{ "version": 1, "lastModified": "2026-10-19", "noticePeriodDays": 30, "establishedOn": "2026-07-15", "subprocessors": [ { "id": "mistral", "legalName": "Mistral AI SAS", "jurisdiction": "FR", "registeredOffice": "Paris, France", "parent": null, "processingLocations": [ { "kind": "region", "country": "FR", "label": "eu-west (France)" } ], "layers": [ "inference" ], "purpose": "Language-model generation (chat answers, planning, tool use, reading images, input moderation) and text embeddings for search. The only managed inference provider; there is no fallback outside the EU.", "scope": "Prompts carry user questions plus retrieved document excerpts. Embedding requests carry document chunks when a document is indexed and the user's question at search time; when self-hosted embeddings are selected, only generation reaches this provider. Zero retention and the training opt-out are account-level settings with this provider, not per-request, so they are recorded here rather than asserted per call.", "role": "dpv:DataProcessor", "personalDataCategories": [ "pd:Name", "pd:UserAgent" ], "transferBasis": { "kind": "eu-only" }, "cloudActExposed": false, "status": "live", "addedOn": "2026-07-15", "effectiveFrom": "2026-07-15", "removedOn": null, "dpaUrl": "https://legal.mistral.ai/terms/data-processing-addendum", "dpaSigned": true, "retention": null, "noTrainingFlowDown": { "committed": true, "mechanism": "Contractual on the paid plan: Commercial Terms of Service section 4.2 (Training, effective 5 August 2026) states Mistral AI will not use Customer Data or Outputs to train its models except where the customer opted in (or did not opt out on a product that trains by default), for Feedback, under an Order Form, or on Labs or Preview models. We run on the company pay-as-you-go workspace provisioned 12 September 2026 with no training opt-in selected, submit no Feedback, hold no Order Form, and pin only generally available models (`bun run models:verify`). The DPA the terms cite (section 12.3) forms part of the same agreement.", "sourceUrl": "https://legal.mistral.ai/terms/commercial-terms-of-service", "verifiedOn": "2026-09-12" }, "subProcessors": { "finding": "named", "entries": [ { "legalName": "Mistral Compute", "jurisdiction": "FR", "purpose": "Cloud infrastructure for all products. Their own compute arm rather than an external party." }, { "legalName": "Microsoft Inc.", "jurisdiction": null, "purpose": "Cloud infrastructure. Processing stated as Sweden and Norway." }, { "legalName": "Google LLC", "jurisdiction": null, "purpose": "Cloud infrastructure. Processing stated as Netherlands, Belgium and the United States." }, { "legalName": "CoreWeave Inc.", "jurisdiction": null, "purpose": "Inference provider. Processing stated as the EEA." }, { "legalName": "Cloudflare Inc.", "jurisdiction": null, "purpose": "Security and traffic routing. Processing stated as worldwide." } ], "sourceUrl": "https://trust.mistral.ai/subprocessors", "verifiedOn": "2026-07-31", "note": "Their disclosure lists 24 parties, several scoped to products we do not use. Recorded here are the infrastructure and inference providers whose stated scope covers the API. Their page states processing regions rather than countries of incorporation, so those regions are given in each purpose and jurisdiction is left unstated." } }, { "id": "jina-ai", "legalName": "Jina AI GmbH", "jurisdiction": "DE", "registeredOffice": "Berlin, Germany", "parent": { "legalName": "Elastic N.V.", "jurisdiction": "US" }, "processingLocations": [ { "kind": "region", "country": "DE", "label": "eu-central (Berlin)" } ], "layers": [ "inference" ], "purpose": "Text embeddings and reranking for retrieval.", "scope": "Removed on 11 September 2026: the last credential read and the last code path reaching this provider were deleted. Embeddings moved to Mistral (mistral-embed, France), already disclosed above for generation. Reranking now runs only against a rerank service we host ourselves; none is provisioned yet, so retrieval runs without a reranker until the EU inference host lands. It never processed customer content: the platform refused to start in production with it configured from 31 July 2026, and no customer-data deployment existed before that.", "role": "dpv:DataProcessor", "personalDataCategories": [ "pd:Name" ], "transferBasis": { "kind": "unresolved", "reason": "Processing is in Germany, but the parent company is outside the EEA, so remote access is a Chapter V transfer under EDPB Guidelines 05/2021. The applicable basis is being confirmed against the signed DPA and is not settled yet." }, "cloudActExposed": true, "status": "removed", "addedOn": "2026-07-15", "effectiveFrom": "2026-07-15", "removedOn": "2026-09-11", "dpaUrl": null, "dpaSigned": false, "retention": { "summary": "No zero-data-retention commitment for the API: their terms permit retaining customer-submitted data in anonymised/pseudonymised form for business purposes including model improvement, and the privacy policy carves API content out to customer agreements. No DPA signed. Named residual until the planned self-hosted embedding cutover.", "sourceUrl": "https://jina.ai/legal/", "verifiedOn": "2026-07-22" }, "noTrainingFlowDown": { "committed": false, "mechanism": "SUPERSEDED BY THE ACQUISITION. Jina AI Terms section 10.4 carried a clean unconditional commitment (\"Jina AI does not use Customer request data, inputs, prompts, or uploaded content to train its models\"), but Jina AI’s own legal page states that following Elastic’s October 2025 acquisition, data processing is governed by Elastic’s Customer DPA rather than the legacy Jina terms. Elastic’s published privacy statement carries a non-training commitment only for marketing data handled by third-party vendors, and does not address customer data submitted to Jina APIs. The flow-down is therefore not established today and needs the signed Elastic Customer DPA to resolve.", "sourceUrl": "https://jina.ai/legal/", "verifiedOn": "2026-07-27" }, "subProcessors": null }, { "id": "supabase", "legalName": "Supabase, Inc.", "jurisdiction": "US", "registeredOffice": "Delaware, United States", "parent": null, "processingLocations": [ { "kind": "region", "country": "IE", "label": "aws eu-west-1 (Ireland)" } ], "layers": [ "storage" ], "purpose": "Primary datastore: Postgres (documents, chunks, embeddings, tenants), authentication, and default object storage.", "scope": "Being replaced: the database will move to our own Postgres on EU hardware and the files to Scaleway in France. The server and the buckets are provisioned and the application is being moved off this provider's interfaces; the database itself has not moved, and until cutover this provider holds the document corpus.", "role": "dpv:DataProcessor", "personalDataCategories": [ "pd:Name", "pd:EmailAddress", "pd:Password", "pd:UserAgent" ], "transferBasis": { "kind": "unresolved", "reason": "Data rests in an EU region but the provider is US-incorporated, so remote access is a Chapter V transfer. The applicable basis is being confirmed against the signed DPA." }, "cloudActExposed": true, "status": "live", "addedOn": "2026-07-15", "effectiveFrom": "2026-07-15", "removedOn": null, "dpaUrl": null, "dpaSigned": false, "retention": null, "noTrainingFlowDown": null, "subProcessors": { "finding": "named", "entries": [ { "legalName": "Amazon Web Services, Inc", "jurisdiction": null, "purpose": "Hosting." }, { "legalName": "Cloudflare, Inc", "jurisdiction": null, "purpose": "Hosting." }, { "legalName": "Google, LLC", "jurisdiction": null, "purpose": "Hosting." }, { "legalName": "Fly.io, Inc", "jurisdiction": null, "purpose": "Hosting." }, { "legalName": "Upstash, Inc", "jurisdiction": null, "purpose": "Serverless data hosting. Also a sub-processor of ours in its own right." }, { "legalName": "Vercel, Inc", "jurisdiction": null, "purpose": "Hosting. Also a sub-processor of ours in its own right." } ], "sourceUrl": "https://supabase.com/legal/customer-resources/subprocessor-list", "verifiedOn": "2026-07-31", "note": "Their list is dated 1 June 2026 and names 19 parties without stating any country, so no jurisdiction is recorded for any of them. Recorded here are the six hosting providers; the remainder are their own support, sales and analytics tooling." } }, { "id": "upstash", "legalName": "Upstash, Inc.", "jurisdiction": "US", "registeredOffice": "California, United States", "parent": null, "processingLocations": [ { "kind": "unconfirmed", "note": "The region holding this database has not been evidenced. Its hostname is an alias for a latency-routed name the vendor shares across regions: on 2026-10-02, queried with Danish, US and Brazilian client subnets, it answered with addresses AWS publishes for eu-central-1 (Frankfurt), us-east-2 (Ohio) and sa-east-1 (São Paulo). DNS therefore shows the vendor edge nearest the client, not where the data, its replicas or its backups are held. Holds IP addresses and session identifiers, so Art. 30(1)(d)-(e) cannot be answered for it.", "summary": "Region not confirmed. Not used for customer content: a deployment that handles customer data refuses this provider at startup." } ], "layers": [ "storage" ], "purpose": "Redis: API rate limiting, session revocation, embedding cache, and impossible-travel detection.", "scope": "This provider serves the rate-limit and cache layer until a Valkey instance we host on EU hardware replaces it. Every part of the application reaches the store through one connection setting, so the move is a configuration change. A deployment that handles customer data cannot use this provider: it refuses at startup any Redis host other than one we operate or one internal to the deployment.", "role": "dpv:DataProcessor", "personalDataCategories": [ "pd:IPAddress", "pd:Location", "pd:UID" ], "transferBasis": { "kind": "unresolved", "reason": "US-incorporated processor holding IP addresses and session identifiers, reached over the Redis protocol through REDIS_URL. No transfer basis is evidenced." }, "cloudActExposed": true, "status": "live", "addedOn": "2026-07-15", "effectiveFrom": "2026-07-15", "removedOn": null, "dpaUrl": null, "dpaSigned": false, "retention": null, "noTrainingFlowDown": null, "subProcessors": { "finding": "named", "entries": [ { "legalName": "Amazon Web Services", "jurisdiction": "US", "purpose": "Cloud provider." }, { "legalName": "Google", "jurisdiction": "US", "purpose": "Cloud provider." }, { "legalName": "Cloudflare, Inc.", "jurisdiction": "US", "purpose": "Cloud services." }, { "legalName": "Humio (CrowdStrike Falcon LogScale)", "jurisdiction": "DK", "purpose": "Logging." } ], "sourceUrl": "https://upstash.com/trust/subprocessors.pdf", "verifiedOn": "2026-07-31", "note": "Their document states an address per party, used here as the jurisdiction. Several entries are scoped to products of theirs we do not use; those are excluded. Recorded here are the providers that could sit under the Redis service we consume." } }, { "id": "cloudflare", "legalName": "Cloudflare, Inc.", "jurisdiction": "US", "registeredOffice": "Delaware, United States", "parent": null, "processingLocations": [ { "kind": "global", "label": "global edge (anycast)" } ], "layers": [ "transit" ], "purpose": "DNS for our domain.", "scope": "DNS only since 2026-09-28: the web hostnames are no longer proxied, so this provider no longer terminates TLS or sees requests. Name resolution moves to an EU provider when we move to our own EU infrastructure; this row is then marked as being replaced, and it is removed thirty days later when the zone is deleted.", "role": "dpv:DataProcessor", "personalDataCategories": [ "pd:IPAddress", "pd:UserAgent" ], "transferBasis": { "kind": "unresolved", "reason": "DNS only since 2026-09-28: no web hostname is proxied, so the provider answers name lookups and neither terminates TLS nor sees requests. No basis is being sought: the provider leaves the register at the sovereignty cutover, when name resolution moves to an EU provider, so this row moves to removing on cutover day rather than being reassessed." }, "cloudActExposed": true, "status": "live", "addedOn": "2026-07-15", "effectiveFrom": "2026-07-15", "removedOn": null, "dpaUrl": null, "dpaSigned": false, "retention": null, "noTrainingFlowDown": null, "subProcessors": { "finding": "named", "entries": [ { "legalName": "Amazon Web Services (AWS)", "jurisdiction": null, "purpose": "Email Security product. Processing stated as United States and EEA.", "products": [ "Email Security" ] }, { "legalName": "Google LLC", "jurisdiction": null, "purpose": "Developer Platform, Zero Trust and AI Gateway. Processing stated as EEA, United States, Australia and India.", "products": [ "Developer Platform", "Zero Trust", "AI Gateway" ] }, { "legalName": "Oracle America, Inc.", "jurisdiction": null, "purpose": "Developer Platform and Cache Reserve. Processing stated across United States, EEA, UK, Japan, Australia, Canada and Singapore.", "products": [ "Developer Platform", "Cache Reserve" ] }, { "legalName": "CoreWeave, Inc.", "jurisdiction": null, "purpose": "Workers AI. Processing stated as United States.", "products": [ "Workers AI" ] }, { "legalName": "Nebius BV", "jurisdiction": null, "purpose": "Workers AI. Processing stated as England.", "products": [ "Workers AI" ] } ], "sourceUrl": "https://www.cloudflare.com/gdpr/subprocessors/cloudflare-services", "verifiedOn": "2026-07-31", "note": "Their list is dated 1 October 2025 and states processing regions rather than countries of incorporation, so regions are given in each purpose. It also names 16 of their own group affiliates, which are not recorded here as external parties. Every entry listed is scoped by them to a specific product, and none is attributed to DNS; that does not show that no party is involved in DNS." }, "productsUsed": [ "DNS" ] }, { "id": "sentry", "legalName": "Functional Software, Inc.", "jurisdiction": "US", "registeredOffice": "California, United States", "parent": null, "processingLocations": [ { "kind": "region", "country": "DE", "label": "ingest.de.sentry.io (Germany)" }, { "kind": "region", "country": "US", "label": "US region (Iowa) for account and operational metadata, whatever region is selected (scheduled-job check-ins, organisation settings and audit logs, project metadata, keys, tokens, usage data); uptime checks are stored in both regions. No customer personal data." } ], "layers": [ "telemetry" ], "purpose": "Application error and performance monitoring.", "scope": "Error events, spans and logs are sent to the ingest endpoint in Germany and stored in Frankfurt; error reporting switches itself off when it is configured with an endpoint outside the EU. Sentry stores account and operational metadata in the US whatever region is selected (scheduled-job check-ins, organisation settings and audit logs, project metadata, keys, access tokens, usage data), and stores uptime checks in both regions. None of it carries customer personal data, so no Chapter V transfer arises from it. This US storage ends when error tracking, scheduled-job monitoring and uptime checks move to infrastructure we host.", "role": "dpv:DataProcessor", "personalDataCategories": [ "pd:UID", "pd:UserAgent" ], "transferBasis": { "kind": "unresolved", "reason": "Ingest is pinned to the EU region by a fail-closed guard, but the entity is US-incorporated so remote access remains a Chapter V question. Basis must be confirmed against the signed DPA." }, "cloudActExposed": true, "status": "live", "addedOn": "2026-07-15", "effectiveFrom": "2026-07-15", "removedOn": null, "dpaUrl": null, "dpaSigned": false, "retention": { "summary": "90-day rolling event retention (vendor-documented: 90 days on paid plans, 30 on free; mirrored in docs/compliance/data-retention-policy.md); event.user.email attaches for consent-granted users and has no erasure hook, so it outlives an erasure request until the 90-day roll-off. Named residual in the erasure-propagation register; closes at the 0F Bugsink cutover.", "sourceUrl": "https://sentry.zendesk.com/hc/en-us/articles/27118913621019", "verifiedOn": "2026-07-22" }, "noTrainingFlowDown": null, "subProcessors": { "finding": "named", "entries": [ { "legalName": "Amazon Web Services, Inc.", "jurisdiction": null, "purpose": "Cloud infrastructure. Processing stated as EU and United States." }, { "legalName": "Cloudflare, Inc.", "jurisdiction": null, "purpose": "Cloud infrastructure. Processing stated as EU and United States." }, { "legalName": "Google LLC", "jurisdiction": null, "purpose": "Cloud infrastructure. Processing stated as EU and United States." } ], "sourceUrl": "https://sentry.io/legal/subprocessors", "verifiedOn": "2026-07-31", "note": "Their list is version 2.3.0 dated 1 June 2026 and states processing regions rather than countries of incorporation. Recorded here are the three cloud providers; the remainder are their email, support and group affiliates." } }, { "id": "brevo", "legalName": "Sendinblue SAS (Brevo)", "jurisdiction": "FR", "registeredOffice": "Paris, France", "parent": null, "processingLocations": [ { "kind": "region", "country": "FR", "label": "eu-west (France)" } ], "layers": [ "communications" ], "purpose": "Transactional email (notifications, account mail).", "scope": "Not in use yet: no mail goes through this provider until its account key is set.", "role": "dpv:DataProcessor", "personalDataCategories": [ "pd:EmailAddress", "pd:Name" ], "transferBasis": { "kind": "eu-only" }, "cloudActExposed": false, "status": "live", "addedOn": "2026-07-15", "effectiveFrom": "2026-07-15", "removedOn": null, "dpaUrl": null, "dpaSigned": false, "retention": { "summary": "Transactional EVENT logs (recipient, subject, delivery events) are stored indefinitely by default until an account retention rule is set (1 month to 5 years); email BODIES are not stored by default (\"Never store previews\" is the default). Provisioning checklist sets the 1-3 month rule in the same session as the key.", "sourceUrl": "https://help.brevo.com/hc/en-us/articles/4415743225746", "verifiedOn": "2026-07-22" }, "noTrainingFlowDown": null, "subProcessors": { "finding": "named", "entries": [ { "legalName": "Google Cloud Platform", "jurisdiction": "FR", "purpose": "Hosting. Servers stated as Belgium." }, { "legalName": "Scaleway (Iliad)", "jurisdiction": "FR", "purpose": "Hosting. Servers stated as France." }, { "legalName": "OVH", "jurisdiction": "FR", "purpose": "Hosting. Servers stated as France." }, { "legalName": "Hetzner Online GmbH", "jurisdiction": "DE", "purpose": "Hosting. Servers stated as Germany. Formerly a sub-processor of ours in its own right (removed 2026-09-13)." }, { "legalName": "Cloudflare", "jurisdiction": "US", "purpose": "CDN and WAF. Servers stated as United States and EU." } ], "sourceUrl": "https://corp-backend.brevo.com/wp-content/uploads/2024/08/BREVO-Annex-2-DPA-150524.pdf", "verifiedOn": "2026-07-31", "note": "Their DPA annex separates infrastructure sub-processors from the rest and states a registered office for each, used here as the jurisdiction. Recorded here is that infrastructure section." } }, { "id": "hetzner", "legalName": "Hetzner Online GmbH", "jurisdiction": "DE", "registeredOffice": "Gunzenhausen, Germany", "parent": null, "processingLocations": [ { "kind": "region", "country": "DE", "label": "nbg1 (Nuremberg)" } ], "layers": [ "storage" ], "purpose": "S3-compatible object storage for raw document bytes.", "scope": "Removed on 13 September 2026, before it ever held a byte: no account was opened and no credential issued. The at-rest decision record chose a vendor with bucket-default server-side encryption, which this vendor does not offer (rechecked 2026-09-13), so raw document bytes go to Scaleway (fr-par) instead, disclosed below. The residency allow list, the example configuration and the storage claim no longer name this vendor's host.", "role": "dpv:DataProcessor", "personalDataCategories": [ "pd:Name" ], "transferBasis": { "kind": "eu-only" }, "cloudActExposed": false, "status": "removed", "addedOn": "2026-07-15", "effectiveFrom": "2026-07-15", "removedOn": "2026-09-13", "dpaUrl": null, "dpaSigned": false, "retention": null, "noTrainingFlowDown": null, "subProcessors": { "finding": "named", "entries": [ { "legalName": "Hetzner Finland Oy", "jurisdiction": "FI", "purpose": "Building rental and technical support.", "engagement": "in-path" }, { "legalName": "Hetzner US LLC", "jurisdiction": "US", "purpose": "Server rental for their US site.", "engagement": "out-of-path" }, { "legalName": "NTT Global Data Centers Americas, Inc.", "jurisdiction": "US", "purpose": "Colocation for their US site.", "engagement": "out-of-path" }, { "legalName": "QTS Investment Properties Hillsboro, LLC", "jurisdiction": "US", "purpose": "Colocation for their US site.", "engagement": "out-of-path" }, { "legalName": "Hetzner Singapore Pte. Ltd.", "jurisdiction": "SG", "purpose": "Server rental for their Singapore site.", "engagement": "out-of-path" }, { "legalName": "NTT Global Data Centers SG1 Pte Ltd", "jurisdiction": "SG", "purpose": "Colocation for their Singapore site.", "engagement": "out-of-path" } ], "sourceUrl": "https://www.hetzner.com/AV/subunternehmer.pdf", "verifiedOn": "2026-07-31", "note": "Their annex is version 1.0 dated 6 August 2024 and names six parties, all of them infrastructure, with a location for each. They state that data on EU-located servers is processed exclusively within the EU; the non-EU entities below serve their US and Singapore sites, which we do not use." } }, { "id": "scaleway", "legalName": "Scaleway SAS", "jurisdiction": "FR", "registeredOffice": "Paris, France", "parent": { "legalName": "Iliad S.A.", "jurisdiction": "FR" }, "processingLocations": [ { "kind": "region", "country": "FR", "label": "fr-par (Paris)" } ], "layers": [ "storage" ], "purpose": "S3-compatible object storage for the original files of documents, and for database backups.", "scope": "Not in use yet. Two private buckets in the Paris region were created on 13 September 2026, one for documents with server-side encryption and versioning and one for backups. No customer data reaches them before this provider's effective date, the earliest the notice period allows, and none until document storage is switched to this provider.", "role": "dpv:DataProcessor", "personalDataCategories": [ "pd:Name" ], "transferBasis": { "kind": "eu-only" }, "cloudActExposed": false, "status": "live", "addedOn": "2026-09-13", "effectiveFrom": "2026-10-13", "removedOn": null, "dpaUrl": "https://www-uploads.scaleway.com/DPA_2024_ENG_b0abb5cc26.pdf", "dpaSigned": true, "retention": { "summary": "Retention is the customer's choice for the duration of the contract (DPA 2024, section 2, Duration); at the end of the contract the vendor ceases processing and deletes the personal data and every copy, save what applicable law or its legitimate interests require, within the limits those set (section 13.1). Services are located in the EU by default and the region is the customer's selection at order (section 11.1); the vendor undertakes not to store personal data outside the EU without informing the customer in advance (section 11.2.2).", "sourceUrl": "https://www-uploads.scaleway.com/DPA_2024_ENG_b0abb5cc26.pdf", "verifiedOn": "2026-09-13" }, "noTrainingFlowDown": null, "subProcessors": { "finding": "named", "entries": [ { "legalName": "OpCore", "jurisdiction": "FR", "purpose": "Colocation services, France.", "engagement": "in-path" }, { "legalName": "Atempo", "jurisdiction": "FR", "purpose": "Data recording and archiving solutions for cold storage (Object Storage).", "engagement": "in-path" }, { "legalName": "Atnorth", "jurisdiction": "SE", "purpose": "Colocation services, Sweden.", "engagement": "out-of-path" }, { "legalName": "3S Data Center S.A.", "jurisdiction": "PL", "purpose": "Colocation services, Poland.", "engagement": "out-of-path" }, { "legalName": "Atman sp. z o.o.", "jurisdiction": "PL", "purpose": "Colocation services, Poland.", "engagement": "out-of-path" }, { "legalName": "Equinix EMEA", "jurisdiction": "US", "purpose": "Colocation services in Italy, the Netherlands and Poland.", "engagement": "out-of-path" }, { "legalName": "Iron Mountain", "jurisdiction": "US", "purpose": "Colocation services, Netherlands.", "engagement": "out-of-path" }, { "legalName": "Digital Realty", "jurisdiction": "US", "purpose": "Colocation services, Netherlands.", "engagement": "out-of-path" }, { "legalName": "BrainStorm Network Inc.", "jurisdiction": "CA", "purpose": "Service provider for a VPS product we do not use.", "engagement": "out-of-path" }, { "legalName": "Clever Cloud", "jurisdiction": "FR", "purpose": "Cloud provider for a web-platform product we do not use.", "engagement": "out-of-path" }, { "legalName": "Confia", "jurisdiction": "FR", "purpose": "Recycling of waste electrical and electronic equipment.", "engagement": "out-of-path" } ], "sourceUrl": "https://www.scaleway.com/en/subprocessorlist/", "verifiedOn": "2026-09-13", "note": "Their list (last reviewed July 2025) names seven data-centre operators, each with an EU processing location, and four service parties. We use Object Storage in the Paris region only, so the in-path parties are the French colocation operator and the cold-storage archiving supplier the list attaches to Object Storage; the three US-headquartered operators serve Italian, Dutch and Polish sites we do not select. Changes are notified 30 days ahead to customers subscribed on that page (DPA section 7.4), with a right to object." } }, { "id": "vercel", "legalName": "Vercel Inc.", "jurisdiction": "US", "registeredOffice": "California, United States", "parent": null, "processingLocations": [ { "kind": "global", "label": "global edge" } ], "layers": [ "transit" ], "purpose": "Application hosting and scheduled jobs (former deployment target).", "scope": "No longer serves the application: since 2026-09-28 the domain points at our own server in the EU. The provider still holds the frozen old deployment, its request logs and the configuration stored with it until the projects are deleted; the row is marked removed once that deletion and the rotation of the credentials it held are recorded.", "role": "dpv:DataProcessor", "personalDataCategories": [ "pd:IPAddress", "pd:UserAgent" ], "transferBasis": { "kind": "unresolved", "reason": "US-incorporated host handling the full request path. Basis must be confirmed against the signed DPA." }, "cloudActExposed": true, "status": "removing", "addedOn": "2026-07-15", "effectiveFrom": "2026-07-15", "removedOn": null, "dpaUrl": null, "dpaSigned": false, "retention": null, "noTrainingFlowDown": null, "subProcessors": { "finding": "named", "entries": [ { "legalName": "Amazon Web Services, Inc.", "jurisdiction": "US", "purpose": "Hosting, storage and generative AI." }, { "legalName": "Google LLC", "jurisdiction": "US", "purpose": "Cloud computing, storage and generative AI." }, { "legalName": "Microsoft Corporation", "jurisdiction": "US", "purpose": "Hosting, storage and generative AI." }, { "legalName": "Upstash, Inc.", "jurisdiction": "US", "purpose": "Serverless storage. Also a sub-processor of ours in its own right." }, { "legalName": "Neon", "jurisdiction": "US", "purpose": "Serverless storage." }, { "legalName": "Redis Labs, Inc.", "jurisdiction": "US", "purpose": "Real-time logging and security." } ], "sourceUrl": "https://security.vercel.com/subprocessors", "verifiedOn": "2026-07-31", "note": "Their list names 28 parties with a location each, used here as the jurisdiction. Recorded here are the six providing hosting or storage; the remainder are their monitoring, support and AI-feature vendors." } }, { "id": "netcup", "legalName": "netcup GmbH", "jurisdiction": "DE", "registeredOffice": "Karlsruhe, Germany", "parent": { "legalName": "Anexia Cloud Solutions GmbH", "jurisdiction": "AT" }, "processingLocations": [ { "kind": "region", "country": "AT", "label": "Vienna (EU)" } ], "layers": [ "transit", "storage" ], "purpose": "Hosting on our own EU server: the Next.js web application today, and at the cutover the BullMQ worker and the self-hosted sidecars (Valkey, SearXNG, MarkItDown, Bugsink, embedding/rerank). Replaced Vercel.", "scope": "Server in the Vienna data centre (the site chosen at order); the Art. 28 agreement was concluded on 2026-09-14 (contract generator in the customer panel, template version 2026/07, Annex 3 completed by us). Serves the web application since 2026-09-28, ahead of the full move; the worker and the other services we host ourselves follow at the cutover. Software we run on it is our own and is not a separate sub-processor.", "role": "dpv:DataProcessor", "personalDataCategories": [ "pd:Name", "pd:EmailAddress", "pd:IPAddress", "pd:UserAgent" ], "transferBasis": { "kind": "eu-only" }, "cloudActExposed": false, "status": "live", "addedOn": "2026-07-15", "effectiveFrom": "2026-08-14", "removedOn": null, "dpaUrl": "https://www.netcup.com/en/helpcenter/documentation/general/dpa", "dpaSigned": true, "retention": { "summary": "At the end of the service the vendor deletes or returns all personal data at our choice and deletes existing copies; data still held in the vendor's backups is deleted at most 14 days later (executed agreement, section 3(9)). Erasure promises for the hosting layer therefore carry a 14-day backup tail.", "sourceUrl": "https://www.netcup.com/en/helpcenter/documentation/general/dpa", "verifiedOn": "2026-09-14" }, "noTrainingFlowDown": null, "subProcessors": { "finding": "named", "entries": [ { "legalName": "Anexia Cloud Solutions GmbH", "jurisdiction": "AT", "purpose": "Infrastructure services in the data centre environment and provision of personnel (Klagenfurt). Lead company of the group the vendor belongs to." }, { "legalName": "Anexia Cloud Solutions GmbH (Germany)", "jurisdiction": "DE", "purpose": "Infrastructure services in the data centre environment and provision of personnel (Karlsruhe establishment)." }, { "legalName": "Anexia Holding GmbH", "jurisdiction": "AT", "purpose": "Support services such as regulatory enquiries and billing (Klagenfurt)." }, { "legalName": "DATASIX Rechenzentrumsbetriebs GmbH", "jurisdiction": "AT", "purpose": "Data centre operations within the group (Vienna). Named in the certification scope of the agreement's annex on technical and organisational measures, not in its list of other processors; recorded because Vienna is the site our server order names, so it is the in-path operator." } ], "sourceUrl": "https://www.netcup.com/en/helpcenter/documentation/general/dpa", "verifiedOn": "2026-09-14", "note": "The vendor publishes no sub-processor page; the parties are named in Annex 2 of the Art. 28 agreement, which a customer receives only on concluding it through the customer panel (the linked help-centre page describes that path). Read from our executed copy on 2026-09-14. Further subcontractors are announced in writing with a 14-calendar-day objection window, and the agreement excludes pure infrastructure provision from its definition of a subcontractor, so the list is narrower than the click-through lists other vendors here publish. The earlier reading of this row named a colocation provider that the executed agreement does not, so that entry is gone." } }, { "id": "bunny", "legalName": "BunnyWay d.o.o. (Bunny.net)", "jurisdiction": "SI", "registeredOffice": "Ljubljana, Slovenia", "parent": null, "processingLocations": [ { "kind": "global", "label": "anycast edge network; a pull zone is served from every edge until pinned to European locations at provisioning" } ], "layers": [ "transit" ], "purpose": "Content delivery network for static assets and document byte serving (target architecture).", "scope": "Announced, not yet processing. Before it is enabled, its pull zone has to be pinned to European edge locations; that pinning is a configuration we set at provisioning, not a property of the service, so it is a step we owe rather than an assurance we can give today.", "role": "dpv:DataProcessor", "personalDataCategories": [ "pd:IPAddress", "pd:UserAgent" ], "transferBasis": { "kind": "unresolved", "reason": "The company is Slovenian, but its edge network is anycast: until the pull zone is pinned to European locations at provisioning, a request can be served from a non-EEA edge, and the basis for that leg is not established. Becomes eu-only when the pin is set and the processing location is recorded as an EEA region." }, "cloudActExposed": false, "status": "planned", "addedOn": "2026-07-15", "effectiveFrom": "2026-08-14", "removedOn": null, "dpaUrl": null, "dpaSigned": false, "retention": null, "noTrainingFlowDown": null, "subProcessors": { "finding": "not-covered", "sourceUrl": "https://bunny.net/gdpr/sub-processors/", "verifiedOn": "2026-07-31", "note": "Their disclosure names six parties, none of which is an infrastructure, colocation or network provider: it covers their support desk, email, bug tracking and one AI feature vendor. So the parties behind their edge network are not disclosed by them. The empty list here records that absence rather than an assurance that none exists." } } ], "history": [ { "revision": 1, "recordedOn": "2026-07-15", "summary": "Register established: the nine processors in use plus the two announced EU replacements.", "changes": [ { "op": "added", "id": "brevo", "row": { "id": "brevo", "legalName": "Sendinblue SAS (Brevo)", "jurisdiction": "FR", "registeredOffice": "Paris, France", "parent": null, "processingLocations": [ { "kind": "region", "country": "FR", "label": "eu-west (France)" } ], "layers": [ "communications" ], "purpose": "Transactional email (notifications, account mail).", "scope": "Inert until BREVO_API_KEY is provisioned.", "role": "dpv:DataProcessor", "personalDataCategories": [ "pd:EmailAddress", "pd:Name" ], "transferBasis": { "kind": "eu-only" }, "cloudActExposed": false, "status": "live", "addedOn": "2026-07-15", "effectiveFrom": "2026-07-15", "removedOn": null, "dpaUrl": null, "dpaSigned": false, "retention": { "summary": "Transactional EVENT logs (recipient, subject, delivery events) are stored indefinitely