{ "version": 1, "lastModified": "2026-08-02", "noticePeriodDays": 30, "establishedOn": "2026-07-15", "subprocessors": [ { "id": "mistral", "legalName": "Mistral AI SAS", "jurisdiction": "FR", "registeredOffice": "Paris, France", "parent": null, "processingLocations": [ { "kind": "region", "country": "FR", "label": "eu-west (France)" } ], "layers": [ "inference" ], "purpose": "LLM generation: chat answers, planning, agent loop, vision, and input moderation. The sole generation provider; there is no non-EU fallback.", "scope": "Prompts carry user queries plus retrieved document excerpts. Zero-retention and training opt-out are account-level settings with this provider, not per-request, so they are recorded here rather than asserted per call.", "role": "dpv:DataProcessor", "personalDataCategories": [ "pd:Name", "pd:UserAgent" ], "transferBasis": { "kind": "eu-only" }, "cloudActExposed": false, "status": "live", "addedOn": "2026-07-15", "effectiveFrom": "2026-07-15", "removedOn": null, "dpaUrl": null, "dpaSigned": false, "retention": null, "noTrainingFlowDown": { "committed": false, "mechanism": "Contractual and unconditional on a paid plan: Commercial Terms of Service section 4.2 (Training) states Mistral AI will not use Customer Data or Outputs to train its models, excepting free subscriptions and the Vibe products where the customer has not opted out. Section 4.3 carves out Labs Models, which we do not use (generation and vision run on mistral-small). NOT in force yet only because the production paid subscription is not provisioned; it flips to true with the production key.", "sourceUrl": "https://legal.mistral.ai/terms/commercial-terms-of-service", "verifiedOn": "2026-07-27" }, "subProcessors": { "finding": "named", "entries": [ { "legalName": "Mistral Compute", "jurisdiction": "FR", "purpose": "Cloud infrastructure for all products. Their own compute arm rather than an external party." }, { "legalName": "Microsoft Inc.", "jurisdiction": null, "purpose": "Cloud infrastructure. Processing stated as Sweden and Norway." }, { "legalName": "Google LLC", "jurisdiction": null, "purpose": "Cloud infrastructure. Processing stated as Netherlands, Belgium and the United States." }, { "legalName": "CoreWeave Inc.", "jurisdiction": null, "purpose": "Inference provider. Processing stated as the EEA." }, { "legalName": "Cloudflare Inc.", "jurisdiction": null, "purpose": "Security and traffic routing. Processing stated as worldwide." } ], "sourceUrl": "https://trust.mistral.ai/subprocessors", "verifiedOn": "2026-07-31", "note": "Their disclosure lists 24 parties, several scoped to products we do not use. Recorded here are the infrastructure and inference providers whose stated scope covers the API. Their page states processing regions rather than countries of incorporation, so those regions are given in each purpose and jurisdiction is left unstated." } }, { "id": "jina-ai", "legalName": "Jina AI GmbH", "jurisdiction": "DE", "registeredOffice": "Berlin, Germany", "parent": { "legalName": "Elastic N.V.", "jurisdiction": "US" }, "processingLocations": [ { "kind": "region", "country": "DE", "label": "eu-central (Berlin)" } ], "layers": [ "inference" ], "purpose": "Text embeddings and reranking for retrieval.", "scope": "Refused for customer data since 31 July 2026: the platform will not start in production with this provider configured for embeddings, so it cannot process customer content. It stays listed because the credential is still read in development, and it remains the development default until the EU replacement is in place: embedding and reranking models we host ourselves on EU hardware, or a managed API under EU jurisdiction.", "role": "dpv:DataProcessor", "personalDataCategories": [ "pd:Name" ], "transferBasis": { "kind": "unresolved", "reason": "Processing is in Germany, but the parent company is outside the EEA, so remote access is a Chapter V transfer under EDPB Guidelines 05/2021. The applicable basis is being confirmed against the signed DPA and is not settled yet." }, "cloudActExposed": true, "status": "live", "addedOn": "2026-07-15", "effectiveFrom": "2026-07-15", "removedOn": null, "dpaUrl": null, "dpaSigned": false, "retention": { "summary": "No zero-data-retention commitment for the API: their terms permit retaining customer-submitted data in anonymised/pseudonymised form for business purposes including model improvement, and the privacy policy carves API content out to customer agreements. No DPA signed. Named residual until the planned self-hosted embedding cutover.", "sourceUrl": "https://jina.ai/legal/", "verifiedOn": "2026-07-22" }, "noTrainingFlowDown": { "committed": false, "mechanism": "SUPERSEDED BY THE ACQUISITION. Jina AI Terms section 10.4 carried a clean unconditional commitment (\"Jina AI does not use Customer request data, inputs, prompts, or uploaded content to train its models\"), but Jina AI’s own legal page states that following Elastic’s October 2025 acquisition, data processing is governed by Elastic’s Customer DPA rather than the legacy Jina terms. Elastic’s published privacy statement carries a non-training commitment only for marketing data handled by third-party vendors, and does not address customer data submitted to Jina APIs. The flow-down is therefore not established today and needs the signed Elastic Customer DPA to resolve.", "sourceUrl": "https://jina.ai/legal/", "verifiedOn": "2026-07-27" }, "subProcessors": null }, { "id": "supabase", "legalName": "Supabase, Inc.", "jurisdiction": "US", "registeredOffice": "Delaware, United States", "parent": null, "processingLocations": [ { "kind": "region", "country": "IE", "label": "aws eu-west-1 (Ireland)" } ], "layers": [ "storage" ], "purpose": "Primary datastore: Postgres (documents, chunks, embeddings, tenants), authentication, and default object storage.", "scope": "Being replaced by our own Postgres and object storage on EU hardware. That migration has not started; until it lands, this provider holds the document corpus.", "role": "dpv:DataProcessor", "personalDataCategories": [ "pd:Name", "pd:EmailAddress", "pd:Password", "pd:UserAgent" ], "transferBasis": { "kind": "unresolved", "reason": "Data rests in an EU region but the provider is US-incorporated, so remote access is a Chapter V transfer. The applicable basis is being confirmed against the signed DPA." }, "cloudActExposed": true, "status": "live", "addedOn": "2026-07-15", "effectiveFrom": "2026-07-15", "removedOn": null, "dpaUrl": null, "dpaSigned": false, "retention": null, "noTrainingFlowDown": null, "subProcessors": { "finding": "named", "entries": [ { "legalName": "Amazon Web Services, Inc", "jurisdiction": null, "purpose": "Hosting." }, { "legalName": "Cloudflare, Inc", "jurisdiction": null, "purpose": "Hosting." }, { "legalName": "Google, LLC", "jurisdiction": null, "purpose": "Hosting." }, { "legalName": "Fly.io, Inc", "jurisdiction": null, "purpose": "Hosting." }, { "legalName": "Upstash, Inc", "jurisdiction": null, "purpose": "Serverless data hosting. Also a sub-processor of ours in its own right." }, { "legalName": "Vercel, Inc", "jurisdiction": null, "purpose": "Hosting. Also a sub-processor of ours in its own right." } ], "sourceUrl": "https://supabase.com/legal/customer-resources/subprocessor-list", "verifiedOn": "2026-07-31", "note": "Their list is dated 1 June 2026 and names 19 parties without stating any country, so no jurisdiction is recorded for any of them. Recorded here are the six hosting providers; the remainder are their own support, sales and analytics tooling." } }, { "id": "upstash", "legalName": "Upstash, Inc.", "jurisdiction": "US", "registeredOffice": "California, United States", "parent": null, "processingLocations": [ { "kind": "unconfirmed", "note": "Region is not pinned in code and the vendor's deployment region for this database has not been evidenced. Holds IP addresses and session identifiers, so Art. 30(1)(d)-(e) cannot be answered for it." } ], "layers": [ "storage" ], "purpose": "Redis: API rate limiting, session revocation, embedding cache, and impossible-travel detection.", "scope": "Being replaced by a cache we host ourselves on EU hardware. That migration has not started; until it lands, this provider serves the rate-limit and cache layer.", "role": "dpv:DataProcessor", "personalDataCategories": [ "pd:IPAddress", "pd:Location", "pd:UID" ], "transferBasis": { "kind": "unresolved", "reason": "US-incorporated processor holding IP addresses and session identifiers. Region is not pinned in code and the basis is not evidenced. This is a hard boot dependency: UPSTASH_REDIS_REST_URL is required, not optional." }, "cloudActExposed": true, "status": "live", "addedOn": "2026-07-15", "effectiveFrom": "2026-07-15", "removedOn": null, "dpaUrl": null, "dpaSigned": false, "retention": null, "noTrainingFlowDown": null, "subProcessors": { "finding": "named", "entries": [ { "legalName": "Amazon Web Services", "jurisdiction": "US", "purpose": "Cloud provider." }, { "legalName": "Google", "jurisdiction": "US", "purpose": "Cloud provider." }, { "legalName": "Cloudflare, Inc.", "jurisdiction": "US", "purpose": "Cloud services." }, { "legalName": "Humio (CrowdStrike Falcon LogScale)", "jurisdiction": "DK", "purpose": "Logging." } ], "sourceUrl": "https://upstash.com/trust/subprocessors.pdf", "verifiedOn": "2026-07-31", "note": "Their document states an address per party, used here as the jurisdiction. Several entries are scoped to products of theirs we do not use; those are excluded. Recorded