The data controller is the person who determines the purposes of processing and the means to be implemented.
The processor is the person who acts on behalf of the data controller and under its instructions. Sarbacane acts as a processor with regard to its clients.
Both of these actors are made accountable by the GDPR.
To go further, we invite you to consult this article on the CNIL website Controller and processor: 6 good practices to protect personal data