by default until an account retention rule is set (1 month to 5 years); email BODIES are not stored by default (\"Never store previews\" is the default). Provisioning checklist sets the 1-3 month rule in the same session as the key.", "sourceUrl": "https://help.brevo.com/hc/en-us/articles/4415743225746", "verifiedOn": "2026-07-22" }, "noTrainingFlowDown": null, "subProcessors": null } }, { "op": "added", "id": "bunny", "row": { "id": "bunny", "legalName": "BunnyWay d.o.o. (Bunny.net)", "jurisdiction": "SI", "registeredOffice": "Ljubljana, Slovenia", "parent": null, "processingLocations": [ { "kind": "region", "country": "SI", "label": "EU edge (pinned)" } ], "layers": [ "transit" ], "purpose": "Content delivery network for static assets and document byte serving (target architecture).", "scope": "Announced, not yet processing. Will serve static assets from EU-only edge locations, pinned so cached bytes stay within the EU.", "role": "dpv:DataProcessor", "personalDataCategories": [ "pd:IPAddress", "pd:UserAgent" ], "transferBasis": { "kind": "eu-only" }, "cloudActExposed": false, "status": "planned", "addedOn": "2026-07-15", "effectiveFrom": "2026-08-14", "removedOn": null, "dpaUrl": null, "dpaSigned": false, "retention": null, "noTrainingFlowDown": null, "subProcessors": null } }, { "op": "added", "id": "cloudflare", "row": { "id": "cloudflare", "legalName": "Cloudflare, Inc.", "jurisdiction": "US", "registeredOffice": "Delaware, United States", "parent": null, "processingLocations": [ { "kind": "global", "label": "global edge (anycast)" } ], "layers": [ "transit" ], "purpose": "DNS. The apex is currently also reverse-proxied, so Cloudflare terminates TLS for it.", "scope": "Our decided posture is DNS-only, which would leave this provider handling name resolution but not request content. The apex domain is still proxied today, so it currently terminates TLS and sees request bodies. This row states what is true now, not the intended end state.", "role": "dpv:DataProcessor", "personalDataCategories": [ "pd:IPAddress", "pd:UserAgent" ], "transferBasis": { "kind": "unresolved", "reason": "The apex A record is currently proxied, so TLS terminates at the provider and full request bodies pass through it; the www hostname is DNS-only. The decided posture is DNS-only for both, under which the provider handles DNS metadata rather than customer content. This row is reassessed once the apex is switched." }, "cloudActExposed": true, "status": "live", "addedOn": "2026-07-15", "effectiveFrom": "2026-07-15", "removedOn": null, "dpaUrl": null, "dpaSigned": false, "retention": null, "noTrainingFlowDown": null, "subProcessors": null } }, { "op": "added", "id": "hetzner", "row": { "id": "hetzner", "legalName": "Hetzner Online GmbH", "jurisdiction": "DE", "registeredOffice": "Gunzenhausen, Germany", "parent": null, "processingLocations": [ { "kind": "region", "country": "DE", "label": "nbg1 (Nuremberg)" } ], "layers": [ "storage" ], "purpose": "S3-compatible object storage for raw document bytes.", "scope": "Engaged only when STORAGE_PROVIDER=s3; the default storage provider is Supabase.", "role": "dpv:DataProcessor", "personalDataCategories": [ "pd:Name" ], "transferBasis": { "kind": "eu-only" }, "cloudActExposed": false, "status": "live", "addedOn": "2026-07-15", "effectiveFrom": "2026-07-15", "removedOn": null, "dpaUrl": null, "dpaSigned": false, "retention": null, "noTrainingFlowDown": null, "subProcessors": null } }, { "op": "added", "id": "jina-ai", "row": { "id": "jina-ai", "legalName": "Jina AI GmbH", "jurisdiction": "DE", "registeredOffice": "Berlin, Germany", "parent": { "legalName": "Elastic N.V.", "jurisdiction": "US" }, "processingLocations": [ { "kind": "region", "country": "DE", "label": "eu-central (Berlin)" } ], "layers": [ "inference" ], "purpose": "Text embeddings and reranking for retrieval.", "scope": "Refused for customer data since 31 July 2026: the platform will not start in production with this provider configured for embeddings, so it cannot process customer content. It stays listed because the credential is still read in development, and it remains the development default until the EU replacement is in place: embedding and reranking models we host ourselves on EU hardware, or a managed API under EU jurisdiction.", "role": "dpv:DataProcessor", "personalDataCategories": [ "pd:Name" ], "transferBasis": { "kind": "unresolved", "reason": "Processing is in Germany, but the parent company is outside the EEA, so remote access is a Chapter V transfer under EDPB Guidelines 05/2021. The applicable basis is being confirmed against the signed DPA and is not settled yet." }, "cloudActExposed": true, "status": "live", "addedOn": "2026-07-15", "effectiveFrom": "2026-07-15", "removedOn": null, "dpaUrl": null, "dpaSigned": false, "retention": { "summary": "No zero-data-retention commitment for the API: their terms permit retaining customer-submitted data in anonymised/pseudonymised form for business purposes including model improvement, and the privacy policy carves API content out to customer agreements. No DPA signed. Named residual until the planned self-hosted embedding cutover.", "sourceUrl": "https://jina.ai/legal/", "verifiedOn": "2026-07-22" }, "noTrainingFlowDown": { "committed": false, "mechanism": "SUPERSEDED BY THE ACQUISITION. Jina AI Terms section 10.4 carried a clean unconditional commitment (\"Jina AI does not use Customer request data, inputs, prompts, or uploaded content to train its models\"), but Jina AI’s own legal page states that following Elastic’s October 2025 acquisition, data processing is governed by Elastic’s Customer DPA rather than the legacy Jina terms. Elastic’s published privacy statement carries a non-training commitment only for marketing data handled by third-party vendors, and does not address customer data submitted to Jina APIs. The flow-down is therefore not established today and needs the signed Elastic Customer DPA to resolve.", "sourceUrl": "https://jina.ai/legal/", "verifiedOn": "2026-07-27" }, "subProcessors": null } }, { "op": "added", "id": "mistral", "row": { "id": "mistral", "legalName": "Mistral AI SAS", "jurisdiction": "FR", "registeredOffice": "Paris, France", "parent": null, "processingLocations": [ { "kind": "region", "country": "FR", "label": "eu-west (France)" } ], "layers": [ "inference" ], "purpose": "LLM generation: chat answers, planning, agent loop, vision, and input moderation. The sole generation provider; there is no non-EU fallback.", "scope": "Prompts carry user queries plus retrieved document excerpts. Zero-retention and training opt-out are account-level settings with this provider, not per-request, so they are recorded here rather than asserted per call.", "role": "dpv:DataProcessor", "personalDataCategories": [ "pd:Name", "pd:UserAgent" ], "transferBasis": { "kind": "eu-only" }, "cloudActExposed": false, "status": "live", "addedOn": "2026-07-15", "effectiveFrom": "2026-07-15", "removedOn": null, "dpaUrl": null, "dpaSigned": false, "retention": null, "noTrainingFlowDown": { "committed": false, "mechanism": "Contractual and unconditional on a paid plan: Commercial Terms of Service section 4.2 (Training) states Mistral AI will not use Customer Data or Outputs to train its models, excepting free subscriptions and the Vibe products where the customer has not opted out. Section 4.3 carves out Labs Models, which we do not use (generation and vision run on mistral-small). NOT in force yet only because the production paid subscription is not provisioned; it flips to true with the production key.", "sourceUrl": "https://legal.mistral.ai/terms/commercial-terms-of-service", "verifiedOn": "2026-07-27" }, "subProcessors": null } }, { "op": "added", "id": "netcup", "row": { "id": "netcup", "legalName": "netcup GmbH", "jurisdiction": "DE", "registeredOffice": "Karlsruhe, Germany", "parent": null, "processingLocations": [ { "kind": "region", "country": "DE", "label": "Nuremberg (EU)" } ], "layers": [ "transit", "storage" ], "purpose": "Application + worker hosting (target architecture): the Next.js app, the BullMQ worker, and the self-hosted sidecars (Valkey, SearXNG, MarkItDown, Bugsink, embedding/rerank) run on a single EU box. Replaces Vercel.", "scope": "Announced, not yet processing. Will provide EU compute for the services we host ourselves. Software we run on it is our own and is not a separate sub-processor.", "role": "dpv:DataProcessor", "personalDataCategories": [ "pd:Name", "pd:EmailAddress", "pd:IPAddress", "pd:UserAgent" ], "transferBasis": { "kind": "eu-only" }, "cloudActExposed": false, "status": "planned", "addedOn": "2026-07-15", "effectiveFrom": "2026-08-14", "removedOn": null, "dpaUrl": null, "dpaSigned": false, "retention": null, "noTrainingFlowDown": null, "subProcessors": null } }, { "op": "added", "id": "sentry", "row": { "id": "sentry", "legalName": "Functional Software, Inc.", "jurisdiction": "US", "registeredOffice": "California, United States", "parent": null, "processingLocations": [ { "kind": "region", "country": "DE", "label": "ingest.de.sentry.io (Germany)" } ], "layers": [ "telemetry" ], "purpose": "Application error and performance monitoring.", "scope": "EU ingest is enforced in code: the client fails closed rather than sending to a non-EU endpoint. Being replaced by an error tracker we host ourselves; that migration has not started.", "role": "dpv:DataProcessor", "personalDataCategories": [ "pd:UID", "pd:UserAgent" ], "transferBasis": { "kind": "unresolved", "reason": "Ingest is pinned to the EU region by a fail-closed guard, but the entity is US-incorporated so remote access remains a Chapter V question. Basis must be confirmed against the signed DPA." }, "cloudActExposed": true, "status": "live", "addedOn": "2026-07-15", "effectiveFrom": "2026-07-15", "removedOn": null, "dpaUrl": null, "dpaSigned": false, "retention": { "summary": "90-day rolling event retention (vendor-documented: 90 days on paid plans, 30 on free; mirrored in docs/compliance/data-retention-policy.md); event.user.email attaches for consent-granted users and has no erasure hook, so it outlives an erasure request until the 90-day roll-off. Named residual in the erasure-propagation register; closes at the 0F Bugsink cutover.", "sourceUrl": "https://sentry.zendesk.com/hc/en-us/articles/27118913621019", "verifiedOn": "2026-07-22" }, "noTrainingFlowDown": null, "subProcessors": null } }, { "op": "added", "id": "supabase", "row": { "id": "supabase", "legalName": "Supabase, Inc.", "jurisdiction": "US", "registeredOffice": "Delaware, United States", "parent": null, "processingLocations": [ { "kind": "region", "country": "IE", "label": "aws eu-west-1 (Ireland)" } ], "layers": [ "storage" ], "purpose": "Primary datastore: Postgres (documents, chunks, embeddings, tenants), authentication, and default object storage.", "scope": "Being replaced by our own Postgres and object storage on EU hardware. That migration has not started; until it lands, this provider holds the document corpus.", "role": "dpv:DataProcessor", "personalDataCategories": [ "pd:Name", "pd:EmailAddress", "pd:Password", "pd:UserAgent" ], "transferBasis": { "kind": "unresolved", "reason": "Data rests in an EU region but the provider is US-incorporated, so remote access is a Chapter V transfer. The applicable basis is being confirmed against the signed DPA. This provider runs on infrastructure it engages in turn, which is not yet itemised in this register." }, "cloudActExposed": true, "status": "live", "addedOn": "2026-07-15", "effectiveFrom": "2026-07-15", "removedOn": null, "dpaUrl": null, "dpaSigned": false, "retention": null, "noTrainingFlowDown": null, "subProcessors": null } }, { "op": "added", "id": "upstash", "row": { "id": "upstash", "legalName": "Upstash, Inc.", "jurisdiction": "US", "registeredOffice": "California, United States", "parent": null, "processingLocations": [ { "kind": "unconfirmed", "note": "Region is not pinned in code and the vendor's deployment region for this database has not been evidenced. Holds IP addresses and session identifiers, so Art. 30(1)(d)-(e) cannot be answered for it." } ], "layers": [ "storage" ], "purpose": "Redis: API rate limiting, session revocation, embedding cache, and impossible-travel detection.", "scope": "Being replaced by a cache we host ourselves on EU hardware. That migration has not started; until it lands, this provider serves the rate-limit and cache layer.", "role": "dpv:DataProcessor", "personalDataCategories": [ "pd:IPAddress", "pd:Location", "pd:UID" ], "transferBasis": { "kind": "unresolved", "reason": "US-incorporated processor holding IP addresses and session identifiers. Region is not pinned in code and the basis is not evidenced. This is a hard boot dependency: UPSTASH_REDIS_REST_URL is required, not optional." }, "cloudActExposed": true, "status": "live", "addedOn": "2026-07-15", "effectiveFrom": "2026-07-15", "removedOn": null, "dpaUrl": null, "dpaSigned": false, "retention": null, "noTrainingFlowDown": null, "subProcessors": null } }, { "op": "added", "id": "vercel", "row": { "id": "vercel", "legalName": "Vercel Inc.", "jurisdiction": "US", "registeredOffice": "California, United States", "parent": null, "processingLocations": [ { "kind": "global", "label": "global edge" } ], "layers": [ "transit" ], "purpose": "Application hosting and scheduled jobs (current deployment target).", "scope": "Being replaced by application hosting we run ourselves on EU hardware. That migration has not started; until it lands, this provider serves the application.", "role": "dpv:DataProcessor", "personalDataCategories": [ "pd:IPAddress", "pd:UserAgent" ], "transferBasis": { "kind": "unresolved", "reason": "US-incorporated host handling the full request path. Basis must be confirmed against the signed DPA." }, "cloudActExposed": true, "status": "live", "addedOn": "2026-07-15", "effectiveFrom": "2026-07-15", "removedOn": null, "dpaUrl": null, "dpaSigned": false, "retention": null, "noTrainingFlowDown": null, "subProcessors": null } } ], "stateHash": "sha256:3e839a32aaeba0bd145b9d03de53e3d93eaad28db091fea661abb8678aeafe30" }, { "revision": 2, "recordedOn": "2026-08-01", "summary": "Fourth-party chains recorded for ten processors from their own published disclosures; the embedding provider publishes none and stays unestablished.", "changes": [ { "op": "changed", "id": "brevo", "field": "subProcessors", "from": null, "to": { "entries": [ { "legalName": "Google Cloud Platform", "jurisdiction": "FR", "purpose": "Hosting. Servers stated as Belgium." }, { "legalName": "Scaleway (Iliad)", "jurisdiction": "FR", "purpose": "Hosting. Servers stated as France." }, { "legalName": "OVH", "jurisdiction": "FR", "purpose": "Hosting. Servers stated as France." }, { "legalName": "Hetzner Online GmbH", "jurisdiction": "DE", "purpose": "Hosting. Servers stated as Germany. Also a sub-processor of ours in its own right." }, { "legalName": "Cloudflare", "jurisdiction": "US", "purpose": "CDN and WAF. Servers stated as United States and EU." } ], "sourceUrl": "https://corp-backend.brevo.com/wp-content/uploads/2024/08/BREVO-Annex-2-DPA-150524.pdf", "verifiedOn": "2026-07-31", "note": "Their DPA annex separates infrastructure sub-processors from the rest and states a registered office for each, used here as the jurisdiction. Recorded here is that infrastructure section." } }, { "op": "changed", "id": "bunny", "field": "subProcessors", "from": null, "to": { "entries": [], "sourceUrl": "https://bunny.net/gdpr/sub-processors/", "verifiedOn": "2026-07-31", "note": "Their disclosure names six parties, none of which is an infrastructure, colocation or network provider: it covers their support desk, email, bug tracking and one AI feature vendor. So the parties behind their edge network are not disclosed by them. The empty list here records that absence rather than an assurance that none exists." } }, { "op": "changed", "id": "cloudflare", "field": "subProcessors", "from": null, "to": { "entries": [ { "legalName": "Amazon Web Services (AWS)", "jurisdiction": null, "purpose": "Email Security product. Processing stated as United States and EEA." }, { "legalName": "Google LLC", "jurisdiction": null, "purpose": "Developer Platform, Zero Trust and AI Gateway. Processing stated as EEA, United States, Australia and India." }, { "legalName": "Oracle America, Inc.", "jurisdiction": null, "purpose": "Developer Platform and Cache Reserve. Processing stated across United States, EEA, UK, Japan, Australia, Canada and Singapore." }, { "legalName": "CoreWeave, Inc.", "jurisdiction": null, "purpose": "Workers AI. Processing stated as United States." }, { "legalName": "Nebius BV", "jurisdiction": null, "purpose": "Workers AI. Processing stated as England." } ], "sourceUrl": "https://www.cloudflare.com/gdpr/subprocessors/cloudflare-services", "verifiedOn": "2026-07-31", "note": "Their list is dated 1 October 2025 and states processing regions rather than countries of incorporation, so regions are given in each purpose. It also names 16 of their own group affiliates, which