here are the providers that could sit under the Redis service we consume." } }, { "id": "cloudflare", "legalName": "Cloudflare, Inc.", "jurisdiction": "US", "registeredOffice": "Delaware, United States", "parent": null, "processingLocations": [ { "kind": "global", "label": "global edge (anycast)" } ], "layers": [ "transit" ], "purpose": "DNS. The apex is currently also reverse-proxied, so Cloudflare terminates TLS for it.", "scope": "Our decided posture is DNS-only, which would leave this provider handling name resolution but not request content. The apex domain is still proxied today, so it currently terminates TLS and sees request bodies. This row states what is true now, not the intended end state.", "role": "dpv:DataProcessor", "personalDataCategories": [ "pd:IPAddress", "pd:UserAgent" ], "transferBasis": { "kind": "unresolved", "reason": "The apex A record is currently proxied, so TLS terminates at the provider and full request bodies pass through it; the www hostname is DNS-only. The decided posture is DNS-only for both, under which the provider handles DNS metadata rather than customer content. This row is reassessed once the apex is switched." }, "cloudActExposed": true, "status": "live", "addedOn": "2026-07-15", "effectiveFrom": "2026-07-15", "removedOn": null, "dpaUrl": null, "dpaSigned": false, "retention": null, "noTrainingFlowDown": null, "subProcessors": { "finding": "named", "entries": [ { "legalName": "Amazon Web Services (AWS)", "jurisdiction": null, "purpose": "Email Security product. Processing stated as United States and EEA." }, { "legalName": "Google LLC", "jurisdiction": null, "purpose": "Developer Platform, Zero Trust and AI Gateway. Processing stated as EEA, United States, Australia and India." }, { "legalName": "Oracle America, Inc.", "jurisdiction": null, "purpose": "Developer Platform and Cache Reserve. Processing stated across United States, EEA, UK, Japan, Australia, Canada and Singapore." }, { "legalName": "CoreWeave, Inc.", "jurisdiction": null, "purpose": "Workers AI. Processing stated as United States." }, { "legalName": "Nebius BV", "jurisdiction": null, "purpose": "Workers AI. Processing stated as England." } ], "sourceUrl": "https://www.cloudflare.com/gdpr/subprocessors/cloudflare-services", "verifiedOn": "2026-07-31", "note": "Their list is dated 1 October 2025 and states processing regions rather than countries of incorporation, so regions are given in each purpose. It also names 16 of their own group affiliates, which are not recorded here as external parties. Every entry below is scoped by them to a specific product; none is stated to apply to DNS." } }, { "id": "sentry", "legalName": "Functional Software, Inc.", "jurisdiction": "US", "registeredOffice": "California, United States", "parent": null, "processingLocations": [ { "kind": "region", "country": "DE", "label": "ingest.de.sentry.io (Germany)" }, { "kind": "region", "country": "US", "label": "US region (Iowa) for account and operational metadata stored outside the selected region regardless of setting (cron check-ins, org settings and audit logs, project metadata, DSN keys, tokens, usage data); uptime checks are stored in both regions. No customer personal data." } ], "layers": [ "telemetry" ], "purpose": "Application error and performance monitoring.", "scope": "EU ingest is enforced in code: the client fails closed rather than sending to a non-EU endpoint, so error events, spans and logs are stored in Frankfurt. Sentry nonetheless stores account and operational metadata in the US regardless of the selected region (cron check-ins, org settings and audit logs, project metadata, DSN keys, access tokens, usage data) and stores uptime checks in both regions. None of it carries customer personal data, so no Chapter V transfer arises from that half; it is nonetheless a US-storage residual of this vendor, and like the retention residual above it closes at the 0F Bugsink cutover, when error tracking, cron heartbeat and uptime checks all move to infrastructure we host.", "role": "dpv:DataProcessor", "personalDataCategories": [ "pd:UID", "pd:UserAgent" ], "transferBasis": { "kind": "unresolved", "reason": "Ingest is pinned to the EU region by a fail-closed guard, but the entity is US-incorporated so remote access remains a Chapter V question. Basis must be confirmed against the signed DPA." }, "cloudActExposed": true, "status": "live", "addedOn": "2026-07-15", "effectiveFrom": "2026-07-15", "removedOn": null, "dpaUrl": null, "dpaSigned": false, "retention": { "summary": "90-day rolling event retention (vendor-documented: 90 days on paid plans, 30 on free; mirrored in docs/compliance/data-retention-policy.md); event.user.email attaches for consent-granted users and has no erasure hook, so it outlives an erasure request until the 90-day roll-off. Named residual in the erasure-propagation register; closes at the 0F Bugsink cutover.", "sourceUrl": "https://sentry.zendesk.com/hc/en-us/articles/27118913621019", "verifiedOn": "2026-07-22" }, "noTrainingFlowDown": null, "subProcessors": { "finding": "named", "entries": [ { "legalName": "Amazon Web Services, Inc.", "jurisdiction": null, "purpose": "Cloud infrastructure. Processing stated as EU and United States." }, { "legalName": "Cloudflare, Inc.", "jurisdiction": null, "purpose": "Cloud infrastructure. Processing stated as EU and United States." }, { "legalName": "Google LLC", "jurisdiction": null, "purpose": "Cloud infrastructure. Processing stated as EU and United States." } ], "sourceUrl": "https://sentry.io/legal/subprocessors", "verifiedOn": "2026-07-31", "note": "Their list is version 2.3.0 dated 1 June 2026 and states processing regions rather than countries of incorporation. Recorded here are the three cloud providers; the remainder are their email, support and group affiliates." } }, { "id": "brevo", "legalName": "Sendinblue SAS (Brevo)", "jurisdiction": "FR", "registeredOffice": "Paris, France", "parent": null, "processingLocations": [ { "kind": "region", "country": "FR", "label": "eu-west (France)" } ], "layers": [ "communications" ], "purpose": "Transactional email (notifications, account mail).", "scope": "Inert until BREVO_API_KEY is provisioned.", "role": "dpv:DataProcessor", "personalDataCategories": [ "pd:EmailAddress", "pd:Name" ], "transferBasis": { "kind": "eu-only" }, "cloudActExposed": false, "status": "live", "addedOn": "2026-07-15", "effectiveFrom": "2026-07-15", "removedOn": null, "dpaUrl": null, "dpaSigned": false, "retention": { "summary": "Transactional EVENT logs (recipient, subject, delivery events) are stored indefinitely by default until an account retention rule is set (1 month to 5 years); email BODIES are not stored by default (\"Never store previews\" is the default). Provisioning checklist sets the 1-3 month rule in the same session as the key.", "sourceUrl": "https://help.brevo.com/hc/en-us/articles/4415743225746", "verifiedOn": "2026-07-22" }, "noTrainingFlowDown": null, "subProcessors": { "finding": "named", "entries": [ { "legalName": "Google Cloud Platform", "jurisdiction": "FR", "purpose": "Hosting. Servers stated as Belgium." }, { "legalName": "Scaleway (Iliad)", "jurisdiction": "FR", "purpose": "Hosting. Servers stated as France." }, { "legalName": "OVH", "jurisdiction": "FR", "purpose": "Hosting. Servers stated as France." }, { "legalName": "Hetzner Online GmbH", "jurisdiction": "DE", "purpose": "Hosting. Servers stated as Germany. Also a sub-processor of ours in its own right." }, { "legalName": "Cloudflare", "jurisdiction": "US", "purpose": "CDN and WAF. Servers stated as United States and EU." } ], "sourceUrl": "https://corp-backend.brevo.com/wp-content/uploads/2024/08/BREVO-Annex-2-DPA-150524.pdf", "verifiedOn": "2026-07-31", "note": "Their DPA annex separates infrastructure sub-processors from the rest and states a registered office for each, used here as the jurisdiction. Recorded here is that infrastructure section." } }, { "id": "hetzner", "legalName": "Hetzner Online GmbH", "jurisdiction": "DE", "registeredOffice": "Gunzenhausen, Germany", "parent": null, "processingLocations": [ { "kind": "region", "country": "DE", "label": "nbg1 (Nuremberg)" } ], "layers": [ "storage" ], "purpose": "S3-compatible object storage for raw document bytes.", "scope": "Engaged only when STORAGE_PROVIDER=s3; the default storage provider is Supabase.", "role": "dpv:DataProcessor", "personalDataCategories": [ "pd:Name" ], "transferBasis": { "kind": "eu-only" }, "cloudActExposed": false, "status": "live", "addedOn": "2026-07-15", "effectiveFrom": "2026-07-15", "removedOn": null, "dpaUrl": null, "dpaSigned": false, "retention": null, "noTrainingFlowDown": null, "subProcessors": { "finding": "named", "entries": [ { "legalName": "Hetzner Finland Oy", "jurisdiction": "FI", "purpose": "Building rental and technical support.", "engagement": "in-path" }, { "legalName": "Hetzner US LLC", "jurisdiction": "US", "purpose": "Server rental for their US site.", "engagement": "out-of-path" }, { "legalName": "NTT Global Data Centers Americas, Inc.", "jurisdiction": "US", "purpose": "Colocation for their US site.", "engagement": "out-of-path" }, { "legalName": "QTS Investment Properties Hillsboro, LLC", "jurisdiction": "US", "purpose": "Colocation for their US site.", "engagement": "out-of-path" }, { "legalName": "Hetzner Singapore Pte. Ltd.", "jurisdiction": "SG", "purpose": "Server rental for their Singapore site.", "engagement": "out-of-path" }, { "legalName": "NTT Global Data Centers