which requires TLS (Transport Layer Security) 1.2 minimum, with 1.3 negotiated by recent clients: unencrypted connections are refused. The console and the API are served over HTTPS only, with HSTS (HTTP Strict Transport Security). Connection strings provided by Lampion contain sslmode=require; the Customer can also use sslmode=verify-full to additionally verify the server certificate.
Being rolled out across every layer (storage volumes, S3 object storage, backups, console database), available in Q1 2027.
Role-based access control at the Lampion organization level (owner, admin, developer, viewer, analyst) and at the PostgreSQL level (native roles).
Each organization has a timestamped audit log, retained for 12 months and queryable through the API, that records console actions on projects, branches, API keys, members, roles and anonymization, as well as full data exports.
Ability to restrict access to each PostgreSQL compute to a list of authorized IP addresses (CIDR). Any connection outside the list is rejected.
Each PostgreSQL instance runs in an isolated container within the Kubernetes cluster. One Customer's data is never accessible to another Customer.
Retention policy and data deletion procedures.
Data is retained for as long as the project exists and the Customer's account is active. WAL backups and snapshots are retained according to the retention policy configured for each project.
When a project is deleted (via the console or the API), it is deactivated immediately: access is cut and its computes are stopped. The Customer then has a 7-day grace period to restore it. After that period, the project is permanently and automatically deleted: database, branches and storage. Residual copies kept by object-storage versioning are erased within the following 30 days. Technical logs are retained for 14 days.
Deleting an account or an organization deletes all associated projects through the same procedure: immediate deactivation, a 7-day grace period to restore, then permanent and automatic deletion of all corresponding data.
Upon request, Lampion provides a certificate attesting to the effective deletion of data, including purge dates and the systems concerned.
Processor assistance in responding to data subject rights requests.
In accordance with Article 28(3)(e) of the GDPR, Lampion assists the Customer in fulfilling its obligation to respond to data subject rights requests:
pg_dump or as CSV (available through the API), or obtain a full export of an endpoint: a .tar.gz archive containing a manifest with the SHA-256 fingerprint of each file, the roles (without passwords) and one custom-format pg_dump file per database, through the API (GET /v1/projects/{project_id}/endpoints/{endpoint_id}/export) or the CLI (lampion export)If Lampion directly receives a rights request from a data subject, it will inform the Customer as soon as possible without responding directly, unless legally required to do so.
Procedure in the event of a personal data breach within the meaning of Article 33 of the GDPR.
Lampion undertakes to notify the Customer of any personal data breach within a maximum of 72 hours of becoming aware of it, in accordance with Article 33(2) of the GDPR.
The notification will include at least:
Lampion will fully cooperate with the Customer to enable it to meet its own notification obligations to the supervisory authority (CNIL) and to data subjects.
Controller's right to audit the processor's compliance.
In accordance with Article 28(3)(h) of the GDPR, Lampion provides the Customer with all information necessary to demonstrate compliance with its obligations and contributes to audits.
The Customer may at any time request documentation relating to security measures, certifications, and internal policies.
The Customer or a mandated third-party auditor may carry out a compliance audit, subject to 30 days notice and a confidentiality agreement.
Audits are limited to one per calendar year, except in the event of a data breach or a request from a supervisory authority. Lampion undertakes to cooperate in good faith and to provide reasonable access to relevant information and systems.
Audit costs are borne by the Customer, unless the audit reveals a failure by Lampion to meet its obligations under this DPA.
For any question relating to this DPA or to exercise your rights, contact us at [email protected].