are not recorded here as external parties. Every entry below is scoped by them to a specific product; none is stated to apply to DNS." } }, { "op": "changed", "id": "hetzner", "field": "subProcessors", "from": null, "to": { "entries": [ { "legalName": "Hetzner Finland Oy", "jurisdiction": "FI", "purpose": "Building rental and technical support." }, { "legalName": "Hetzner US LLC", "jurisdiction": "US", "purpose": "Server rental for their US site." }, { "legalName": "NTT Global Data Centers Americas, Inc.", "jurisdiction": "US", "purpose": "Colocation for their US site." }, { "legalName": "QTS Investment Properties Hillsboro, LLC", "jurisdiction": "US", "purpose": "Colocation for their US site." }, { "legalName": "Hetzner Singapore Pte. Ltd.", "jurisdiction": "SG", "purpose": "Server rental for their Singapore site." }, { "legalName": "NTT Global Data Centers SG1 Pte Ltd", "jurisdiction": "SG", "purpose": "Colocation for their Singapore site." } ], "sourceUrl": "https://www.hetzner.com/AV/subunternehmer.pdf", "verifiedOn": "2026-07-31", "note": "Their annex is version 1.0 dated 6 August 2024 and names six parties, all of them infrastructure, with a location for each. They state that data on EU-located servers is processed exclusively within the EU; the non-EU entities below serve their US and Singapore sites, which we do not use." } }, { "op": "changed", "id": "mistral", "field": "subProcessors", "from": null, "to": { "entries": [ { "legalName": "Mistral Compute", "jurisdiction": "FR", "purpose": "Cloud infrastructure for all products. Their own compute arm rather than an external party." }, { "legalName": "Microsoft Inc.", "jurisdiction": null, "purpose": "Cloud infrastructure. Processing stated as Sweden and Norway." }, { "legalName": "Google LLC", "jurisdiction": null, "purpose": "Cloud infrastructure. Processing stated as Netherlands, Belgium and the United States." }, { "legalName": "CoreWeave Inc.", "jurisdiction": null, "purpose": "Inference provider. Processing stated as the EEA." }, { "legalName": "Cloudflare Inc.", "jurisdiction": null, "purpose": "Security and traffic routing. Processing stated as worldwide." } ], "sourceUrl": "https://trust.mistral.ai/subprocessors", "verifiedOn": "2026-07-31", "note": "Their disclosure lists 24 parties, several scoped to products we do not use. Recorded here are the infrastructure and inference providers whose stated scope covers the API. Their page states processing regions rather than countries of incorporation, so those regions are given in each purpose and jurisdiction is left unstated." } }, { "op": "changed", "id": "netcup", "field": "subProcessors", "from": null, "to": { "entries": [ { "legalName": "Hetzner Online GmbH", "jurisdiction": "DE", "purpose": "Colocation data centre, Nuremberg. Also a sub-processor of ours in its own right." }, { "legalName": "DATASIX Rechenzentrumsbetriebs GmbH", "jurisdiction": "AT", "purpose": "Data centre operator, Vienna." } ], "sourceUrl": "https://www.netcup.com/en/legal/privacy-policy", "verifiedOn": "2026-07-31", "note": "They publish no standalone sub-processor page; the parties below are named in their Art 28 processing agreement, which reaches a customer only on execution. That is a weaker disclosure mechanism than the click-through lists every other vendor here offers, and it is recorded as such." } }, { "op": "changed", "id": "sentry", "field": "subProcessors", "from": null, "to": { "entries": [ { "legalName": "Amazon Web Services, Inc.", "jurisdiction": null, "purpose": "Cloud infrastructure. Processing stated as EU and United States." }, { "legalName": "Cloudflare, Inc.", "jurisdiction": null, "purpose": "Cloud infrastructure. Processing stated as EU and United States." }, { "legalName": "Google LLC", "jurisdiction": null, "purpose": "Cloud infrastructure. Processing stated as EU and United States." } ], "sourceUrl": "https://sentry.io/legal/subprocessors", "verifiedOn": "2026-07-31", "note": "Their list is version 2.3.0 dated 1 June 2026 and states processing regions rather than countries of incorporation. Recorded here are the three cloud providers; the remainder are their email, support and group affiliates." } }, { "op": "changed", "id": "supabase", "field": "subProcessors", "from": null, "to": { "entries": [ { "legalName": "Amazon Web Services, Inc", "jurisdiction": null, "purpose": "Hosting." }, { "legalName": "Cloudflare, Inc", "jurisdiction": null, "purpose": "Hosting." }, { "legalName": "Google, LLC", "jurisdiction": null, "purpose": "Hosting." }, { "legalName": "Fly.io, Inc", "jurisdiction": null, "purpose": "Hosting." }, { "legalName": "Upstash, Inc", "jurisdiction": null, "purpose": "Serverless data hosting. Also a sub-processor of ours in its own right." }, { "legalName": "Vercel, Inc", "jurisdiction": null, "purpose": "Hosting. Also a sub-processor of ours in its own right." } ], "sourceUrl": "https://supabase.com/legal/customer-resources/subprocessor-list", "verifiedOn": "2026-07-31", "note": "Their list is dated 1 June 2026 and names 19 parties without stating any country, so no jurisdiction is recorded for any of them. Recorded here are the six hosting providers; the remainder are their own support, sales and analytics tooling." } }, { "op": "changed", "id": "upstash", "field": "subProcessors", "from": null, "to": { "entries": [ { "legalName": "Amazon Web Services", "jurisdiction": "US", "purpose": "Cloud provider." }, { "legalName": "Google", "jurisdiction": "US", "purpose": "Cloud provider." }, { "legalName": "Cloudflare, Inc.", "jurisdiction": "US", "purpose": "Cloud services." }, { "legalName": "Humio (CrowdStrike Falcon LogScale)", "jurisdiction": "DK", "purpose": "Logging." } ], "sourceUrl": "https://upstash.com/trust/subprocessors.pdf", "verifiedOn": "2026-07-31", "note": "Their document states an address per party, used here as the jurisdiction. Several entries are scoped to products of theirs we do not use; those are excluded. Recorded here are the providers that could sit under the Redis service we consume." } }, { "op": "changed", "id": "vercel", "field": "subProcessors", "from": null, "to": { "entries": [ { "legalName": "Amazon Web Services, Inc.", "jurisdiction": "US", "purpose": "Hosting, storage and generative AI." }, { "legalName": "Google LLC", "jurisdiction": "US", "purpose": "Cloud computing, storage and generative AI." }, { "legalName": "Microsoft Corporation", "jurisdiction": "US", "purpose": "Hosting, storage and generative AI." }, { "legalName": "Upstash, Inc.", "jurisdiction": "US", "purpose": "Serverless storage. Also a sub-processor of ours in its own right." }, { "legalName": "Neon", "jurisdiction": "US", "purpose": "Serverless storage." }, { "legalName": "Redis Labs, Inc.", "jurisdiction": "US", "purpose": "Real-time logging and security." } ], "sourceUrl": "https://security.vercel.com/subprocessors", "verifiedOn": "2026-07-31", "note": "Their list names 28 parties with a location each, used here as the jurisdiction. Recorded here are the six providing hosting or storage; the remainder are their monitoring, support and AI-feature vendors." } } ], "stateHash": "sha256:4e25295f211cec8b45ca51c9b3b6259117e5f2a285d8960f6cbf7895ed1d3e86" }, { "revision": 3, "recordedOn": "2026-08-01", "summary": "Record where Sentry actually stores data. Its own data-storage-location documentation lists account and operational metadata as US-resident regardless of the selected region (cron check-ins, org settings and audit logs, project metadata, DSN keys, tokens, usage data) and uptime checks as stored in both regions. Error events, which carry the declared personal-data categories, remain in Frankfurt. No customer personal data sits in the US half, and the residual closes at the 0F Bugsink cutover. No change to what Sentry processes; this corrects an incomplete disclosure.", "changes": [ { "op": "changed", "id": "sentry", "field": "processingLocations", "from": [ { "kind": "region", "country": "DE", "label": "ingest.de.sentry.io (Germany)" } ], "to": [ { "kind": "region", "country": "DE", "label": "ingest.de.sentry.io (Germany)" }, { "kind": "region", "country": "US", "label": "US region (Iowa) for account and operational metadata stored outside the selected region regardless of setting (cron check-ins, org settings and audit logs, project metadata, DSN keys, tokens, usage data); uptime checks are stored in both regions. No customer personal data." } ] }, { "op": "changed", "id": "sentry", "field": "scope", "from": "EU ingest is enforced in code: the client fails closed rather than sending to a non-EU endpoint. Being replaced by an error tracker we host ourselves; that migration has not started.", "to": "EU ingest is enforced in code: the client fails closed rather than sending to a non-EU endpoint, so error events, spans and logs are stored in Frankfurt. Sentry nonetheless stores account and operational metadata in the US regardless of the selected region (cron check-ins, org settings and audit logs, project metadata, DSN keys, access tokens, usage data) and stores uptime checks in both regions. None of it carries customer personal data, so no Chapter V transfer arises from that half; it is nonetheless a US-storage residual of this vendor, and like the retention residual above it closes at the 0F Bugsink cutover, when error tracking, cron heartbeat and uptime checks all move to infrastructure we host." } ], "stateHash": "sha256:754c76c5ed958276f3dc6f90c1da61dac5134e05559c23fa1490ac7754c0f858" }, { "revision": 4, "recordedOn": "2026-08-01", "summary": "Restate the CDN's EU edge pinning as a provisioning step we owe rather than an assurance already in place.", "changes": [ { "op": "changed", "id": "bunny", "field": "scope", "from": "Announced, not yet processing. Will serve static assets from EU-only edge locations, pinned so cached bytes stay within the EU.", "to": "Announced, not yet processing. Before it is enabled, its pull zone has to be pinned to European edge locations; that pinning is a configuration we set at provisioning, not a property of the service, so it is a step we owe rather than an assurance we can give today." } ], "stateHash": "sha256:ae56c0851ea7205a9687fc8bbf414eb65c3195f3074d85bf383c83b243f4bbe9" }, { "revision": 5, "recordedOn": "2026-08-01", "summary": "Record each chain's finding explicitly: named, none, or their disclosure does not cover the relevant parties. Same parties, a state the page can no longer collapse into an assurance.", "changes": [ { "op": "changed", "id": "brevo", "field": "subProcessors", "from": { "entries": [ { "legalName": "Google Cloud Platform", "jurisdiction": "FR", "purpose": "Hosting. Servers stated as Belgium." }, { "legalName": "Scaleway (Iliad)", "jurisdiction": "FR", "purpose": "Hosting. Servers stated as France." }, { "legalName": "OVH", "jurisdiction": "FR", "purpose": "Hosting. Servers stated as France." }, { "legalName": "Hetzner Online GmbH", "jurisdiction": "DE", "purpose": "Hosting. Servers stated as Germany. Also a sub-processor of ours in its own right." }, { "legalName": "Cloudflare", "jurisdiction": "US", "purpose": "CDN and WAF. Servers stated as United States and EU." } ], "sourceUrl": "https://corp-backend.brevo.com/wp-content/uploads/2024/08/BREVO-Annex-2-DPA-150524.pdf", "verifiedOn": "2026-07-31", "note": "Their DPA annex separates infrastructure sub-processors from the rest and states a registered office for each, used here as the jurisdiction. Recorded here is that infrastructure section." }, "to": { "finding": "named", "entries": [ { "legalName": "Google Cloud Platform", "jurisdiction": "FR", "purpose": "Hosting. Servers stated as Belgium." }, { "legalName": "Scaleway (Iliad)", "jurisdiction": "FR", "purpose": "Hosting. Servers stated as France." }, { "legalName": "OVH", "jurisdiction": "FR", "purpose": "Hosting. Servers stated as France." }, { "legalName": "Hetzner Online GmbH", "jurisdiction": "DE", "purpose": "Hosting. Servers stated as Germany. Also a sub-processor of ours in its own right." }, { "legalName": "Cloudflare", "jurisdiction": "US", "purpose": "CDN and WAF. Servers stated as United States and EU." } ], "sourceUrl": "https://corp-backend.brevo.com/wp-content/uploads/2024/08/BREVO-Annex-2-DPA-150524.pdf", "verifiedOn": "2026-07-31", "note": "Their DPA annex separates infrastructure sub-processors from the rest and states a registered office for each, used here as the jurisdiction. Recorded here is that infrastructure section." } }, { "op": "changed", "id": "bunny", "field": "subProcessors", "from": { "entries": [], "sourceUrl": "https://bunny.net/gdpr/sub-processors/", "verifiedOn": "2026-07-31", "note": "Their disclosure names six parties, none of which is an infrastructure, colocation or network provider: it covers their support desk, email, bug tracking and one AI feature vendor. So the parties behind their edge network are not disclosed by them. The empty list here records that absence rather than an assurance that none exists." }, "to": { "finding": "not-covered", "sourceUrl": "https://bunny.net/gdpr/sub-processors/", "verifiedOn": "2026-07-31", "note": "Their disclosure names six parties, none of which is an infrastructure, colocation or network provider: it covers their support desk, email, bug tracking and one AI feature vendor. So the parties behind their edge network are not disclosed by them. The empty list here records that absence rather than an assurance that none exists." } }, { "op": "changed", "id": "cloudflare", "field": "subProcessors", "from": { "entries": [ { "legalName": "Amazon Web Services (AWS)", "jurisdiction": null, "purpose": "Email Security product. Processing stated as United States and EEA." }, { "legalName": "Google LLC", "jurisdiction": null, "purpose": "Developer Platform, Zero Trust and AI Gateway. Processing stated as EEA, United States, Australia and India." }, { "legalName": "Oracle America, Inc.", "jurisdiction": null, "purpose": "Developer Platform and Cache Reserve. Processing stated across United States, EEA, UK, Japan, Australia, Canada and Singapore." }, { "legalName": "CoreWeave, Inc.", "jurisdiction": null, "purpose": "Workers AI. Processing stated as United States." }, { "legalName": "Nebius BV", "jurisdiction": null, "purpose": "Workers AI. Processing stated as England." } ], "sourceUrl": "https://www.cloudflare.com/gdpr/subprocessors/cloudflare-services", "verifiedOn": "2026-07-31", "note": "Their list is dated 1 October 2025 and states processing regions rather than countries of incorporation, so regions are given in each purpose. It also names 16 of their own group affiliates, which are not recorded here as external parties. Every entry below is scoped by them to a specific product; none is stated to apply to DNS." }, "to": { "finding": "named", "entries": [ { "legalName": "Amazon Web Services (AWS)", "jurisdiction": null, "purpose": "Email Security product. Processing stated as United States and EEA." }, { "legalName": "Google LLC", "jurisdiction": null, "purpose": "Developer Platform, Zero Trust and AI Gateway. Processing stated as EEA, United States, Australia and India." }, { "legalName": "Oracle America, Inc.", "jurisdiction": null, "purpose": "Developer Platform and Cache Reserve. Processing stated across United States, EEA, UK, Japan, Australia, Canada and Singapore." }, { "legalName": "CoreWeave, Inc.", "jurisdiction": null, "purpose": "Workers AI. Processing stated as United States." }, { "legalName": "Nebius BV", "jurisdiction": null, "purpose": "Workers AI. Processing stated as England." } ], "sourceUrl": "https://www.cloudflare.com/gdpr/subprocessors/cloudflare-services", "verifiedOn": "2026-07-31", "note": "Their list is dated 1 October 2025 and states processing regions rather than countries of incorporation, so regions are given in each purpose. It also names 16 of their own group affiliates, which are not recorded here as external parties. Every entry below is scoped by them to a specific product; none is stated to apply to DNS." } }, { "op": "changed", "id": "hetzner", "field": "subProcessors", "from": { "entries": [ { "legalName": "Hetzner Finland Oy", "jurisdiction": "FI", "purpose": "Building rental and technical support." }, { "legalName": "Hetzner US LLC", "jurisdiction": "US", "purpose": "Server rental for their US site." }, { "legalName": "NTT Global Data Centers Americas, Inc.", "jurisdiction": "US", "purpose": "Colocation for their US site." }, { "legalName": "QTS Investment Properties Hillsboro, LLC", "jurisdiction": "US", "purpose": "Colocation for their US site." }, { "legalName": "Hetzner Singapore Pte. Ltd.", "jurisdiction": "SG", "purpose": "Server rental for their Singapore site." }, { "legalName": "NTT Global Data Centers SG1 Pte Ltd", "jurisdiction": "SG", "purpose": "Colocation for their Singapore site." } ], "sourceUrl": "https://www.hetzner.com/AV/subunternehmer.pdf", "verifiedOn": "2026-07-31", "note": "Their annex is version 1.0 dated 6 August 2024 and names six parties, all of them infrastructure, with a location for each. They state that data on EU-located