SG1 Pte Ltd", "jurisdiction": "SG", "purpose": "Colocation for their Singapore site.", "engagement": "out-of-path" } ], "sourceUrl": "https://www.hetzner.com/AV/subunternehmer.pdf", "verifiedOn": "2026-07-31", "note": "Their annex is version 1.0 dated 6 August 2024 and names six parties, all of them infrastructure, with a location for each. They state that data on EU-located servers is processed exclusively within the EU; the non-EU entities below serve their US and Singapore sites, which we do not use." } }, { "id": "vercel", "legalName": "Vercel Inc.", "jurisdiction": "US", "registeredOffice": "California, United States", "parent": null, "processingLocations": [ { "kind": "global", "label": "global edge" } ], "layers": [ "transit" ], "purpose": "Application hosting and scheduled jobs (current deployment target).", "scope": "Being replaced by application hosting we run ourselves on EU hardware. That migration has not started; until it lands, this provider serves the application.", "role": "dpv:DataProcessor", "personalDataCategories": [ "pd:IPAddress", "pd:UserAgent" ], "transferBasis": { "kind": "unresolved", "reason": "US-incorporated host handling the full request path. Basis must be confirmed against the signed DPA." }, "cloudActExposed": true, "status": "live", "addedOn": "2026-07-15", "effectiveFrom": "2026-07-15", "removedOn": null, "dpaUrl": null, "dpaSigned": false, "retention": null, "noTrainingFlowDown": null, "subProcessors": { "finding": "named", "entries": [ { "legalName": "Amazon Web Services, Inc.", "jurisdiction": "US", "purpose": "Hosting, storage and generative AI." }, { "legalName": "Google LLC", "jurisdiction": "US", "purpose": "Cloud computing, storage and generative AI." }, { "legalName": "Microsoft Corporation", "jurisdiction": "US", "purpose": "Hosting, storage and generative AI." }, { "legalName": "Upstash, Inc.", "jurisdiction": "US", "purpose": "Serverless storage. Also a sub-processor of ours in its own right." }, { "legalName": "Neon", "jurisdiction": "US", "purpose": "Serverless storage." }, { "legalName": "Redis Labs, Inc.", "jurisdiction": "US", "purpose": "Real-time logging and security." } ], "sourceUrl": "https://security.vercel.com/subprocessors", "verifiedOn": "2026-07-31", "note": "Their list names 28 parties with a location each, used here as the jurisdiction. Recorded here are the six providing hosting or storage; the remainder are their monitoring, support and AI-feature vendors." } }, { "id": "netcup", "legalName": "netcup GmbH", "jurisdiction": "DE", "registeredOffice": "Karlsruhe, Germany", "parent": null, "processingLocations": [ { "kind": "region", "country": "DE", "label": "Nuremberg (EU)" } ], "layers": [ "transit", "storage" ], "purpose": "Application + worker hosting (target architecture): the Next.js app, the BullMQ worker, and the self-hosted sidecars (Valkey, SearXNG, MarkItDown, Bugsink, embedding/rerank) run on a single EU box. Replaces Vercel.", "scope": "Announced, not yet processing. Will provide EU compute for the services we host ourselves. Software we run on it is our own and is not a separate sub-processor.", "role": "dpv:DataProcessor", "personalDataCategories": [ "pd:Name", "pd:EmailAddress", "pd:IPAddress", "pd:UserAgent" ], "transferBasis": { "kind": "eu-only" }, "cloudActExposed": false, "status": "planned", "addedOn": "2026-07-15", "effectiveFrom": "2026-08-14", "removedOn": null, "dpaUrl": null, "dpaSigned": false, "retention": null, "noTrainingFlowDown": null, "subProcessors": { "finding": "named", "entries": [ { "legalName": "Hetzner Online GmbH", "jurisdiction": "DE", "purpose": "Colocation data centre, Nuremberg. Also a sub-processor of ours in its own right." }, { "legalName": "DATASIX Rechenzentrumsbetriebs GmbH", "jurisdiction": "AT", "purpose": "Data centre operator, Vienna." } ], "sourceUrl": "https://www.netcup.com/en/legal/privacy-policy", "verifiedOn": "2026-07-31", "note": "They publish no standalone sub-processor page; the parties below are named in their Art 28 processing agreement, which reaches a customer only on execution. That is a weaker disclosure mechanism than the click-through lists every other vendor here offers, and it is recorded as such." } }, { "id": "bunny", "legalName": "BunnyWay d.o.o. (Bunny.net)", "jurisdiction": "SI", "registeredOffice": "Ljubljana, Slovenia", "parent": null, "processingLocations": [ { "kind": "region", "country": "SI", "label": "EU edge (pinned)" } ], "layers": [ "transit" ], "purpose": "Content delivery network for static assets and document byte serving (target architecture).", "scope": "Announced, not yet processing. Before it is enabled, its pull zone has to be pinned to European edge locations; that pinning is a configuration we set at provisioning, not a property of the service, so it is a step we owe rather than an assurance we can give today.", "role": "dpv:DataProcessor", "personalDataCategories": [ "pd:IPAddress", "pd:UserAgent" ], "transferBasis": { "kind": "eu-only" }, "cloudActExposed": false, "status": "planned", "addedOn": "2026-07-15", "effectiveFrom": "2026-08-14", "removedOn": null, "dpaUrl": null, "dpaSigned": false, "retention": null, "noTrainingFlowDown": null, "subProcessors": { "finding": "not-covered", "sourceUrl": "https://bunny.net/gdpr/sub-processors/", "verifiedOn": "2026-07-31", "note": "Their disclosure names six parties, none of which is an infrastructure, colocation or network provider: it covers their support desk, email, bug tracking and one AI feature vendor. So the parties behind their edge network are not disclosed by them. The empty list here records that absence rather than an assurance that none exists." } } ], "history": [ { "revision": 1, "recordedOn": "2026-07-15", "summary": "Register established: the nine processors in use plus the two announced EU replacements.", "changes": [ { "op": "added", "id": "brevo", "row": { "id": "brevo", "legalName": "Sendinblue SAS (Brevo)", "jurisdiction": "FR", "registeredOffice": "Paris, France", "parent": null, "processingLocations": [ { "kind": "region", "country": "FR", "label": "eu-west (France)" } ], "layers": [ "communications" ], "purpose": "Transactional email (notifications, account mail).", "scope": "Inert until BREVO_API_KEY is provisioned.", "role": "dpv:DataProcessor", "personalDataCategories": [ "pd:EmailAddress", "pd:Name" ], "transferBasis": { "kind": "eu-only" }, "cloudActExposed": false, "status": "live", "addedOn": "2026-07-15", "effectiveFrom": "2026-07-15", "removedOn": null, "dpaUrl": null, "dpaSigned": false, "retention": { "summary": "Transactional EVENT logs (recipient, subject, delivery events) are stored indefinitely by default until an account retention rule is set (1 month to 5 years); email BODIES are not stored by default (\"Never store previews\" is the default). Provisioning checklist sets the 1-3 month rule in the same session as the key.", "sourceUrl": "https://help.brevo.com/hc/en-us/articles/4415743225746", "verifiedOn": "2026-07-22" }, "noTrainingFlowDown": null, "subProcessors": null } }, { "op": "added", "id": "bunny", "row": { "id": "bunny", "legalName": "BunnyWay d.o.o. (Bunny.net)", "jurisdiction": "SI", "registeredOffice": "Ljubljana, Slovenia", "parent": null, "processingLocations": [ { "kind": "region", "country": "SI", "label": "EU edge (pinned)" } ], "layers": [ "transit" ], "purpose": "Content delivery network for static assets and document byte serving (target architecture).", "scope": "Announced, not yet processing. Will serve static assets from EU-only edge locations, pinned so cached bytes stay within the EU.", "role": "dpv:DataProcessor", "personalDataCategories": [ "pd:IPAddress", "pd:UserAgent" ], "transferBasis": { "kind": "eu-only" }, "cloudActExposed": false, "status": "planned", "addedOn": "2026-07-15", "effectiveFrom": "2026-08-14", "removedOn": null, "dpaUrl": null, "dpaSigned": false, "retention": null, "noTrainingFlowDown": null, "subProcessors": null } }, { "op": "added", "id": "cloudflare", "row": { "id": "cloudflare", "legalName": "Cloudflare, Inc.", "jurisdiction": "US", "registeredOffice": "Delaware, United States", "parent": null, "processingLocations": [ { "kind": "global", "label": "global edge (anycast)" } ], "layers": [ "transit" ], "purpose": "DNS. The apex is currently also reverse-proxied, so Cloudflare terminates TLS for it.", "scope": "Our decided posture is DNS-only, which would leave this provider handling name resolution but not request content. The apex domain is still proxied today, so it currently terminates TLS and sees request bodies. This row states what is true now, not the intended end state.", "role": "dpv:DataProcessor", "personalDataCategories": [ "pd:IPAddress", "pd:UserAgent" ], "transferBasis": { "kind": "unresolved", "reason": "The apex A record is currently proxied, so TLS terminates at the provider and full request bodies pass through it; the www hostname is DNS-only. The decided posture is DNS-only for both, under which the provider handles DNS metadata rather than customer content. This row is reassessed once the apex is switched." }, "cloudActExposed": true, "status": "live", "addedOn": "2026-07-15", "effectiveFrom": "2026-07-15", "removedOn": null, "dpaUrl": null, "dpaSigned": false, "retention": null, "noTrainingFlowDown": null, "subProcessors": null } }, { "op": "added", "id": "hetzner", "row": { "id": "hetzner", "legalName": "Hetzner Online GmbH", "jurisdiction": "DE", "registeredOffice": "Gunzenhausen, Germany", "parent": null, "processingLocations": [ { "kind": "region", "country": "DE", "label": "nbg1 (Nuremberg)" } ], "layers": [ "storage" ], "purpose": "S3-compatible object storage for raw document bytes.", "scope": "Engaged only when STORAGE_PROVIDER=s3; the default storage provider is Supabase.", "role": "dpv:DataProcessor", "personalDataCategories": [ "pd:Name" ], "transferBasis": { "kind": "eu-only" }, "cloudActExposed": false, "status": "live", "addedOn": "2026-07-15", "effectiveFrom": "2026-07-15", "removedOn": null, "dpaUrl": null, "dpaSigned": false, "retention": null, "noTrainingFlowDown": null, "subProcessors": null } }, { "op": "added", "id": "jina-ai", "row": { "id": "jina-ai", "legalName": "Jina AI GmbH", "jurisdiction": "DE", "registeredOffice": "Berlin, Germany", "parent": { "legalName": "Elastic N.V.", "jurisdiction": "US" }, "processingLocations": [ { "kind": "region", "country": "DE", "label": "eu-central (Berlin)" } ], "layers": [ "inference" ], "purpose": "Text embeddings and reranking for retrieval.", "scope": "Refused for customer data since 31 July 2026: the platform will not start in production with this provider configured for embeddings, so it cannot process customer content. It stays listed because the credential is still read in development, and it remains the development default until the EU replacement is in place: embedding and reranking models we host ourselves on EU hardware, or a managed API under EU jurisdiction.", "role": "dpv:DataProcessor", "personalDataCategories": [ "pd:Name" ], "transferBasis": { "kind": "unresolved", "reason": "Processing is in Germany, but the parent company is outside the EEA, so remote access is a Chapter V transfer under EDPB Guidelines 05/2021. The applicable basis is being confirmed against the signed DPA and is not settled yet." }, "cloudActExposed": true, "status": "live", "addedOn": "2026-07-15", "effectiveFrom": "2026-07-15", "removedOn": null, "dpaUrl": null, "dpaSigned": false, "retention": { "summary": "No zero-data-retention commitment for the API: their terms permit retaining customer-submitted data in anonymised/pseudonymised form for business purposes including model improvement, and the privacy policy carves API content out to customer agreements. No DPA signed. Named residual until the planned self-hosted embedding cutover.", "sourceUrl": "https://jina.ai/legal/", "verifiedOn": "2026-07-22" }, "noTrainingFlowDown": { "committed": false, "mechanism": "SUPERSEDED BY THE ACQUISITION. Jina AI Terms section 10.4 carried a clean unconditional commitment (\"Jina AI does not use Customer request data, inputs, prompts, or uploaded content to train its models\"), but Jina AI’s own legal page states that following Elastic’s October 2025 acquisition, data processing is governed by Elastic’s Customer DPA rather than the legacy Jina terms. Elastic’s published privacy statement carries a non-training commitment only for marketing data handled by third-party vendors, and does not address customer data submitted to Jina APIs. The flow-down is therefore not established today and needs the signed Elastic Customer DPA to resolve.", "sourceUrl": "https://jina.ai/legal/", "verifiedOn": "2026-07-27" }, "subProcessors": null } }, { "op": "added", "id": "mistral", "row": { "id": "mistral", "legalName": "Mistral AI SAS", "jurisdiction": "FR", "registeredOffice": "Paris, France", "parent": null, "processingLocations": [ { "kind": "region", "country": "FR", "label": "eu-west (France)" } ], "layers": [ "inference" ], "purpose": "LLM generation: chat answers, planning, agent loop, vision, and input moderation. The sole generation provider; there is no non-EU fallback.", "scope": "Prompts carry user queries plus retrieved document excerpts. Zero-retention and training opt-out are account-level settings with this provider, not per-request, so they are recorded here rather than asserted per call.", "role": "dpv:DataProcessor", "personalDataCategories": [ "pd:Name", "pd:UserAgent" ], "transferBasis": { "kind": "eu-only" }, "cloudActExposed": false, "status": "live", "addedOn": "2026-07-15", "effectiveFrom": "2026-07-15", "removedOn": null, "dpaUrl": null, "dpaSigned": false, "retention": null, "noTrainingFlowDown": { "committed": false, "mechanism": "Contractual and unconditional on a paid plan: Commercial Terms of Service section 4.2 (Training) states Mistral AI will not use Customer Data or Outputs to train its models, excepting free subscriptions and the Vibe products where the customer has not opted out. Section 4.3 carves out Labs Models, which we do not use (generation and vision run on mistral-small). NOT in force yet only because the production paid subscription is not provisioned; it flips to true with the production key.", "sourceUrl": "https://legal.mistral.ai/terms/commercial-terms-of-service", "verifiedOn": "2026-07-27" }, "subProcessors": null } }, { "op": "added", "id": "netcup", "row": { "id": "netcup", "legalName": "netcup GmbH", "jurisdiction": "DE", "registeredOffice": "Karlsruhe, Germany", "parent": null, "processingLocations": [ { "kind": "region", "country": "DE", "label": "Nuremberg (EU)" } ], "layers": [ "transit", "storage" ], "purpose": "Application + worker hosting (target architecture): the Next.js app, the BullMQ worker, and the self-hosted sidecars (Valkey, SearXNG, MarkItDown, Bugsink, embedding/rerank) run on a single EU box. Replaces Vercel.", "scope": "Announced, not yet processing. Will provide EU compute for the services we host ourselves. Software we run on it is our own and is not a separate sub-processor.", "role": "dpv:DataProcessor", "personalDataCategories": [ "pd:Name", "pd:EmailAddress", "pd:IPAddress", "pd:UserAgent" ], "transferBasis": { "kind": "eu-only" }, "cloudActExposed": false, "status": "planned", "addedOn": "2026-07-15", "effectiveFrom": "2026-08-14", "removedOn": null, "dpaUrl": null, "dpaSigned": false, "retention": null, "noTrainingFlowDown": null, "subProcessors": null } }, { "op": "added", "id": "sentry", "row": { "id": "sentry", "legalName": "Functional Software, Inc.", "jurisdiction": "US", "registeredOffice": "California, United States", "parent": null, "processingLocations": [ { "kind": "region", "country": "DE", "label": "ingest.de.sentry.io (Germany)" } ], "layers": [ "telemetry" ], "purpose": "Application error and performance monitoring.", "scope": "EU ingest is enforced in code: the client fails closed rather than sending to a non-EU endpoint. Being replaced by an error tracker we host ourselves; that migration has not started.", "role": "dpv:DataProcessor", "personalDataCategories": [ "pd:UID", "pd:UserAgent" ], "transferBasis": { "kind": "unresolved", "reason": "Ingest is pinned to the EU region by a fail-closed guard, but the entity is US-incorporated so remote access remains a Chapter V question. Basis must be confirmed against the signed DPA." }, "cloudActExposed": true, "status": "live", "addedOn": "2026-07-15", "effectiveFrom": "2026-07-15", "removedOn": null, "dpaUrl": null, "dpaSigned": false, "retention": { "summary": "90-day rolling event retention (vendor-documented: 90 days on paid plans, 30 on free; mirrored in docs/compliance/data-retention-policy.md); event.user.email attaches for consent-granted users and has no erasure hook, so it outlives an erasure request until the 90-day roll-off. Named residual in the erasure-propagation register; closes at the 0F Bugsink cutover.", "sourceUrl": "https://sentry.zendesk.com/hc/en-us/articles/27118913621019", "verifiedOn": "2026-07-22" }, "noTrainingFlowDown": null, "subProcessors": null } }, { "op": "added", "id": "supabase", "row": { "id": "supabase", "legalName": "Supabase, Inc.", "jurisdiction": "US", "registeredOffice": "Delaware, United States", "parent": null, "processingLocations": [ { "kind": "region", "country": "IE", "label": "aws eu-west-1 (Ireland)" } ], "layers": [ "storage" ], "purpose": "Primary datastore: Postgres (documents, chunks, embeddings, tenants), authentication, and default object storage.", "scope": "Being replaced by our own Postgres and object storage on EU hardware. That migration has not started; until it lands, this provider holds the document corpus.", "role": "dpv:DataProcessor", "personalDataCategories": [ "pd:Name", "pd:EmailAddress", "pd:Password", "pd:UserAgent" ], "transferBasis": { "kind": "unresolved", "reason": "Data rests in an EU region but the provider is US-incorporated, so remote access is a Chapter V transfer. The applicable basis is being confirmed against the signed DPA. This provider runs on infrastructure it engages in turn, which is not yet itemised in this register." }, "cloudActExposed": true, "status": "live", "addedOn": "2026-07-15", "effectiveFrom": "2026-07-15", "removedOn": null, "dpaUrl": null, "dpaSigned": false, "retention": null, "noTrainingFlowDown": null, "subProcessors": null } }, { "op": "added", "id": "upstash", "row": { "id": "upstash", "legalName": "Upstash, Inc.", "jurisdiction": "US", "registeredOffice": "California, United States", "parent": null, "processingLocations": [ { "kind": "unconfirmed", "note": "Region is not pinned in code and the vendor's deployment region for this database has not been evidenced. Holds IP addresses and session identifiers, so Art. 30(1)(d)-(e) cannot be answered for it." } ], "layers": [ "storage" ], "purpose": "Redis: API rate limiting, session revocation, embedding cache, and impossible-travel detection.", "scope": "Being replaced by a cache we host ourselves on EU hardware. That migration has not