servers is processed exclusively within the EU; the non-EU entities below serve their US and Singapore sites, which we do not use." }, "to": { "finding": "named", "entries": [ { "legalName": "Hetzner Finland Oy", "jurisdiction": "FI", "purpose": "Building rental and technical support." }, { "legalName": "Hetzner US LLC", "jurisdiction": "US", "purpose": "Server rental for their US site." }, { "legalName": "NTT Global Data Centers Americas, Inc.", "jurisdiction": "US", "purpose": "Colocation for their US site." }, { "legalName": "QTS Investment Properties Hillsboro, LLC", "jurisdiction": "US", "purpose": "Colocation for their US site." }, { "legalName": "Hetzner Singapore Pte. Ltd.", "jurisdiction": "SG", "purpose": "Server rental for their Singapore site." }, { "legalName": "NTT Global Data Centers SG1 Pte Ltd", "jurisdiction": "SG", "purpose": "Colocation for their Singapore site." } ], "sourceUrl": "https://www.hetzner.com/AV/subunternehmer.pdf", "verifiedOn": "2026-07-31", "note": "Their annex is version 1.0 dated 6 August 2024 and names six parties, all of them infrastructure, with a location for each. They state that data on EU-located servers is processed exclusively within the EU; the non-EU entities below serve their US and Singapore sites, which we do not use." } }, { "op": "changed", "id": "mistral", "field": "subProcessors", "from": { "entries": [ { "legalName": "Mistral Compute", "jurisdiction": "FR", "purpose": "Cloud infrastructure for all products. Their own compute arm rather than an external party." }, { "legalName": "Microsoft Inc.", "jurisdiction": null, "purpose": "Cloud infrastructure. Processing stated as Sweden and Norway." }, { "legalName": "Google LLC", "jurisdiction": null, "purpose": "Cloud infrastructure. Processing stated as Netherlands, Belgium and the United States." }, { "legalName": "CoreWeave Inc.", "jurisdiction": null, "purpose": "Inference provider. Processing stated as the EEA." }, { "legalName": "Cloudflare Inc.", "jurisdiction": null, "purpose": "Security and traffic routing. Processing stated as worldwide." } ], "sourceUrl": "https://trust.mistral.ai/subprocessors", "verifiedOn": "2026-07-31", "note": "Their disclosure lists 24 parties, several scoped to products we do not use. Recorded here are the infrastructure and inference providers whose stated scope covers the API. Their page states processing regions rather than countries of incorporation, so those regions are given in each purpose and jurisdiction is left unstated." }, "to": { "finding": "named", "entries": [ { "legalName": "Mistral Compute", "jurisdiction": "FR", "purpose": "Cloud infrastructure for all products. Their own compute arm rather than an external party." }, { "legalName": "Microsoft Inc.", "jurisdiction": null, "purpose": "Cloud infrastructure. Processing stated as Sweden and Norway." }, { "legalName": "Google LLC", "jurisdiction": null, "purpose": "Cloud infrastructure. Processing stated as Netherlands, Belgium and the United States." }, { "legalName": "CoreWeave Inc.", "jurisdiction": null, "purpose": "Inference provider. Processing stated as the EEA." }, { "legalName": "Cloudflare Inc.", "jurisdiction": null, "purpose": "Security and traffic routing. Processing stated as worldwide." } ], "sourceUrl": "https://trust.mistral.ai/subprocessors", "verifiedOn": "2026-07-31", "note": "Their disclosure lists 24 parties, several scoped to products we do not use. Recorded here are the infrastructure and inference providers whose stated scope covers the API. Their page states processing regions rather than countries of incorporation, so those regions are given in each purpose and jurisdiction is left unstated." } }, { "op": "changed", "id": "netcup", "field": "subProcessors", "from": { "entries": [ { "legalName": "Hetzner Online GmbH", "jurisdiction": "DE", "purpose": "Colocation data centre, Nuremberg. Also a sub-processor of ours in its own right." }, { "legalName": "DATASIX Rechenzentrumsbetriebs GmbH", "jurisdiction": "AT", "purpose": "Data centre operator, Vienna." } ], "sourceUrl": "https://www.netcup.com/en/legal/privacy-policy", "verifiedOn": "2026-07-31", "note": "They publish no standalone sub-processor page; the parties below are named in their Art 28 processing agreement, which reaches a customer only on execution. That is a weaker disclosure mechanism than the click-through lists every other vendor here offers, and it is recorded as such." }, "to": { "finding": "named", "entries": [ { "legalName": "Hetzner Online GmbH", "jurisdiction": "DE", "purpose": "Colocation data centre, Nuremberg. Also a sub-processor of ours in its own right." }, { "legalName": "DATASIX Rechenzentrumsbetriebs GmbH", "jurisdiction": "AT", "purpose": "Data centre operator, Vienna." } ], "sourceUrl": "https://www.netcup.com/en/legal/privacy-policy", "verifiedOn": "2026-07-31", "note": "They publish no standalone sub-processor page; the parties below are named in their Art 28 processing agreement, which reaches a customer only on execution. That is a weaker disclosure mechanism than the click-through lists every other vendor here offers, and it is recorded as such." } }, { "op": "changed", "id": "sentry", "field": "subProcessors", "from": { "entries": [ { "legalName": "Amazon Web Services, Inc.", "jurisdiction": null, "purpose": "Cloud infrastructure. Processing stated as EU and United States." }, { "legalName": "Cloudflare, Inc.", "jurisdiction": null, "purpose": "Cloud infrastructure. Processing stated as EU and United States." }, { "legalName": "Google LLC", "jurisdiction": null, "purpose": "Cloud infrastructure. Processing stated as EU and United States." } ], "sourceUrl": "https://sentry.io/legal/subprocessors", "verifiedOn": "2026-07-31", "note": "Their list is version 2.3.0 dated 1 June 2026 and states processing regions rather than countries of incorporation. Recorded here are the three cloud providers; the remainder are their email, support and group affiliates." }, "to": { "finding": "named", "entries": [ { "legalName": "Amazon Web Services, Inc.", "jurisdiction": null, "purpose": "Cloud infrastructure. Processing stated as EU and United States." }, { "legalName": "Cloudflare, Inc.", "jurisdiction": null, "purpose": "Cloud infrastructure. Processing stated as EU and United States." }, { "legalName": "Google LLC", "jurisdiction": null, "purpose": "Cloud infrastructure. Processing stated as EU and United States." } ], "sourceUrl": "https://sentry.io/legal/subprocessors", "verifiedOn": "2026-07-31", "note": "Their list is version 2.3.0 dated 1 June 2026 and states processing regions rather than countries of incorporation. Recorded here are the three cloud providers; the remainder are their email, support and group affiliates." } }, { "op": "changed", "id": "supabase", "field": "subProcessors", "from": { "entries": [ { "legalName": "Amazon Web Services, Inc", "jurisdiction": null, "purpose": "Hosting." }, { "legalName": "Cloudflare, Inc", "jurisdiction": null, "purpose": "Hosting." }, { "legalName": "Google, LLC", "jurisdiction": null, "purpose": "Hosting." }, { "legalName": "Fly.io, Inc", "jurisdiction": null, "purpose": "Hosting." }, { "legalName": "Upstash, Inc", "jurisdiction": null, "purpose": "Serverless data hosting. Also a sub-processor of ours in its own right." }, { "legalName": "Vercel, Inc", "jurisdiction": null, "purpose": "Hosting. Also a sub-processor of ours in its own right." } ], "sourceUrl": "https://supabase.com/legal/customer-resources/subprocessor-list", "verifiedOn": "2026-07-31", "note": "Their list is dated 1 June 2026 and names 19 parties without stating any country, so no jurisdiction is recorded for any of them. Recorded here are the six hosting providers; the remainder are their own support, sales and analytics tooling." }, "to": { "finding": "named", "entries": [ { "legalName": "Amazon Web Services, Inc", "jurisdiction": null, "purpose": "Hosting." }, { "legalName": "Cloudflare, Inc", "jurisdiction": null, "purpose": "Hosting." }, { "legalName": "Google, LLC", "jurisdiction": null, "purpose": "Hosting." }, { "legalName": "Fly.io, Inc", "jurisdiction": null, "purpose": "Hosting." }, { "legalName": "Upstash, Inc", "jurisdiction": null, "purpose": "Serverless data hosting. Also a sub-processor of ours in its own right." }, { "legalName": "Vercel, Inc", "jurisdiction": null, "purpose": "Hosting. Also a sub-processor of ours in its own right." } ], "sourceUrl": "https://supabase.com/legal/customer-resources/subprocessor-list", "verifiedOn": "2026-07-31", "note": "Their list is dated 1 June 2026 and names 19 parties without stating any country, so no jurisdiction is recorded for any of them. Recorded here are the six hosting providers; the remainder are their own support, sales and analytics tooling." } }, { "op": "changed", "id": "upstash", "field": "subProcessors", "from": { "entries": [ { "legalName": "Amazon Web Services", "jurisdiction": "US", "purpose": "Cloud provider." }, { "legalName": "Google", "jurisdiction": "US", "purpose": "Cloud provider." }, { "legalName": "Cloudflare, Inc.", "jurisdiction": "US", "purpose": "Cloud services." }, { "legalName": "Humio (CrowdStrike Falcon LogScale)", "jurisdiction": "DK", "purpose": "Logging." } ], "sourceUrl": "https://upstash.com/trust/subprocessors.pdf", "verifiedOn": "2026-07-31", "note": "Their document states an address per party, used here as the jurisdiction. Several entries are scoped to products of theirs we do not use; those are excluded. Recorded here are the providers that could sit under the Redis service we consume." }, "to": { "finding": "named", "entries": [ { "legalName": "Amazon Web Services", "jurisdiction": "US", "purpose": "Cloud provider." }, { "legalName": "Google", "jurisdiction": "US", "purpose": "Cloud provider." }, { "legalName": "Cloudflare, Inc.", "jurisdiction": "US", "purpose": "Cloud services." }, { "legalName": "Humio (CrowdStrike Falcon LogScale)", "jurisdiction": "DK", "purpose": "Logging." } ], "sourceUrl": "https://upstash.com/trust/subprocessors.pdf", "verifiedOn": "2026-07-31", "note": "Their document states an address per party, used here as the jurisdiction. Several entries are scoped to products of theirs we do not use; those are excluded. Recorded here are the providers that could sit under the Redis service we consume." } }, { "op": "changed", "id": "vercel", "field": "subProcessors", "from": { "entries": [ { "legalName": "Amazon Web Services, Inc.", "jurisdiction": "US", "purpose": "Hosting, storage and generative AI." }, { "legalName": "Google LLC", "jurisdiction": "US", "purpose": "Cloud computing, storage and generative AI." }, { "legalName": "Microsoft Corporation", "jurisdiction": "US", "purpose": "Hosting, storage and generative AI." }, { "legalName": "Upstash, Inc.", "jurisdiction": "US", "purpose": "Serverless storage. Also a sub-processor of ours in its own right." }, { "legalName": "Neon", "jurisdiction": "US", "purpose": "Serverless storage." }, { "legalName": "Redis Labs, Inc.", "jurisdiction": "US", "purpose": "Real-time logging and security." } ], "sourceUrl": "https://security.vercel.com/subprocessors", "verifiedOn": "2026-07-31", "note": "Their list names 28 parties with a location each, used here as the jurisdiction. Recorded here are the six providing hosting or storage; the remainder are their monitoring, support and AI-feature vendors." }, "to": { "finding": "named", "entries": [ { "legalName": "Amazon Web Services, Inc.", "jurisdiction": "US", "purpose": "Hosting, storage and generative AI." }, { "legalName": "Google LLC", "jurisdiction": "US", "purpose": "Cloud computing, storage and generative AI." }, { "legalName": "Microsoft Corporation", "jurisdiction": "US", "purpose": "Hosting, storage and generative AI." }, { "legalName": "Upstash, Inc.", "jurisdiction": "US", "purpose": "Serverless storage. Also a sub-processor of ours in its own right." }, { "legalName": "Neon", "jurisdiction": "US", "purpose": "Serverless storage." }, { "legalName": "Redis Labs, Inc.", "jurisdiction": "US", "purpose": "Real-time logging and security." } ], "sourceUrl": "https://security.vercel.com/subprocessors", "verifiedOn": "2026-07-31", "note": "Their list names 28 parties with a location each, used here as the jurisdiction. Recorded here are the six providing hosting or storage; the remainder are their monitoring, support and AI-feature vendors." } } ], "stateHash": "sha256:cfa7556c1f8d940e2989aff1a593179ee6fecc3d912caf18abe5867ced5d9001" }, { "revision": 6, "recordedOn": "2026-08-02", "summary": "Record which of the storage provider's group entities serve regions we do not use, so the chain's third-country reach is counted from facts rather than inferred from a note", "changes": [ { "op": "changed", "id": "hetzner", "field": "subProcessors", "from": { "finding": "named", "entries": [ { "legalName": "Hetzner Finland Oy", "jurisdiction": "FI", "purpose": "Building rental and technical support." }, { "legalName": "Hetzner US LLC", "jurisdiction": "US", "purpose": "Server rental for their US site." }, { "legalName": "NTT Global Data Centers Americas, Inc.", "jurisdiction": "US", "purpose": "Colocation for their US site." }, { "legalName": "QTS Investment Properties Hillsboro, LLC", "jurisdiction": "US", "purpose": "Colocation for their US site." }, { "legalName": "Hetzner Singapore Pte. Ltd.", "jurisdiction": "SG", "purpose": "Server rental for their Singapore site." }, { "legalName": "NTT Global Data Centers SG1 Pte Ltd", "jurisdiction": "SG", "purpose": "Colocation for their Singapore site." } ], "sourceUrl": "https://www.hetzner.com/AV/subunternehmer.pdf", "verifiedOn": "2026-07-31", "note": "Their annex is version 1.0 dated 6 August 2024 and names six parties, all of them infrastructure, with a location for each. They state that data on EU-located servers is processed exclusively within the EU; the non-EU entities below serve their US and Singapore sites, which we do not use." }, "to": { "finding": "named", "entries": [ { "legalName": "Hetzner Finland Oy", "jurisdiction": "FI", "purpose": "Building rental and technical support.", "engagement": "in-path" }, { "legalName": "Hetzner US LLC", "jurisdiction": "US", "purpose": "Server rental for their US site.", "engagement": "out-of-path" }, { "legalName": "NTT Global Data Centers Americas, Inc.", "jurisdiction": "US", "purpose": "Colocation for their US site.", "engagement": "out-of-path" }, { "legalName": "QTS Investment Properties Hillsboro, LLC", "jurisdiction": "US", "purpose": "Colocation for their US site.", "engagement": "out-of-path" }, { "legalName": "Hetzner Singapore Pte. Ltd.", "jurisdiction": "SG", "purpose": "Server rental for their Singapore site.", "engagement": "out-of-path" }, { "legalName": "NTT Global Data Centers SG1 Pte Ltd", "jurisdiction": "SG", "purpose": "Colocation for their Singapore site.", "engagement": "out-of-path" } ], "sourceUrl": "https://www.hetzner.com/AV/subunternehmer.pdf", "verifiedOn": "2026-07-31", "note": "Their annex is version 1.0 dated 6 August 2024 and names six parties, all of them infrastructure, with a location for each. They state that data on EU-located servers is processed exclusively within the EU; the non-EU entities below serve their US and Singapore sites, which we do not use." } } ], "stateHash": "sha256:d2fc96480561febf3eeccd4ef66706d2ccee86a4619c662f37437fef6ccc8c49" }, { "revision": 7, "recordedOn": "2026-08-02", "summary": "Remove a sentence stating the database provider's own infrastructure was not itemised here, which the same row's chain refutes", "changes": [ { "op": "changed", "id": "supabase", "field": "transferBasis", "from": { "kind": "unresolved", "reason": "Data rests in an EU region but the provider is US-incorporated, so remote access is a Chapter V transfer. The applicable basis is being confirmed against the signed DPA. This provider runs on infrastructure it engages in turn, which is not yet itemised in this register." }, "to": { "kind": "unresolved", "reason": "Data rests in an EU region but the provider is US-incorporated, so remote access is a Chapter V transfer. The applicable basis is being confirmed against the signed DPA." } } ], "stateHash": "sha256:fb8b74f7c79ad58a002e9585dbfbc9976faaae0eb226d8857277a581e8c7d795" }, { "revision": 8, "recordedOn": "2026-09-08", "summary": "Upstash: the code no longer depends on the vendor's client or REST API; every Redis consumer reaches the store over the Redis protocol through one ioredis connection addressed by REDIS_URL, so the move to a self-hosted Valkey on EU hardware is a change of that variable", "changes": [ { "op": "changed", "id": "upstash", "field": "scope", "from": "Being replaced by a cache we host ourselves on EU hardware. That migration has not started; until it lands, this provider serves the rate-limit and cache layer.", "to": "This provider still serves the rate-limit and cache layer; a Valkey we host ourselves on EU hardware will replace it. The code no longer depends on the vendor's client or REST API: every Redis consumer reaches the store through one ioredis connection addressed by REDIS_URL, so the move is a change of that variable, and until the EU host exists REDIS_URL points at this provider's TLS endpoint." }, { "op": "changed", "id": "upstash", "field": "transferBasis", "from": { "kind": "unresolved", "reason": "US-incorporated processor holding IP addresses and session identifiers. Region is not pinned in code and the basis is not evidenced. This is a hard boot dependency: UPSTASH_REDIS_REST_URL is required, not optional." }, "to": { "kind": "unresolved", "reason": "US-incorporated processor holding IP addresses and session identifiers. Region is not pinned in code and the basis is not evidenced. The database is reached over the Redis protocol through REDIS_URL, which is required wherever the deployment handles customer data." } } ], "stateHash": "sha256:32d2dc9c5b5743d2c3b34d54df95b9ae7af6dfd3dbb10cbaf82504d4933d9f50" }, { "revision": 9, "recordedOn": "2026-09-11", "summary": "Embedding provider removed: Jina AI (Berlin, US parent since October 2025) no longer receives any traffic; embeddings moved to Mistral (mistral-embed, France), reranking to a model hosted on our own EU hardware. Mistral's purpose and scope widen accordingly.", "changes": [ { "op": "changed", "id": "jina-ai", "field": "removedOn", "from": null, "to": "2026-09-11" }, { "op": "changed", "id": "jina-ai", "field": "scope", "from": "Refused for customer data since 31 July 2026: the platform will not start in production with this provider configured for embeddings, so it cannot process customer content. It stays listed because the credential is still read in development, and it remains the development default until the EU replacement is in place: embedding and reranking models we host ourselves on EU hardware, or a managed API under EU jurisdiction.", "to": "Removed on 11 September 2026: the last credential read and the last code path reaching this provider were deleted. Embeddings moved to Mistral (mistral-embed, France), already disclosed above for generation, and reranking to a model we host ourselves on EU hardware. It never processed customer content: the platform refused to start in production with it configured from 31 July 2026, and no customer-data deployment existed before that." }, { "op": "changed", "id": "jina-ai", "field": "status", "from": "live", "to": "removed" }, { "op": "changed", "id": "mistral", "field": "purpose", "from": "LLM generation: chat answers, planning, agent loop, vision, and input moderation. The sole generation provider; there is no non-EU fallback.", "to": "LLM generation (chat answers, planning, agent loop, vision, input moderation) and text embeddings for retrieval (mistral-embed). The sole managed inference provider; there is no non-EU fallback." }, { "op": "changed", "id": "mistral", "field": "scope", "from": "Prompts carry user queries plus retrieved document excerpts. Zero-retention and training opt-out are account-level settings with this provider, not per-request, so they are recorded here rather than asserted per call.", "to": "Prompts carry user queries plus retrieved document excerpts; embedding requests carry document chunks at ingest and the user's query at search time. Zero-retention and training opt-out are account-level settings with this provider, not per-request, so they are recorded here rather than asserted per call." } ], "stateHash": "sha256:be55fc2700fc57344598a2c88930c5a48d63ae61d9c835fd9776cd3d88f2cc83" }, { "revision": 10, "recordedOn": "2026-09-12", "summary": "Reranking is disclosed as running only against a rerank service we host, none provisioned yet; embeddings to Mistral are engaged only while EMBEDDING_PROVIDER selects it; the CDN row records its anycast edge as a global location with an unresolved basis until the pull zone is pinned", "changes": [ { "op": "changed", "id": "bunny", "field": "processingLocations", "from": [ { "kind": "region", "country": "SI", "label": "EU edge (pinned)" } ], "to": [ { "kind": "global", "label": "anycast edge network; a pull zone is served from every edge until pinned to European locations at provisioning" } ] }, { "op": "changed", "id": "bunny", "field": "transferBasis", "from": { "kind": "eu-only" }, "to": { "kind": "unresolved", "reason": "The company is Slovenian, but its edge network is anycast: until the pull zone is pinned to European locations at provisioning, a request can be served from a non-EEA edge, and the basis for that leg is not established. Becomes eu-only when the pin is set and the processing location is recorded as an EEA region." } }, { "op": "changed", "id": "jina-ai", "field": "scope", "from": "Removed on 11 September 2026: the last credential read and the last code path reaching this provider were deleted. Embeddings moved to Mistral (mistral-embed, France), already disclosed above for generation, and reranking to a model we host ourselves on EU hardware. It never processed customer content: the platform refused to start in production with it configured from 31 July 2026, and no customer-data deployment existed before that.", "to": "Removed on 11 September 2026: the last credential read and the last code path reaching this provider were deleted. Embeddings moved to Mistral (mistral-embed, France), already disclosed above for generation. Reranking now runs only against a rerank service we host ourselves; none is provisioned yet, so retrieval runs without a reranker until the EU inference host lands. It never processed customer content: the platform refused to start in production with it configured from 31 July 2026, and no customer-data deployment existed before that." }, { "op": "changed", "id": "mistral", "field": "scope", "from": "Prompts carry user queries plus retrieved document excerpts; embedding requests carry document chunks at ingest and the user's query at search time. Zero-retention and training opt-out are account-level settings with this provider, not per-request, so they are recorded here rather than asserted per call.", "to": "Prompts carry user queries plus retrieved document excerpts; embedding requests carry document chunks at ingest and the user's query at search time, and are sent only while EMBEDDING_PROVIDER selects mistral (the default); with selfhost selected only generation reaches this provider. Zero-retention and training opt-out are account-level settings with this provider, not per-request, so they are recorded here rather than asserted per call." } ], "stateHash": "sha256:793898a2615f9c8531d753319caf3625a630453c84fcce913192d019dd081952" }, { "revision": 11, "recordedOn": "2026-09-12", "summary": "Mistral data-processing agreement in force: the production workspace moved to a paid company account on 12 September 2026, which accepts the Commercial Terms (section 12.3 applies the Data Processing Addendum) and binds the no-training commitment (section 4.2); zero data retention remains an account activation awaiting Mistral's confirmation.", "changes": [ { "op": "changed", "id": "mistral", "field": "dpaSigned", "from": false, "to": true }, { "op": "changed", "id": "mistral", "field": "dpaUrl", "from": null, "to": "https://legal.mistral.ai/terms/data-processing-addendum" }, { "op": "changed", "id": "mistral", "field": "noTrainingFlowDown", "from": { "committed": false, "mechanism": "Contractual and unconditional on a paid plan: Commercial Terms of Service section 4.2 (Training) states Mistral AI will not use Customer Data or Outputs to train its models, excepting free subscriptions and the Vibe products where the customer has not opted out. Section 4.3 carves out Labs Models, which we do not use (generation and vision run on mistral-small). NOT in force yet only because the production paid subscription is not provisioned; it flips to true with the production key.", "sourceUrl": "https://legal.mistral.ai/terms/commercial-terms-of-service", "verifiedOn": "2026-07-27" }, "to": { "committed": true, "mechanism": "Contractual on the paid plan: Commercial Terms of Service section 4.2 (Training, effective 5 August 2026) states Mistral AI will not use Customer Data or Outputs to train its models except where the customer opted in (or did not opt out on a product that trains by default), for Feedback, under an Order Form, or on Labs or Preview models. We run on the company pay-as-you-go workspace provisioned 12 September 2026 with no training opt-in selected, submit no Feedback, hold no Order Form, and pin only generally available models (`bun run models:verify`). The DPA the terms cite (section 12.3) forms part of the same agreement.", "sourceUrl": "https://legal.mistral.ai/terms/commercial-terms-of-service", "verifiedOn": "2026-09-12" } } ], "stateHash": "sha256:62a90bd805ec01c0bcd3559fad14f44f5fc31694fd0939b6efcbd847ac6c28c2" }, { "revision": 12, "recordedOn": "2026-09-13", "summary": "Cloudflare leaves the target stack: the 2026-09-08 cutover decision moves name resolution to an EU provider, so the row is marked for removal at cutover rather than re-pinned to DNS-only; the apex stays proxied until then", "changes": [ { "op": "changed", "id": "cloudflare", "field": "scope", "from": "Our decided posture is DNS-only, which would leave this provider handling name resolution but not request content. The apex domain is still proxied today, so it currently terminates TLS and sees request bodies. This row states what is true now, not the intended end state.", "to": "The apex domain is proxied today, so this provider terminates TLS and sees request bodies; the www hostname is DNS-only. It is not part of the target stack: the cutover decision of 2026-09-08 moves name resolution to an EU provider, this row goes to removing on cutover day and to removed thirty days later when the zone is deleted. This row states what is true now, not the intended end state.", "noticeWaived": "Correction of the record: the processing is unchanged (the apex was proxied before and after this revision, the www hostname DNS-only), and the sentence replaced described a DNS-only end state the 2026-09-08 cutover decision had already superseded. The row now states the true end state, removal at cutover, which is a narrowing announced with its own notice when it is scheduled." }, { "op": "changed", "id": "cloudflare", "field": "transferBasis", "from": { "kind": "unresolved", "reason": "The apex A record is currently proxied, so TLS terminates at the provider and full request bodies pass through it; the www hostname is DNS-only. The decided posture is DNS-only for both, under which the provider handles DNS metadata rather than customer content. This row is reassessed once the apex is switched." }, "to": { "kind": "unresolved", "reason": "The apex A record is currently proxied, so TLS terminates at the provider and full request bodies pass through it; the www hostname is DNS-only. No basis is being sought: the provider leaves the register at the sovereignty cutover, when name resolution moves to an EU provider, so this row moves to removing on cutover day rather than being reassessed." }, "noticeWaived": "Correction of the record: the processing is unchanged (the apex was proxied before and after this revision, the www hostname DNS-only), and the sentence replaced described a DNS-only end state the 2026-09-08 cutover decision had already superseded. The row now states the true end state, removal at cutover, which is a narrowing announced with its own notice when it is scheduled." } ], "stateHash": "sha256:0f956a6670c21ef607b5a0ac722b2c686e2f650cef2d0ae22d7149e27c61fd49" }, { "revision": 13, "recordedOn": "2026-09-13", "summary": "Object storage moves from Hetzner to Scaleway: the at-rest decision record required bucket-default server-side encryption, which Hetzner does not offer, so Hetzner is removed before it ever held a byte and Scaleway SAS (Paris, fr-par) is added with a signed DPA, effective after the notice period", "changes": [ { "op": "added", "id": "scaleway", "row": { "id": "scaleway", "legalName": "Scaleway SAS", "jurisdiction": "FR", "registeredOffice": "Paris, France", "parent": { "legalName": "Iliad S.A.", "jurisdiction": "FR" }, "processingLocations": [ { "kind": "region", "country": "FR", "label": "fr-par (Paris)" } ], "layers": [ "storage" ], "purpose": "S3-compatible object storage for raw document bytes, and the off-box copy of the database backups.", "scope": "Engaged only when STORAGE_PROVIDER=s3; the default storage provider is Supabase. The organisation, the two buckets (documents, backups; both Private, the documents bucket with SSE-ONE and versioning) and two scoped IAM applications were created on 13 September 2026 in the Paris region; no customer byte reaches them before the effective date, which is the earliest the notice period allows and precedes the storage cutover (infrastructure-cutover-brief B4).", "role": "dpv:DataProcessor", "personalDataCategories": [ "pd:Name" ], "transferBasis": { "kind": "eu-only" }, "cloudActExposed": false, "status": "live", "addedOn": "2026-09-13", "effectiveFrom": "2026-10-13", "removedOn": null, "dpaUrl": "https://www-uploads.scaleway.com/DPA_2024_ENG_b0abb5cc26.pdf", "dpaSigned": true, "retention": { "summary": "Retention is the customer's choice for the duration of the contract (DPA 2024, section 2, Duration); at the end of the contract the vendor ceases processing and deletes the personal data and every copy, save what applicable law or its legitimate interests require, within the limits those set (section 13.1). Services are located in the EU by default and the region is the customer's selection at order (section 11.1); the vendor undertakes not to store personal data outside the EU without informing the customer in advance (section 11.2.2).", "sourceUrl": "https://www-uploads.scaleway.com/DPA_2024_ENG_b0abb5cc26.pdf", "verifiedOn": "2026-09-13" }, "noTrainingFlowDown": null, "subProcessors": { "finding": "named", "entries": [ { "legalName": "OpCore", "jurisdiction": "FR", "purpose": "Colocation services, France.", "engagement": "in-path" }, { "legalName": "Atempo", "jurisdiction": "FR", "purpose": "Data recording and archiving solutions for cold storage (Object Storage).", "engagement": "in-path" }, { "legalName": "Atnorth", "jurisdiction": "SE", "purpose": "Colocation services, Sweden.", "engagement": "out-of-path" }, { "legalName": "3S Data Center S.A.", "jurisdiction": "PL", "purpose": "Colocation services, Poland.", "engagement": "out-of-path" }, { "legalName": "Atman sp. z o.o.", "jurisdiction": "PL", "purpose": "Colocation services, Poland.", "engagement": "out-of-path" }, { "legalName": "Equinix EMEA", "jurisdiction": "US", "purpose": "Colocation services in Italy, the Netherlands and Poland.", "engagement": "out-of-path" }, { "legalName": "Iron Mountain", "jurisdiction": "US", "purpose": "Colocation services, Netherlands.", "engagement": "out-of-path" }, { "legalName": "Digital Realty", "jurisdiction": "US", "purpose": "Colocation services, Netherlands.", "engagement": "out-of-path" }, { "legalName": "BrainStorm Network Inc.", "jurisdiction": "CA", "purpose": "Service provider for a VPS product we do not use.", "engagement": "out-of-path" }, { "legalName": "Clever Cloud", "jurisdiction": "FR", "purpose": "Cloud provider for a web-platform product we do not use.", "engagement": "out-of-path" }, { "legalName": "Confia", "jurisdiction": "FR", "purpose": "Recycling of waste electrical and electronic equipment.", "engagement": "out-of-path" } ], "sourceUrl": "https://www.scaleway.com/en/subprocessorlist/", "verifiedOn": "2026-09-13", "note": "Their list (last reviewed July 2025) names seven data-centre operators, each with an EU processing location, and four service parties. We use Object Storage in the Paris region only, so the in-path parties are the French colocation operator and the cold-storage archiving supplier the list attaches to Object Storage; the three US-headquartered operators serve Italian, Dutch and Polish sites we do not select. Changes are notified 30 days ahead to customers subscribed on that page (DPA section 7.4), with a right to object." } } }, { "op": "changed", "id": "brevo", "field": "subProcessors", "from": { "finding": "named", "entries": [ { "legalName": "Google Cloud Platform", "jurisdiction": "FR", "purpose": "Hosting. Servers stated as Belgium." }, { "legalName": "Scaleway (Iliad)", "jurisdiction": "FR", "purpose": "Hosting. Servers stated as France." }, { "legalName": "OVH", "jurisdiction": "FR", "purpose": "Hosting. Servers stated as France." }, { "legalName": "Hetzner Online GmbH", "jurisdiction": "DE", "purpose": "Hosting. Servers stated as Germany. Also a sub-processor of ours in its own right." }, { "legalName": "Cloudflare", "jurisdiction": "US", "purpose": "CDN and WAF. Servers stated as United States and EU." } ], "sourceUrl": "https://corp-backend.brevo.com/wp-content/uploads/2024/08/BREVO-Annex-2-DPA-150524.pdf", "verifiedOn": "2026-07-31", "note": "Their DPA annex separates infrastructure sub-processors from the rest and states a registered office for each, used here as the jurisdiction. Recorded here is that infrastructure