started; until it lands, this provider serves the rate-limit and cache layer.", "role": "dpv:DataProcessor", "personalDataCategories": [ "pd:IPAddress", "pd:Location", "pd:UID" ], "transferBasis": { "kind": "unresolved", "reason": "US-incorporated processor holding IP addresses and session identifiers. Region is not pinned in code and the basis is not evidenced. This is a hard boot dependency: UPSTASH_REDIS_REST_URL is required, not optional." }, "cloudActExposed": true, "status": "live", "addedOn": "2026-07-15", "effectiveFrom": "2026-07-15", "removedOn": null, "dpaUrl": null, "dpaSigned": false, "retention": null, "noTrainingFlowDown": null, "subProcessors": null } }, { "op": "added", "id": "vercel", "row": { "id": "vercel", "legalName": "Vercel Inc.", "jurisdiction": "US", "registeredOffice": "California, United States", "parent": null, "processingLocations": [ { "kind": "global", "label": "global edge" } ], "layers": [ "transit" ], "purpose": "Application hosting and scheduled jobs (current deployment target).", "scope": "Being replaced by application hosting we run ourselves on EU hardware. That migration has not started; until it lands, this provider serves the application.", "role": "dpv:DataProcessor", "personalDataCategories": [ "pd:IPAddress", "pd:UserAgent" ], "transferBasis": { "kind": "unresolved", "reason": "US-incorporated host handling the full request path. Basis must be confirmed against the signed DPA." }, "cloudActExposed": true, "status": "live", "addedOn": "2026-07-15", "effectiveFrom": "2026-07-15", "removedOn": null, "dpaUrl": null, "dpaSigned": false, "retention": null, "noTrainingFlowDown": null, "subProcessors": null } } ], "stateHash": "sha256:3e839a32aaeba0bd145b9d03de53e3d93eaad28db091fea661abb8678aeafe30" }, { "revision": 2, "recordedOn": "2026-08-01", "summary": "Fourth-party chains recorded for ten processors from their own published disclosures; the embedding provider publishes none and stays unestablished.", "changes": [ { "op": "changed", "id": "brevo", "field": "subProcessors", "from": null, "to": { "entries": [ { "legalName": "Google Cloud Platform", "jurisdiction": "FR", "purpose": "Hosting. Servers stated as Belgium." }, { "legalName": "Scaleway (Iliad)", "jurisdiction": "FR", "purpose": "Hosting. Servers stated as France." }, { "legalName": "OVH", "jurisdiction": "FR", "purpose": "Hosting. Servers stated as France." }, { "legalName": "Hetzner Online GmbH", "jurisdiction": "DE", "purpose": "Hosting. Servers stated as Germany. Also a sub-processor of ours in its own right." }, { "legalName": "Cloudflare", "jurisdiction": "US", "purpose": "CDN and WAF. Servers stated as United States and EU." } ], "sourceUrl": "https://corp-backend.brevo.com/wp-content/uploads/2024/08/BREVO-Annex-2-DPA-150524.pdf", "verifiedOn": "2026-07-31", "note": "Their DPA annex separates infrastructure sub-processors from the rest and states a registered office for each, used here as the jurisdiction. Recorded here is that infrastructure section." } }, { "op": "changed", "id": "bunny", "field": "subProcessors", "from": null, "to": { "entries": [], "sourceUrl": "https://bunny.net/gdpr/sub-processors/", "verifiedOn": "2026-07-31", "note": "Their disclosure names six parties, none of which is an infrastructure, colocation or network provider: it covers their support desk, email, bug tracking and one AI feature vendor. So the parties behind their edge network are not disclosed by them. The empty list here records that absence rather than an assurance that none exists." } }, { "op": "changed", "id": "cloudflare", "field": "subProcessors", "from": null, "to": { "entries": [ { "legalName": "Amazon Web Services (AWS)", "jurisdiction": null, "purpose": "Email Security product. Processing stated as United States and EEA." }, { "legalName": "Google LLC", "jurisdiction": null, "purpose": "Developer Platform, Zero Trust and AI Gateway. Processing stated as EEA, United States, Australia and India." }, { "legalName": "Oracle America, Inc.", "jurisdiction": null, "purpose": "Developer Platform and Cache Reserve. Processing stated across United States, EEA, UK, Japan, Australia, Canada and Singapore." }, { "legalName": "CoreWeave, Inc.", "jurisdiction": null, "purpose": "Workers AI. Processing stated as United States." }, { "legalName": "Nebius BV", "jurisdiction": null, "purpose": "Workers AI. Processing stated as England." } ], "sourceUrl": "https://www.cloudflare.com/gdpr/subprocessors/cloudflare-services", "verifiedOn": "2026-07-31", "note": "Their list is dated 1 October 2025 and states processing regions rather than countries of incorporation, so regions are given in each purpose. It also names 16 of their own group affiliates, which are not recorded here as external parties. Every entry below is scoped by them to a specific product; none is stated to apply to DNS." } }, { "op": "changed", "id": "hetzner", "field": "subProcessors", "from": null, "to": { "entries": [ { "legalName": "Hetzner Finland Oy", "jurisdiction": "FI", "purpose": "Building rental and technical support." }, { "legalName": "Hetzner US LLC", "jurisdiction": "US", "purpose": "Server rental for their US site." }, { "legalName": "NTT Global Data Centers Americas, Inc.", "jurisdiction": "US", "purpose": "Colocation for their US site." }, { "legalName": "QTS Investment Properties Hillsboro, LLC", "jurisdiction": "US", "purpose": "Colocation for their US site." }, { "legalName": "Hetzner Singapore Pte. Ltd.", "jurisdiction": "SG", "purpose": "Server rental for their Singapore site." }, { "legalName": "NTT Global Data Centers SG1 Pte Ltd", "jurisdiction": "SG", "purpose": "Colocation for their Singapore site." } ], "sourceUrl": "https://www.hetzner.com/AV/subunternehmer.pdf", "verifiedOn": "2026-07-31", "note": "Their annex is version 1.0 dated 6 August 2024 and names six parties, all of them infrastructure, with a location for each. They state that data on EU-located servers is processed exclusively within the EU; the non-EU entities below serve their US and Singapore sites, which we do not use." } }, { "op": "changed", "id": "mistral", "field": "subProcessors", "from": null, "to": { "entries": [ { "legalName": "Mistral Compute", "jurisdiction": "FR", "purpose": "Cloud infrastructure for all products. Their own compute arm rather than an external party." }, { "legalName": "Microsoft Inc.", "jurisdiction": null, "purpose": "Cloud infrastructure. Processing stated as Sweden and Norway." }, { "legalName": "Google LLC", "jurisdiction": null, "purpose": "Cloud infrastructure. Processing stated as Netherlands, Belgium and the United States." }, { "legalName": "CoreWeave Inc.", "jurisdiction": null, "purpose": "Inference provider. Processing stated as the EEA." }, { "legalName": "Cloudflare Inc.", "jurisdiction": null, "purpose": "Security and traffic routing. Processing stated as worldwide." } ], "sourceUrl": "https://trust.mistral.ai/subprocessors", "verifiedOn": "2026-07-31", "note": "Their disclosure lists 24 parties, several scoped to products we do not use. Recorded here are the infrastructure and inference providers whose stated scope covers the API. Their page states processing regions rather than countries of incorporation, so those regions are given in each purpose and jurisdiction is left unstated." } }, { "op": "changed", "id": "netcup", "field": "subProcessors", "from": null, "to": { "entries": [ { "legalName": "Hetzner Online GmbH", "jurisdiction": "DE", "purpose": "Colocation data centre, Nuremberg. Also a sub-processor of ours in its own right." }, { "legalName": "DATASIX Rechenzentrumsbetriebs GmbH", "jurisdiction": "AT", "purpose": "Data centre operator, Vienna." } ], "sourceUrl": "https://www.netcup.com/en/legal/privacy-policy", "verifiedOn": "2026-07-31", "note": "They publish no standalone sub-processor page; the parties below are named in their Art 28 processing agreement, which reaches a customer only on execution. That is a weaker disclosure mechanism than the click-through lists every other vendor here offers, and it is recorded as such." } }, { "op": "changed", "id": "sentry", "field": "subProcessors", "from": null, "to": { "entries": [ { "legalName": "Amazon Web Services, Inc.", "jurisdiction": null, "purpose": "Cloud infrastructure. Processing stated as EU and United States." }, { "legalName": "Cloudflare, Inc.", "jurisdiction": null, "purpose": "Cloud infrastructure. Processing stated as EU and United States." }, { "legalName": "Google LLC", "jurisdiction": null, "purpose": "Cloud infrastructure. Processing stated as EU and United States." } ], "sourceUrl": "https://sentry.io/legal/subprocessors", "verifiedOn": "2026-07-31", "note": "Their list is version 2.3.0 dated 1 June 2026 and states processing regions rather than countries of incorporation. Recorded here are the three cloud providers; the remainder are their email, support and group affiliates." } }, { "op": "changed", "id": "supabase", "field": "subProcessors", "from": null, "to": { "entries": [ { "legalName": "Amazon Web Services, Inc", "jurisdiction": null, "purpose": "Hosting." }, { "legalName": "Cloudflare, Inc", "jurisdiction": null, "purpose": "Hosting." }, { "legalName": "Google, LLC", "jurisdiction": null, "purpose": "Hosting." }, { "legalName": "Fly.io, Inc", "jurisdiction": null, "purpose": "Hosting." }, { "legalName": "Upstash, Inc", "jurisdiction": null, "purpose": "Serverless data hosting. Also a sub-processor of ours in its own right." }, { "legalName": "Vercel, Inc", "jurisdiction": null, "purpose": "Hosting. Also a sub-processor of ours in its own right." } ], "sourceUrl": "https://supabase.com/legal/customer-resources/subprocessor-list", "verifiedOn": "2026-07-31", "note": "Their list is dated 1 June 2026 and names 19 parties without stating any country, so no jurisdiction is recorded for any of them. Recorded here are the six hosting providers; the remainder are their own support, sales and analytics tooling." } }, { "op": "changed", "id": "upstash", "field": "subProcessors", "from": null, "to": { "entries": [ { "legalName": "Amazon Web Services", "jurisdiction": "US", "purpose": "Cloud provider." }, { "legalName": "Google", "jurisdiction": "US", "purpose": "Cloud provider." }, { "legalName": "Cloudflare, Inc.", "jurisdiction": "US", "purpose": "Cloud services." }, { "legalName": "Humio (CrowdStrike Falcon LogScale)", "jurisdiction": "DK", "purpose": "Logging." } ], "sourceUrl": "https://upstash.com/trust/subprocessors.pdf", "verifiedOn": "2026-07-31", "note": "Their document states an address per party, used here as the jurisdiction. Several entries are scoped to products of theirs we do not use; those are excluded. Recorded here are the providers that could sit under the Redis service we consume." } }, { "op": "changed", "id": "vercel", "field": "subProcessors", "from": null, "to": { "entries": [ { "legalName": "Amazon Web Services, Inc.", "jurisdiction": "US", "purpose": "Hosting, storage and generative AI." }, { "legalName": "Google LLC", "jurisdiction": "US", "purpose": "Cloud computing, storage and generative AI." }, { "legalName": "Microsoft Corporation", "jurisdiction": "US", "purpose": "Hosting, storage and generative AI." }, { "legalName": "Upstash, Inc.", "jurisdiction": "US", "purpose": "Serverless storage. Also a sub-processor of ours in its own right." }, { "legalName": "Neon", "jurisdiction": "US", "purpose": "Serverless storage." }, { "legalName": "Redis Labs, Inc.", "jurisdiction": "US", "purpose": "Real-time logging and security." } ], "sourceUrl": "https://security.vercel.com/subprocessors", "verifiedOn": "2026-07-31", "note": "Their list names 28 parties with a location each, used here as the jurisdiction. Recorded here are the six providing hosting or storage; the remainder are their monitoring, support and AI-feature vendors." } } ], "stateHash": "sha256:4e25295f211cec8b45ca51c9b3b6259117e5f2a285d8960f6cbf7895ed1d3e86" }, { "revision": 3, "recordedOn": "2026-08-01", "summary": "Record where Sentry actually stores data. Its own data-storage-location documentation lists account and operational metadata as US-resident regardless of the selected region (cron check-ins, org settings and audit logs, project metadata, DSN keys, tokens, usage data) and uptime checks as stored in both regions. Error events, which carry the declared personal-data categories, remain in Frankfurt. No customer personal data sits in the US half, and the residual closes at the 0F Bugsink cutover. No change to what Sentry processes; this corrects an incomplete disclosure.", "changes": [ { "op": "changed", "id": "sentry", "field": "processingLocations", "from": [ { "kind": "region", "country": "DE", "label": "ingest.de.sentry.io (Germany)" } ], "to": [ { "kind": "region", "country": "DE", "label": "ingest.de.sentry.io (Germany)" }, { "kind": "region", "country": "US", "label": "US region (Iowa) for account and operational metadata stored outside the selected region regardless of setting (cron check-ins, org settings and audit logs, project metadata, DSN keys, tokens, usage data); uptime checks are stored in both regions. No customer personal data." } ] }, { "op": "changed", "id": "sentry", "field": "scope", "from": "EU ingest is enforced in code: the client fails closed rather than sending to a non-EU endpoint. Being replaced by an error tracker we host ourselves; that migration has not started.", "to": "EU ingest is enforced in code: the client fails closed rather than sending to a non-EU endpoint, so error events, spans and logs are stored in Frankfurt. Sentry nonetheless stores account and operational metadata in the US regardless of the selected region (cron check-ins, org settings and audit logs, project metadata, DSN keys, access tokens, usage data) and stores uptime checks in both regions. None of it carries customer personal data, so no Chapter V transfer arises from that half; it is nonetheless a US-storage residual of this vendor, and like the retention residual above it closes at the 0F Bugsink cutover, when error tracking, cron heartbeat and uptime checks all move to infrastructure we host." } ], "stateHash": "sha256:754c76c5ed958276f3dc6f90c1da61dac5134e05559c23fa1490ac7754c0f858" }, { "revision": 4, "recordedOn": "2026-08-01", "summary": "Restate the CDN's EU edge pinning as a provisioning step we owe rather than an assurance already in place.", "changes": [ { "op": "changed", "id": "bunny", "field": "scope", "from": "Announced, not yet processing. Will serve static assets from EU-only edge locations, pinned so cached bytes stay within the EU.", "to": "Announced, not yet processing. Before it is enabled, its pull zone has to be pinned to European edge locations; that pinning is a configuration we set at provisioning, not a property of the service, so it is a step we owe rather than an assurance we can give today." } ], "stateHash": "sha256:ae56c0851ea7205a9687fc8bbf414eb65c3195f3074d85bf383c83b243f4bbe9" }, { "revision": 5, "recordedOn": "2026-08-01", "summary": "Record each chain's finding explicitly: named, none, or their disclosure does not cover the relevant parties. Same parties, a state the page can no longer collapse into an assurance.", "changes": [ { "op": "changed", "id": "brevo", "field": "subProcessors", "from": { "entries": [ { "legalName": "Google Cloud Platform", "jurisdiction": "FR", "purpose": "Hosting. Servers stated as Belgium." }, { "legalName": "Scaleway (Iliad)", "jurisdiction": "FR", "purpose": "Hosting. Servers stated as France." }, { "legalName": "OVH", "jurisdiction": "FR", "purpose": "Hosting. Servers stated as France." }, { "legalName": "Hetzner Online GmbH", "jurisdiction": "DE", "purpose": "Hosting. Servers stated as Germany. Also a sub-processor of ours in its own right." }, { "legalName": "Cloudflare", "jurisdiction": "US", "purpose": "CDN and WAF. Servers stated as United States and EU." } ], "sourceUrl": "https://corp-backend.brevo.com/wp-content/uploads/2024/08/BREVO-Annex-2-DPA-150524.pdf", "verifiedOn": "2026-07-31", "note": "Their DPA annex separates infrastructure sub-processors from the rest and states a registered office for each, used here as the jurisdiction. Recorded here is that infrastructure section." }, "to": { "finding": "named", "entries": [ { "legalName": "Google Cloud Platform", "jurisdiction": "FR", "purpose": "Hosting. Servers stated as Belgium." }, { "legalName": "Scaleway (Iliad)", "jurisdiction": "FR", "purpose": "Hosting. Servers stated as France." }, { "legalName": "OVH", "jurisdiction": "FR", "purpose": "Hosting. Servers stated as France." }, { "legalName": "Hetzner Online GmbH", "jurisdiction": "DE", "purpose": "Hosting. Servers stated as Germany. Also a sub-processor of ours in its own right." }, { "legalName": "Cloudflare", "jurisdiction": "US", "purpose": "CDN and WAF. Servers stated as United States and EU." } ], "sourceUrl": "https://corp-backend.brevo.com/wp-content/uploads/2024/08/BREVO-Annex-2-DPA-150524.pdf", "verifiedOn": "2026-07-31", "note": "Their DPA annex separates infrastructure sub-processors from the rest and states a registered office for each, used here as the jurisdiction. Recorded here is that infrastructure section." } }, { "op": "changed", "id": "bunny", "field": "subProcessors", "from": { "entries": [], "sourceUrl": "https://bunny.net/gdpr/sub-processors/", "verifiedOn": "2026-07-31", "note": "Their disclosure names six parties, none of which is an infrastructure, colocation or network provider: it covers their support desk, email, bug tracking and one AI feature vendor. So the parties behind their edge network are not disclosed by them. The empty list here records that absence rather than an assurance that none exists." }, "to": { "finding": "not-covered", "sourceUrl": "https://bunny.net/gdpr/sub-processors/", "verifiedOn": "2026-07-31", "note": "Their disclosure names six parties, none of which is an infrastructure, colocation or network provider: it covers their support desk, email, bug tracking and one AI feature vendor. So the parties behind their edge network are not disclosed by them. The empty list here records that absence rather than an assurance that none exists." } }, { "op": "changed", "id": "cloudflare", "field": "subProcessors", "from": { "entries": [ { "legalName": "Amazon Web Services (AWS)", "jurisdiction": null, "purpose": "Email Security product. Processing stated as United States and EEA." }, { "legalName": "Google LLC", "jurisdiction": null, "purpose": "Developer Platform, Zero Trust and AI Gateway. Processing stated as EEA, United States, Australia and India." }, { "legalName": "Oracle America, Inc.", "jurisdiction": null, "purpose": "Developer Platform and Cache Reserve. Processing stated across United States, EEA, UK, Japan, Australia, Canada and Singapore." }, { "legalName": "CoreWeave, Inc.", "jurisdiction": null, "purpose": "Workers AI. Processing stated as United States." }, { "legalName": "Nebius BV", "jurisdiction": null, "purpose": "Workers AI. Processing stated as