section." }, "to": { "finding": "named", "entries": [ { "legalName": "Google Cloud Platform", "jurisdiction": "FR", "purpose": "Hosting. Servers stated as Belgium." }, { "legalName": "Scaleway (Iliad)", "jurisdiction": "FR", "purpose": "Hosting. Servers stated as France." }, { "legalName": "OVH", "jurisdiction": "FR", "purpose": "Hosting. Servers stated as France." }, { "legalName": "Hetzner Online GmbH", "jurisdiction": "DE", "purpose": "Hosting. Servers stated as Germany. Formerly a sub-processor of ours in its own right (removed 2026-09-13)." }, { "legalName": "Cloudflare", "jurisdiction": "US", "purpose": "CDN and WAF. Servers stated as United States and EU." } ], "sourceUrl": "https://corp-backend.brevo.com/wp-content/uploads/2024/08/BREVO-Annex-2-DPA-150524.pdf", "verifiedOn": "2026-07-31", "note": "Their DPA annex separates infrastructure sub-processors from the rest and states a registered office for each, used here as the jurisdiction. Recorded here is that infrastructure section." }, "noticeWaived": "A narrowing and a re-labelling: the Hetzner scope records a removal of a processor that never held data, and the netcup and Brevo chain entries only note that the same colocation operator is no longer a processor of ours; neither adds processing" }, { "op": "changed", "id": "hetzner", "field": "removedOn", "from": null, "to": "2026-09-13" }, { "op": "changed", "id": "hetzner", "field": "scope", "from": "Engaged only when STORAGE_PROVIDER=s3; the default storage provider is Supabase.", "to": "Removed on 13 September 2026, before it ever held a byte: no account was opened and no credential issued. The at-rest decision record chose a vendor with bucket-default server-side encryption, which this vendor does not offer (rechecked 2026-09-13), so raw document bytes go to Scaleway (fr-par) instead, disclosed below. The residency allow list, the example configuration and the storage claim no longer name this vendor's host.", "noticeWaived": "A narrowing and a re-labelling: the Hetzner scope records a removal of a processor that never held data, and the netcup and Brevo chain entries only note that the same colocation operator is no longer a processor of ours; neither adds processing" }, { "op": "changed", "id": "hetzner", "field": "status", "from": "live", "to": "removed" }, { "op": "changed", "id": "netcup", "field": "subProcessors", "from": { "finding": "named", "entries": [ { "legalName": "Hetzner Online GmbH", "jurisdiction": "DE", "purpose": "Colocation data centre, Nuremberg. Also a sub-processor of ours in its own right." }, { "legalName": "DATASIX Rechenzentrumsbetriebs GmbH", "jurisdiction": "AT", "purpose": "Data centre operator, Vienna." } ], "sourceUrl": "https://www.netcup.com/en/legal/privacy-policy", "verifiedOn": "2026-07-31", "note": "They publish no standalone sub-processor page; the parties below are named in their Art 28 processing agreement, which reaches a customer only on execution. That is a weaker disclosure mechanism than the click-through lists every other vendor here offers, and it is recorded as such." }, "to": { "finding": "named", "entries": [ { "legalName": "Hetzner Online GmbH", "jurisdiction": "DE", "purpose": "Colocation data centre, Nuremberg. Formerly a sub-processor of ours in its own right (removed 2026-09-13)." }, { "legalName": "DATASIX Rechenzentrumsbetriebs GmbH", "jurisdiction": "AT", "purpose": "Data centre operator, Vienna." } ], "sourceUrl": "https://www.netcup.com/en/legal/privacy-policy", "verifiedOn": "2026-07-31", "note": "They publish no standalone sub-processor page; the parties below are named in their Art 28 processing agreement, which reaches a customer only on execution. That is a weaker disclosure mechanism than the click-through lists every other vendor here offers, and it is recorded as such." }, "noticeWaived": "A narrowing and a re-labelling: the Hetzner scope records a removal of a processor that never held data, and the netcup and Brevo chain entries only note that the same colocation operator is no longer a processor of ours; neither adds processing" } ], "stateHash": "sha256:8962581fe1d4ce2b59127f971c8e4eab3d2edeb3c905657f49b8439544a9fb32" }, { "revision": 14, "recordedOn": "2026-09-14", "summary": "netcup: the Art. 28 agreement is concluded (2026-09-14, template 2026/07) with Annex 3 completed by us; the row records the group parent, the 14-day backup retention tail and the Annex 2 parties (Anexia Cloud Solutions AT and DE, Anexia Holding, DATASIX), replacing a colocation provider the executed agreement does not name", "changes": [ { "op": "changed", "id": "netcup", "field": "dpaSigned", "from": false, "to": true }, { "op": "changed", "id": "netcup", "field": "dpaUrl", "from": null, "to": "https://www.netcup.com/en/helpcenter/documentation/general/dpa" }, { "op": "changed", "id": "netcup", "field": "parent", "from": null, "to": { "legalName": "Anexia Cloud Solutions GmbH", "jurisdiction": "AT" }, "noticeWaived": "The vendor is planned and not yet processing, so no controller's data is affected; the chain and parent are corrected to what the executed agreement states, and the previous chain named a party it does not" }, { "op": "changed", "id": "netcup", "field": "retention", "from": null, "to": { "summary": "At the end of the service the vendor deletes or returns all personal data at our choice and deletes existing copies; data still held in the vendor's backups is deleted at most 14 days later (executed agreement, section 3(9)). Erasure promises for the hosting layer therefore carry a 14-day backup tail.", "sourceUrl": "https://www.netcup.com/en/helpcenter/documentation/general/dpa", "verifiedOn": "2026-09-14" }, "noticeWaived": "The vendor is planned and not yet processing, so no controller's data is affected; the chain and parent are corrected to what the executed agreement states, and the previous chain named a party it does not" }, { "op": "changed", "id": "netcup", "field": "scope", "from": "Announced, not yet processing. Will provide EU compute for the services we host ourselves. Software we run on it is our own and is not a separate sub-processor.", "to": "Server obtained and the Art. 28 agreement concluded on 2026-09-14 (contract generator in the customer panel, template version 2026/07, Annex 3 completed by us); not yet processing until the cutover deploys onto the box. Will provide EU compute for the services we host ourselves. Software we run on it is our own and is not a separate sub-processor.", "noticeWaived": "The vendor is planned and not yet processing, so no controller's data is affected; the chain and parent are corrected to what the executed agreement states, and the previous chain named a party it does not" }, { "op": "changed", "id": "netcup", "field": "subProcessors", "from": { "finding": "named", "entries": [ { "legalName": "Hetzner Online GmbH", "jurisdiction": "DE", "purpose": "Colocation data centre, Nuremberg. Formerly a sub-processor of ours in its own right (removed 2026-09-13)." }, { "legalName": "DATASIX Rechenzentrumsbetriebs GmbH", "jurisdiction": "AT", "purpose": "Data centre operator, Vienna." } ], "sourceUrl": "https://www.netcup.com/en/legal/privacy-policy", "verifiedOn": "2026-07-31", "note": "They publish no standalone sub-processor page; the parties below are named in their Art 28 processing agreement, which reaches a customer only on execution. That is a weaker disclosure mechanism than the click-through lists every other vendor here offers, and it is recorded as such." }, "to": { "finding": "named", "entries": [ { "legalName": "Anexia Cloud Solutions GmbH", "jurisdiction": "AT", "purpose": "Infrastructure services in the data centre environment and provision of personnel (Klagenfurt). Lead company of the group the vendor belongs to." }, { "legalName": "Anexia Cloud Solutions GmbH", "jurisdiction": "DE", "purpose": "Infrastructure services in the data centre environment and provision of personnel (Karlsruhe establishment)." }, { "legalName": "Anexia Holding GmbH", "jurisdiction": "AT", "purpose": "Support services such as regulatory enquiries and billing (Klagenfurt)." }, { "legalName": "DATASIX Rechenzentrumsbetriebs GmbH", "jurisdiction": "AT", "purpose": "Data centre operations within the group (Vienna). Named in the certification scope of the agreement's TOM annex, not in its list of other processors; recorded so the Vienna site the TOMs cover has an operator on the row." } ], "sourceUrl": "https://www.netcup.com/en/helpcenter/documentation/general/dpa", "verifiedOn": "2026-09-14", "note": "The vendor publishes no sub-processor page; the parties are named in Annex 2 of the Art. 28 agreement, which a customer receives only on concluding it through the customer panel (the linked help-centre page describes that path). Read from our executed copy on 2026-09-14. Further subcontractors are announced in writing with a 14-calendar-day objection window, and the agreement excludes pure infrastructure provision from its definition of a subcontractor, so the list is narrower than the click-through lists other vendors here publish. The earlier reading of this row named a colocation provider that the executed agreement does not, so that entry is gone." }, "noticeWaived": "The vendor is planned and not yet processing, so no controller's data is affected; the chain and parent are corrected to what the executed agreement states, and the previous chain named a party it does not" } ], "stateHash": "sha256:170e9ae8c38b425a8ab75b05d0f60cf043bcc87ddacd059b853c1a69c331142f" }, { "revision": 15, "recordedOn": "2026-09-14", "summary": "netcup: the server order names the Vienna data centre, so the processing location moves from Nuremberg to Vienna (both EU sites of the same vendor under the same agreement)", "changes": [ { "op": "changed", "id": "netcup", "field": "processingLocations", "from": [ { "kind": "region", "country": "DE", "label": "Nuremberg (EU)" } ], "to": [ { "kind": "region", "country": "AT", "label": "Vienna (EU)" } ], "noticeWaived": "The vendor is planned and not yet processing, so no controller's data moves; the row is corrected to the site the server order names, an EU site under the same agreement and TOMs" }, { "op": "changed", "id": "netcup", "field": "scope", "from": "Server obtained and the Art. 28 agreement concluded on 2026-09-14 (contract generator in the customer panel, template version 2026/07, Annex 3 completed by us); not yet processing until the cutover deploys onto the box. Will provide EU compute for the services we host ourselves. Software we run on it is our own and is not a separate sub-processor.", "to": "Server obtained (RS 2000 G12, Vienna data centre, chosen at order) and the Art. 28 agreement concluded on 2026-09-14 (contract generator in the customer panel, template version 2026/07, Annex 3 completed by us); not yet processing until the cutover deploys onto the box. Will provide EU compute for the services we host ourselves. Software we run on it is our own and is not a separate sub-processor.", "noticeWaived": "The vendor is planned and not yet processing, so no controller's data moves; the row is corrected to the site the server order names, an EU site under the same agreement and TOMs" }, { "op": "changed", "id": "netcup", "field": "subProcessors", "from": { "finding": "named", "entries": [ { "legalName": "Anexia Cloud Solutions GmbH", "jurisdiction": "AT", "purpose": "Infrastructure services in the data centre environment and provision of personnel (Klagenfurt). Lead company of the group the vendor belongs to." }, { "legalName": "Anexia Cloud Solutions GmbH", "jurisdiction": "DE", "purpose": "Infrastructure services in the data centre environment and provision of personnel (Karlsruhe establishment)." }, { "legalName": "Anexia Holding GmbH", "jurisdiction": "AT", "purpose": "Support services such as regulatory enquiries and billing (Klagenfurt)." }, { "legalName": "DATASIX Rechenzentrumsbetriebs GmbH", "jurisdiction": "AT", "purpose": "Data centre operations within the group (Vienna). Named in the certification scope of the agreement's TOM annex, not in its list of other processors; recorded so the Vienna site the TOMs cover has an operator on the row." } ], "sourceUrl": "https://www.netcup.com/en/helpcenter/documentation/general/dpa", "verifiedOn": "2026-09-14", "note": "The vendor publishes no sub-processor page; the parties are named in Annex 2 of the Art. 28 agreement, which a customer receives only on concluding it through the customer panel (the linked help-centre page describes that path). Read from our executed copy on 2026-09-14. Further subcontractors are announced in writing with a 14-calendar-day objection window, and the agreement excludes pure infrastructure provision from its definition of a subcontractor, so the list is narrower than the click-through lists other vendors here publish. The earlier reading of this row named a colocation provider that the executed agreement does not, so that entry is gone." }, "to": { "finding": "named", "entries": [ { "legalName": "Anexia Cloud Solutions GmbH", "jurisdiction": "AT", "purpose": "Infrastructure services in the data centre environment and provision of personnel (Klagenfurt). Lead company of the group the vendor belongs to." }, { "legalName": "Anexia Cloud Solutions GmbH", "jurisdiction": "DE", "purpose": "Infrastructure services in the data centre environment and provision of personnel (Karlsruhe establishment)." }, { "legalName": "Anexia Holding GmbH", "jurisdiction": "AT", "purpose": "Support services such as regulatory enquiries and billing (Klagenfurt)." }, { "legalName": "DATASIX Rechenzentrumsbetriebs GmbH", "jurisdiction": "AT", "purpose": "Data centre operations within the group (Vienna). Named in the certification scope of the agreement's TOM annex, not in its list of other processors; recorded because Vienna is the site our server order names, so it is the in-path operator." } ], "sourceUrl": "https://www.netcup.com/en/helpcenter/documentation/general/dpa", "verifiedOn": "2026-09-14", "note": "The vendor publishes no sub-processor page; the parties are named in Annex 2 of the Art. 28 agreement, which a customer receives only on concluding it through the customer panel (the linked help-centre page describes that path). Read from our executed copy on 2026-09-14. Further subcontractors are announced in writing with a 14-calendar-day objection window, and the agreement excludes pure infrastructure provision from its definition of a subcontractor, so the list is narrower than the click-through lists other vendors here publish. The earlier reading of this row named a colocation provider that the executed agreement does not, so that entry is gone." }, "noticeWaived": "The vendor is planned and not yet processing, so no controller's data moves; the row is corrected to the site the server order names, an EU site under the same agreement and TOMs" } ], "stateHash": "sha256:4af987387cad65b6234f5f2617060716f941fd2ea58b04f276380458f576da56" }, { "revision": 16, "recordedOn": "2026-09-27", "summary": "Register prose rewritten for a reader: environment variables, plan ids and internal names removed; the Paris object store is described as not yet in use; no change to what any provider processes", "changes": [ { "op": "changed", "id": "brevo", "field": "scope", "from": "Inert until BREVO_API_KEY is provisioned.", "to": "Not in use yet: no mail goes through this provider until its account key is set.", "noticeWaived": "A correction of the record's wording: no provider processes anything new, anywhere new, or for a new purpose" }, { "op": "changed", "id": "cloudflare", "field": "purpose", "from": "DNS. The apex is currently also reverse-proxied, so Cloudflare terminates TLS for it.", "to": "DNS, and TLS termination for the apex domain.", "noticeWaived": "A correction of the record's wording: no provider processes anything new, anywhere new, or for a new purpose" }, { "op": "changed", "id": "cloudflare", "field": "scope", "from": "The apex domain is proxied today, so this provider terminates TLS and sees request bodies; the www hostname is DNS-only. It is not part of the target stack: the cutover decision of 2026-09-08 moves name resolution to an EU provider, this row goes to removing on cutover day and to removed thirty days later when the zone is deleted. This row states what is true now, not the intended end state.", "to": "The apex domain is proxied today, so this provider terminates TLS and sees request bodies; the www hostname is DNS-only. Name resolution moves to an EU provider when we move to our own EU infrastructure; this row is then marked as being replaced, and it is removed thirty days later when the zone is deleted.", "noticeWaived": "A correction of the record's wording: no provider processes anything new, anywhere new, or for a new purpose" }, { "op": "changed", "id": "mistral", "field": "purpose", "from": "LLM generation (chat answers, planning, agent loop, vision, input moderation) and text embeddings for retrieval (mistral-embed). The sole managed inference provider; there