England." } ], "sourceUrl": "https://www.cloudflare.com/gdpr/subprocessors/cloudflare-services", "verifiedOn": "2026-07-31", "note": "Their list is dated 1 October 2025 and states processing regions rather than countries of incorporation, so regions are given in each purpose. It also names 16 of their own group affiliates, which are not recorded here as external parties. Every entry below is scoped by them to a specific product; none is stated to apply to DNS." }, "to": { "finding": "named", "entries": [ { "legalName": "Amazon Web Services (AWS)", "jurisdiction": null, "purpose": "Email Security product. Processing stated as United States and EEA." }, { "legalName": "Google LLC", "jurisdiction": null, "purpose": "Developer Platform, Zero Trust and AI Gateway. Processing stated as EEA, United States, Australia and India." }, { "legalName": "Oracle America, Inc.", "jurisdiction": null, "purpose": "Developer Platform and Cache Reserve. Processing stated across United States, EEA, UK, Japan, Australia, Canada and Singapore." }, { "legalName": "CoreWeave, Inc.", "jurisdiction": null, "purpose": "Workers AI. Processing stated as United States." }, { "legalName": "Nebius BV", "jurisdiction": null, "purpose": "Workers AI. Processing stated as England." } ], "sourceUrl": "https://www.cloudflare.com/gdpr/subprocessors/cloudflare-services", "verifiedOn": "2026-07-31", "note": "Their list is dated 1 October 2025 and states processing regions rather than countries of incorporation, so regions are given in each purpose. It also names 16 of their own group affiliates, which are not recorded here as external parties. Every entry below is scoped by them to a specific product; none is stated to apply to DNS." } }, { "op": "changed", "id": "hetzner", "field": "subProcessors", "from": { "entries": [ { "legalName": "Hetzner Finland Oy", "jurisdiction": "FI", "purpose": "Building rental and technical support." }, { "legalName": "Hetzner US LLC", "jurisdiction": "US", "purpose": "Server rental for their US site." }, { "legalName": "NTT Global Data Centers Americas, Inc.", "jurisdiction": "US", "purpose": "Colocation for their US site." }, { "legalName": "QTS Investment Properties Hillsboro, LLC", "jurisdiction": "US", "purpose": "Colocation for their US site." }, { "legalName": "Hetzner Singapore Pte. Ltd.", "jurisdiction": "SG", "purpose": "Server rental for their Singapore site." }, { "legalName": "NTT Global Data Centers SG1 Pte Ltd", "jurisdiction": "SG", "purpose": "Colocation for their Singapore site." } ], "sourceUrl": "https://www.hetzner.com/AV/subunternehmer.pdf", "verifiedOn": "2026-07-31", "note": "Their annex is version 1.0 dated 6 August 2024 and names six parties, all of them infrastructure, with a location for each. They state that data on EU-located servers is processed exclusively within the EU; the non-EU entities below serve their US and Singapore sites, which we do not use." }, "to": { "finding": "named", "entries": [ { "legalName": "Hetzner Finland Oy", "jurisdiction": "FI", "purpose": "Building rental and technical support." }, { "legalName": "Hetzner US LLC", "jurisdiction": "US", "purpose": "Server rental for their US site." }, { "legalName": "NTT Global Data Centers Americas, Inc.", "jurisdiction": "US", "purpose": "Colocation for their US site." }, { "legalName": "QTS Investment Properties Hillsboro, LLC", "jurisdiction": "US", "purpose": "Colocation for their US site." }, { "legalName": "Hetzner Singapore Pte. Ltd.", "jurisdiction": "SG", "purpose": "Server rental for their Singapore site." }, { "legalName": "NTT Global Data Centers SG1 Pte Ltd", "jurisdiction": "SG", "purpose": "Colocation for their Singapore site." } ], "sourceUrl": "https://www.hetzner.com/AV/subunternehmer.pdf", "verifiedOn": "2026-07-31", "note": "Their annex is version 1.0 dated 6 August 2024 and names six parties, all of them infrastructure, with a location for each. They state that data on EU-located servers is processed exclusively within the EU; the non-EU entities below serve their US and Singapore sites, which we do not use." } }, { "op": "changed", "id": "mistral", "field": "subProcessors", "from": { "entries": [ { "legalName": "Mistral Compute", "jurisdiction": "FR", "purpose": "Cloud infrastructure for all products. Their own compute arm rather than an external party." }, { "legalName": "Microsoft Inc.", "jurisdiction": null, "purpose": "Cloud infrastructure. Processing stated as Sweden and Norway." }, { "legalName": "Google LLC", "jurisdiction": null, "purpose": "Cloud infrastructure. Processing stated as Netherlands, Belgium and the United States." }, { "legalName": "CoreWeave Inc.", "jurisdiction": null, "purpose": "Inference provider. Processing stated as the EEA." }, { "legalName": "Cloudflare Inc.", "jurisdiction": null, "purpose": "Security and traffic routing. Processing stated as worldwide." } ], "sourceUrl": "https://trust.mistral.ai/subprocessors", "verifiedOn": "2026-07-31", "note": "Their disclosure lists 24 parties, several scoped to products we do not use. Recorded here are the infrastructure and inference providers whose stated scope covers the API. Their page states processing regions rather than countries of incorporation, so those regions are given in each purpose and jurisdiction is left unstated." }, "to": { "finding": "named", "entries": [ { "legalName": "Mistral Compute", "jurisdiction": "FR", "purpose": "Cloud infrastructure for all products. Their own compute arm rather than an external party." }, { "legalName": "Microsoft Inc.", "jurisdiction": null, "purpose": "Cloud infrastructure. Processing stated as Sweden and Norway." }, { "legalName": "Google LLC", "jurisdiction": null, "purpose": "Cloud infrastructure. Processing stated as Netherlands, Belgium and the United States." }, { "legalName": "CoreWeave Inc.", "jurisdiction": null, "purpose": "Inference provider. Processing stated as the EEA." }, { "legalName": "Cloudflare Inc.", "jurisdiction": null, "purpose": "Security and traffic routing. Processing stated as worldwide." } ], "sourceUrl": "https://trust.mistral.ai/subprocessors", "verifiedOn": "2026-07-31", "note": "Their disclosure lists 24 parties, several scoped to products we do not use. Recorded here are the infrastructure and inference providers whose stated scope covers the API. Their page states processing regions rather than countries of incorporation, so those regions are given in each purpose and jurisdiction is left unstated." } }, { "op": "changed", "id": "netcup", "field": "subProcessors", "from": { "entries": [ { "legalName": "Hetzner Online GmbH", "jurisdiction": "DE", "purpose": "Colocation data centre, Nuremberg. Also a sub-processor of ours in its own right." }, { "legalName": "DATASIX Rechenzentrumsbetriebs GmbH", "jurisdiction": "AT", "purpose": "Data centre operator, Vienna." } ], "sourceUrl": "https://www.netcup.com/en/legal/privacy-policy", "verifiedOn": "2026-07-31", "note": "They publish no standalone sub-processor page; the parties below are named in their Art 28 processing agreement, which reaches a customer only on execution. That is a weaker disclosure mechanism than the click-through lists every other vendor here offers, and it is recorded as such." }, "to": { "finding": "named", "entries": [ { "legalName": "Hetzner Online GmbH", "jurisdiction": "DE", "purpose": "Colocation data centre, Nuremberg. Also a sub-processor of ours in its own right." }, { "legalName": "DATASIX Rechenzentrumsbetriebs GmbH", "jurisdiction": "AT", "purpose": "Data centre operator, Vienna." } ], "sourceUrl": "https://www.netcup.com/en/legal/privacy-policy", "verifiedOn": "2026-07-31", "note": "They publish no standalone sub-processor page; the parties below are named in their Art 28 processing agreement, which reaches a customer only on execution. That is a weaker disclosure mechanism than the click-through lists every other vendor here offers, and it is recorded as such." } }, { "op": "changed", "id": "sentry", "field": "subProcessors", "from": { "entries": [ { "legalName": "Amazon Web Services, Inc.", "jurisdiction": null, "purpose": "Cloud infrastructure. Processing stated as EU and United States." }, { "legalName": "Cloudflare, Inc.", "jurisdiction": null, "purpose": "Cloud infrastructure. Processing stated as EU and United States." }, { "legalName": "Google LLC", "jurisdiction": null, "purpose": "Cloud infrastructure. Processing stated as EU and United States." } ], "sourceUrl": "https://sentry.io/legal/subprocessors", "verifiedOn": "2026-07-31", "note": "Their list is version 2.3.0 dated 1 June 2026 and states processing regions rather than countries of incorporation. Recorded here are the three cloud providers; the remainder are their email, support and group affiliates." }, "to": { "finding": "named", "entries": [ { "legalName": "Amazon Web Services, Inc.", "jurisdiction": null, "purpose": "Cloud infrastructure. Processing stated as EU and United States." }, { "legalName": "Cloudflare, Inc.", "jurisdiction": null, "purpose": "Cloud infrastructure. Processing stated as EU and United States." }, { "legalName": "Google LLC", "jurisdiction": null, "purpose": "Cloud infrastructure. Processing stated as EU and United States." } ], "sourceUrl": "https://sentry.io/legal/subprocessors", "verifiedOn": "2026-07-31", "note": "Their list is version 2.3.0 dated 1 June 2026 and states processing regions rather than countries of incorporation. Recorded here are the three cloud providers; the remainder are their email, support and group affiliates." } }, { "op": "changed", "id": "supabase", "field": "subProcessors", "from": { "entries": [ { "legalName": "Amazon Web Services, Inc", "jurisdiction": null, "purpose": "Hosting." }, { "legalName": "Cloudflare, Inc", "jurisdiction": null, "purpose": "Hosting." }, { "legalName": "Google, LLC", "jurisdiction": null, "purpose": "Hosting." }, { "legalName": "Fly.io, Inc", "jurisdiction": null, "purpose": "Hosting." }, { "legalName": "Upstash, Inc", "jurisdiction": null, "purpose": "Serverless data hosting. Also a sub-processor of ours in its own right." }, { "legalName": "Vercel, Inc", "jurisdiction": null, "purpose": "Hosting. Also a sub-processor of ours in its own right." } ], "sourceUrl": "https://supabase.com/legal/customer-resources/subprocessor-list", "verifiedOn": "2026-07-31", "note": "Their list is dated 1 June 2026 and names 19 parties without stating any country, so no jurisdiction is recorded for any of them. Recorded here are the six hosting providers; the remainder are their own support, sales and analytics tooling." }, "to": { "finding": "named", "entries": [ { "legalName": "Amazon Web Services, Inc", "jurisdiction": null, "purpose": "Hosting." }, { "legalName": "Cloudflare, Inc", "jurisdiction": null, "purpose": "Hosting." }, { "legalName": "Google, LLC", "jurisdiction": null, "purpose": "Hosting." }, { "legalName": "Fly.io, Inc", "jurisdiction": null, "purpose": "Hosting." }, { "legalName": "Upstash, Inc", "jurisdiction": null, "purpose": "Serverless data hosting. Also a sub-processor of ours in its own right." }, { "legalName": "Vercel, Inc", "jurisdiction": null, "purpose": "Hosting. Also a sub-processor of ours in its own right." } ], "sourceUrl": "https://supabase.com/legal/customer-resources/subprocessor-list", "verifiedOn": "2026-07-31", "note": "Their list is dated 1 June 2026 and names 19 parties without stating any country, so no jurisdiction is recorded for any of them. Recorded here are the six hosting providers; the remainder are their own support, sales and analytics tooling." } }, { "op": "changed", "id": "upstash", "field": "subProcessors", "from": { "entries": [ { "legalName": "Amazon Web Services", "jurisdiction": "US", "purpose": "Cloud provider." }, { "legalName": "Google", "jurisdiction": "US", "purpose": "Cloud provider." }, { "legalName": "Cloudflare, Inc.", "jurisdiction": "US", "purpose": "Cloud services." }, { "legalName": "Humio (CrowdStrike Falcon LogScale)", "jurisdiction": "DK", "purpose": "Logging." } ], "sourceUrl": "https://upstash.com/trust/subprocessors.pdf", "verifiedOn": "2026-07-31", "note": "Their document states an address per party, used here as the jurisdiction. Several entries are scoped to products of theirs we do not use; those are excluded. Recorded here are the providers that could sit under the Redis service we consume." }, "to": { "finding": "named", "entries": [ { "legalName": "Amazon Web Services", "jurisdiction": "US", "purpose": "Cloud provider." }, { "legalName": "Google", "jurisdiction": "US", "purpose": "Cloud provider." }, { "legalName": "Cloudflare, Inc.", "jurisdiction": "US", "purpose": "Cloud services." }, { "legalName": "Humio (CrowdStrike Falcon LogScale)", "jurisdiction": "DK", "purpose": "Logging." } ], "sourceUrl": "https://upstash.com/trust/subprocessors.pdf", "verifiedOn": "2026-07-31", "note": "Their document states an address per party, used here as the jurisdiction. Several entries are scoped to products of theirs we do not use; those are excluded. Recorded here are the providers that could sit under the Redis service we consume." } }, { "op": "changed", "id": "vercel", "field": "subProcessors", "from": { "entries": [ { "legalName": "Amazon Web Services, Inc.", "jurisdiction": "US", "purpose": "Hosting, storage and generative AI." }, { "legalName": "Google LLC", "jurisdiction": "US", "purpose": "Cloud computing, storage and generative AI." }, { "legalName": "Microsoft Corporation", "jurisdiction": "US", "purpose": "Hosting, storage and generative AI." }, { "legalName": "Upstash, Inc.", "jurisdiction": "US", "purpose": "Serverless storage. Also a sub-processor of ours in its own right." }, { "legalName": "Neon", "jurisdiction": "US", "purpose": "Serverless storage." }, { "legalName": "Redis Labs, Inc.", "jurisdiction": "US", "purpose": "Real-time logging and security." } ], "sourceUrl": "https://security.vercel.com/subprocessors", "verifiedOn": "2026-07-31", "note": "Their list names 28 parties with a location each, used here as the jurisdiction. Recorded here are the six providing hosting or storage; the remainder are their monitoring, support and AI-feature vendors." }, "to": { "finding": "named", "entries": [ { "legalName": "Amazon Web Services, Inc.", "jurisdiction": "US", "purpose": "Hosting, storage and generative AI." }, { "legalName": "Google LLC", "jurisdiction": "US", "purpose": "Cloud computing, storage and generative AI." }, { "legalName": "Microsoft Corporation", "jurisdiction": "US", "purpose": "Hosting, storage and generative AI." }, { "legalName": "Upstash, Inc.", "jurisdiction": "US", "purpose": "Serverless storage. Also a sub-processor of ours in its own right." }, { "legalName": "Neon", "jurisdiction": "US", "purpose": "Serverless storage." }, { "legalName": "Redis Labs, Inc.", "jurisdiction": "US", "purpose": "Real-time logging and security." } ], "sourceUrl": "https://security.vercel.com/subprocessors", "verifiedOn": "2026-07-31", "note": "Their list names 28 parties with a location each, used here as the jurisdiction. Recorded here are the six providing hosting or storage; the remainder are their monitoring, support and AI-feature vendors." } } ], "stateHash": "sha256:cfa7556c1f8d940e2989aff1a593179ee6fecc3d912caf18abe5867ced5d9001" }, { "revision": 6, "recordedOn": "2026-08-02", "summary": "Record which of the storage provider's group entities serve regions we do not use, so the chain's third-country reach is counted from facts rather than inferred from a note", "changes": [ { "op": "changed", "id": "hetzner", "field": "subProcessors", "from": { "finding": "named", "entries": [ { "legalName": "Hetzner Finland Oy", "jurisdiction": "FI", "purpose": "Building rental and technical support." }, { "legalName": "Hetzner US LLC", "jurisdiction": "US", "purpose": "Server rental for their US site." }, { "legalName": "NTT Global Data Centers Americas, Inc.", "jurisdiction": "US", "purpose": "Colocation for their US site." }, { "legalName": "QTS Investment Properties Hillsboro, LLC", "jurisdiction": "US", "purpose": "Colocation for their US site." }, { "legalName": "Hetzner Singapore Pte. Ltd.", "jurisdiction": "SG", "purpose": "Server rental for their Singapore site." }, { "legalName": "NTT Global Data Centers SG1 Pte Ltd", "jurisdiction": "SG", "purpose": "Colocation for their Singapore site." } ], "sourceUrl": "https://www.hetzner.com/AV/subunternehmer.pdf", "verifiedOn": "2026-07-31", "note": "Their annex is version 1.0 dated 6 August 2024 and names six parties, all of them infrastructure, with a location for each. They state that data on EU-located servers is processed exclusively within the EU; the non-EU entities below serve their US and Singapore sites, which we do not use." }, "to": { "finding": "named", "entries": [ { "legalName": "Hetzner Finland Oy", "jurisdiction": "FI", "purpose": "Building rental and technical support.", "engagement": "in-path" }, { "legalName": "Hetzner US LLC", "jurisdiction": "US", "purpose": "Server rental for their US site.", "engagement": "out-of-path" }, { "legalName": "NTT Global Data Centers Americas, Inc.", "jurisdiction": "US", "purpose": "Colocation for their US site.", "engagement": "out-of-path" }, { "legalName": "QTS Investment Properties Hillsboro, LLC", "jurisdiction": "US", "purpose": "Colocation for their US site.", "engagement": "out-of-path" }, { "legalName": "Hetzner Singapore Pte. Ltd.", "jurisdiction": "SG", "purpose": "Server rental for their Singapore site.", "engagement": "out-of-path" }, { "legalName": "NTT Global Data Centers SG1 Pte Ltd", "jurisdiction": "SG", "purpose": "Colocation for their Singapore site.", "engagement": "out-of-path" } ], "sourceUrl": "https://www.hetzner.com/AV/subunternehmer.pdf", "verifiedOn": "2026-07-31", "note": "Their annex is version 1.0 dated 6 August 2024 and names six parties, all of them infrastructure, with a location for each. They state that data on EU-located servers is processed exclusively within the EU; the non-EU entities below serve their US and Singapore sites, which we do not use." } } ], "stateHash": "sha256:d2fc96480561febf3eeccd4ef66706d2ccee86a4619c662f37437fef6ccc8c49" }, { "revision": 7, "recordedOn": "2026-08-02", "summary": "Remove a sentence stating the database provider's own infrastructure was not itemised here, which the same row's chain refutes", "changes": [ { "op": "changed", "id": "supabase", "field": "transferBasis", "from": { "kind": "unresolved", "reason": "Data rests in an EU region but the provider is US-incorporated, so remote access is a Chapter V transfer. The applicable basis is being confirmed against the signed DPA. This provider runs on infrastructure it engages in turn, which is not yet itemised in this register." }, "to": { "kind": "unresolved", "reason": "Data rests in an EU region but the provider is US-incorporated, so remote access is a Chapter V transfer. The applicable basis is being confirmed against the signed DPA." } } ], "stateHash": "sha256:fb8b74f7c79ad58a002e9585dbfbc9976faaae0eb226d8857277a581e8c7d795" } ] }