is no non-EU fallback.", "to": "Language-model generation (chat answers, planning, tool use, reading images, input moderation) and text embeddings for search. The only managed inference provider; there is no fallback outside the EU.", "noticeWaived": "A correction of the record's wording: no provider processes anything new, anywhere new, or for a new purpose" }, { "op": "changed", "id": "mistral", "field": "scope", "from": "Prompts carry user queries plus retrieved document excerpts; embedding requests carry document chunks at ingest and the user's query at search time, and are sent only while EMBEDDING_PROVIDER selects mistral (the default); with selfhost selected only generation reaches this provider. Zero-retention and training opt-out are account-level settings with this provider, not per-request, so they are recorded here rather than asserted per call.", "to": "Prompts carry user questions plus retrieved document excerpts. Embedding requests carry document chunks when a document is indexed and the user's question at search time; when self-hosted embeddings are selected, only generation reaches this provider. Zero retention and the training opt-out are account-level settings with this provider, not per-request, so they are recorded here rather than asserted per call.", "noticeWaived": "A correction of the record's wording: no provider processes anything new, anywhere new, or for a new purpose" }, { "op": "changed", "id": "scaleway", "field": "purpose", "from": "S3-compatible object storage for raw document bytes, and the off-box copy of the database backups.", "to": "S3-compatible object storage for the original files of documents, and for database backups.", "noticeWaived": "A correction of the record's wording: no provider processes anything new, anywhere new, or for a new purpose" }, { "op": "changed", "id": "scaleway", "field": "scope", "from": "Engaged only when STORAGE_PROVIDER=s3; the default storage provider is Supabase. The organisation, the two buckets (documents, backups; both Private, the documents bucket with SSE-ONE and versioning) and two scoped IAM applications were created on 13 September 2026 in the Paris region; no customer byte reaches them before the effective date, which is the earliest the notice period allows and precedes the storage cutover (infrastructure-cutover-brief B4).", "to": "Not in use yet. Two private buckets in the Paris region were created on 13 September 2026, one for documents with server-side encryption and versioning and one for backups. No customer data reaches them before this provider's effective date, the earliest the notice period allows, and none until document storage is switched to this provider.", "noticeWaived": "A correction of the record's wording: no provider processes anything new, anywhere new, or for a new purpose" }, { "op": "changed", "id": "sentry", "field": "processingLocations", "from": [ { "kind": "region", "country": "DE", "label": "ingest.de.sentry.io (Germany)" }, { "kind": "region", "country": "US", "label": "US region (Iowa) for account and operational metadata stored outside the selected region regardless of setting (cron check-ins, org settings and audit logs, project metadata, DSN keys, tokens, usage data); uptime checks are stored in both regions. No customer personal data." } ], "to": [ { "kind": "region", "country": "DE", "label": "ingest.de.sentry.io (Germany)" }, { "kind": "region", "country": "US", "label": "US region (Iowa) for account and operational metadata, whatever region is selected (scheduled-job check-ins, organisation settings and audit logs, project metadata, keys, tokens, usage data); uptime checks are stored in both regions. No customer personal data." } ], "noticeWaived": "A correction of the record's wording: no provider processes anything new, anywhere new, or for a new purpose" }, { "op": "changed", "id": "sentry", "field": "scope", "from": "EU ingest is enforced in code: the client fails closed rather than sending to a non-EU endpoint, so error events, spans and logs are stored in Frankfurt. Sentry nonetheless stores account and operational metadata in the US regardless of the selected region (cron check-ins, org settings and audit logs, project metadata, DSN keys, access tokens, usage data) and stores uptime checks in both regions. None of it carries customer personal data, so no Chapter V transfer arises from that half; it is nonetheless a US-storage residual of this vendor, and like the retention residual above it closes at the 0F Bugsink cutover, when error tracking, cron heartbeat and uptime checks all move to infrastructure we host.", "to": "Error events, spans and logs are sent to the ingest endpoint in Germany and stored in Frankfurt; error reporting switches itself off when it is configured with an endpoint outside the EU. Sentry stores account and operational metadata in the US whatever region is selected (scheduled-job check-ins, organisation settings and audit logs, project metadata, keys, access tokens, usage data), and stores uptime checks in both regions. None of it carries customer personal data, so no Chapter V transfer arises from it. This US storage ends when error tracking, scheduled-job monitoring and uptime checks move to infrastructure we host.", "noticeWaived": "A correction of the record's wording: no provider processes anything new, anywhere new, or for a new purpose" }, { "op": "changed", "id": "upstash", "field": "scope", "from": "This provider still serves the rate-limit and cache layer; a Valkey we host ourselves on EU hardware will replace it. The code no longer depends on the vendor's client or REST API: every Redis consumer reaches the store through one ioredis connection addressed by REDIS_URL, so the move is a change of that variable, and until the EU host exists REDIS_URL points at this provider's TLS endpoint.", "to": "This provider serves the rate-limit and cache layer until a Valkey instance we host on EU hardware replaces it. Every part of the application reaches the store through one connection setting, so the move is a configuration change.", "noticeWaived": "A correction of the record's wording: no provider processes anything new, anywhere new, or for a new purpose" } ], "stateHash": "sha256:4acae265bd84bcecdb342e828d96443cb87b8a564d88d1d2e4a41ad531a33ec2" }, { "revision": 17, "recordedOn": "2026-09-28", "summary": "The web application moved off Vercel onto our own server at netcup in Vienna on 2026-09-28: Vercel is being removed until its projects are deleted, netcup is live, Cloudflare answers DNS only and no longer sees requests, and netcup's German Anexia entity is named apart from the Austrian one", "changes": [ { "op": "changed", "id": "cloudflare", "field": "purpose", "from": "DNS, and TLS termination for the apex domain.", "to": "DNS for our domain.", "noticeWaived": "No controller's data moves: the product has not launched and the deployment serving it is declared as holding no customer data. netcup was announced on 2026-08-14 under an agreement concluded on 2026-09-14, and the other two changes take providers out of the request path" }, { "op": "changed", "id": "cloudflare", "field": "scope", "from": "The apex domain is proxied today, so this provider terminates TLS and sees request bodies; the www hostname is DNS-only. Name resolution moves to an EU provider when we move to our own EU infrastructure; this row is then marked as being replaced, and it is removed thirty days later when the zone is deleted.", "to": "DNS only since 2026-09-28: the web hostnames are no longer proxied, so this provider no longer terminates TLS or sees requests. Name resolution moves to an EU provider when we move to our own EU infrastructure; this row is then marked as being replaced, and it is removed thirty days later when the zone is deleted.", "noticeWaived": "No controller's data moves: the product has not launched and the deployment serving it is declared as holding no customer data. netcup was announced on 2026-08-14 under an agreement concluded on 2026-09-14, and the other two changes take providers out of the request path" }, { "op": "changed", "id": "netcup", "field": "purpose", "from": "Application + worker hosting (target architecture): the Next.js app, the BullMQ worker, and the self-hosted sidecars (Valkey, SearXNG, MarkItDown, Bugsink, embedding/rerank) run on a single EU box. Replaces Vercel.", "to": "Hosting on our own EU server: the Next.js web application today, and at the cutover the BullMQ worker and the self-hosted sidecars (Valkey, SearXNG, MarkItDown, Bugsink, embedding/rerank). Replaced Vercel.", "noticeWaived": "No controller's data moves: the product has not launched and the deployment serving it is declared as holding no customer data. netcup was announced on 2026-08-14 under an agreement concluded on 2026-09-14, and the other two changes take providers out of the request path" }, { "op": "changed", "id": "netcup", "field": "scope", "from": "Server obtained (RS 2000 G12, Vienna data centre, chosen at order) and the Art. 28 agreement concluded on 2026-09-14 (contract generator in the customer panel, template version 2026/07, Annex 3 completed by us); not yet processing until the cutover deploys onto the box. Will provide EU compute for the services we host ourselves. Software we run on it is our own and is not a separate sub-processor.", "to": "Server in the Vienna data centre (the site chosen at order); the Art. 28 agreement was concluded on 2026-09-14 (contract generator in the customer panel, template version 2026/07, Annex 3 completed by us). Serves the web application since 2026-09-28, ahead of the full move; the worker and the other services we host ourselves follow at the cutover. Software we run on it is our own and is not a separate sub-processor.", "noticeWaived": "No controller's data moves: the product has not launched and the deployment serving it is declared as holding no customer data. netcup was announced on 2026-08-14 under an agreement concluded on 2026-09-14, and the other two changes take providers out of the request path" }, { "op": "changed", "id": "netcup", "field": "status", "from": "planned", "to": "live" }, { "op": "changed", "id": "netcup", "field": "subProcessors", "from": { "finding": "named", "entries": [ { "legalName": "Anexia Cloud Solutions GmbH", "jurisdiction": "AT", "purpose": "Infrastructure services in the data centre environment and provision of personnel (Klagenfurt). Lead company of the group the vendor belongs to." }, { "legalName": "Anexia Cloud Solutions GmbH", "jurisdiction": "DE", "purpose": "Infrastructure services in the data centre environment and provision of personnel (Karlsruhe establishment)." }, { "legalName": "Anexia Holding GmbH", "jurisdiction": "AT", "purpose": "Support services such as regulatory enquiries and billing (Klagenfurt)." }, { "legalName": "DATASIX Rechenzentrumsbetriebs GmbH", "jurisdiction": "AT", "purpose": "Data centre operations within the group (Vienna). Named in the certification scope of the agreement's TOM annex, not in its list of other processors; recorded because Vienna is the site our server order names, so it is the in-path operator." } ], "sourceUrl": "https://www.netcup.com/en/helpcenter/documentation/general/dpa", "verifiedOn": "2026-09-14", "note": "The vendor publishes no sub-processor page; the parties are named in Annex 2 of the Art. 28 agreement, which a customer receives only on concluding it through the customer panel (the linked help-centre page describes that path). Read from our executed copy on 2026-09-14. Further subcontractors are announced in writing with a 14-calendar-day objection window, and the agreement excludes pure infrastructure provision from its definition of a subcontractor, so the list is narrower than the click-through lists other vendors here publish. The earlier reading of this row named a colocation provider that the executed agreement does not, so that entry is gone." }, "to": { "finding": "named", "entries": [ { "legalName": "Anexia Cloud Solutions GmbH", "jurisdiction": "AT", "purpose": "Infrastructure services in the data centre environment and provision of personnel (Klagenfurt). Lead company of the group the vendor belongs to." }, { "legalName": "Anexia Cloud Solutions GmbH (Germany)", "jurisdiction": "DE", "purpose": "Infrastructure services in the data centre environment and provision of personnel (Karlsruhe establishment)." }, { "legalName": "Anexia Holding GmbH", "jurisdiction": "AT", "purpose": "Support services such as regulatory enquiries and billing (Klagenfurt)." }, { "legalName": "DATASIX Rechenzentrumsbetriebs GmbH", "jurisdiction": "AT", "purpose": "Data centre operations within the group (Vienna). Named in the certification scope of the agreement's annex on technical and organisational measures, not in its list of other processors; recorded because Vienna is the site our server order names, so it is the in-path operator." } ], "sourceUrl": "https://www.netcup.com/en/helpcenter/documentation/general/dpa", "verifiedOn": "2026-09-14", "note": "The vendor publishes no sub-processor page; the parties are named in Annex 2 of the Art. 28 agreement, which a customer receives only on concluding it through the customer panel (the linked help-centre page describes that path). Read from our executed copy on 2026-09-14. Further subcontractors are announced in writing with a 14-calendar-day objection window, and the agreement excludes pure infrastructure provision from its definition of a subcontractor, so the list is narrower than the click-through lists other vendors here publish. The earlier reading of this row named a colocation provider that the executed agreement does not, so that entry is gone." }, "noticeWaived": "No controller's data moves: the product has not launched and the deployment serving it is declared as holding no customer data. netcup was announced on 2026-08-14 under an agreement concluded on 2026-09-14, and the other two changes take providers out of the request path" }, { "op": "changed", "id": "vercel", "field": "purpose", "from": "Application hosting and scheduled jobs (current deployment target).", "to": "Application hosting and scheduled jobs (former deployment target).", "noticeWaived": "No controller's data moves: the product has not launched and the deployment serving it is declared as holding no customer data. netcup was announced on 2026-08-14 under an agreement concluded on 2026-09-14, and the other two changes take providers out of the request path" }, { "op": "changed", "id": "vercel", "field": "scope", "from": "Being replaced by application hosting we run ourselves on EU hardware. That migration has not started; until it lands, this provider serves the application.", "to": "No longer serves the application: since 2026-09-28 the domain points at our own server in the EU. The provider still holds the frozen old deployment, its request logs and the configuration stored with it until the projects are deleted; the row is marked removed once that deletion and the rotation of the credentials it held are recorded.", "noticeWaived": "No controller's data moves: the product has not launched and the deployment serving it is declared as holding no customer data. netcup was announced on 2026-08-14 under an agreement concluded on 2026-09-14, and the other two changes take providers out of the request path" }, { "op": "changed", "id": "vercel", "field": "status", "from": "live", "to": "removing" } ], "stateHash": "sha256:95916b0e9b2cb09f7ee35bbdff81adbf8ba89caceed1d1ef9651b46c219d2686" }, { "revision": 18, "recordedOn": "2026-09-30", "summary": "Cloudflare's transfer-basis note now states the DNS-only setup its scope has recorded since 2026-09-28", "changes": [ { "op": "changed", "id": "cloudflare", "field": "transferBasis", "from": { "kind": "unresolved", "reason": "The apex A record is currently proxied, so TLS terminates at the provider and full request bodies pass through it; the www hostname is DNS-only. No basis is being sought: the provider leaves the register at the sovereignty cutover, when name resolution moves to an EU provider, so this row moves to removing on cutover day rather than being reassessed." }, "to": { "kind": "unresolved", "reason": "DNS only since 2026-09-28: no web hostname is proxied, so the provider answers name lookups and neither terminates TLS nor sees requests. No basis is being sought: the provider leaves the register at the sovereignty cutover, when name resolution moves to an EU provider, so this row moves to removing on cutover day rather than being reassessed." } } ], "stateHash": "sha256:fdd2ec2a01b9eaceff0217a3aacb972e902edb55dafbb04b53509a985991038f" }, { "revision": 19, "recordedOn": "2026-10-02", "summary": "Upstash's location note records the DNS evidence for its database endpoint, which names no region for the data, and its scope records that a deployment handling customer data refuses it at startup", "changes": [ { "op": "changed", "id": "upstash", "field": "processingLocations", "from": [ { "kind": "unconfirmed", "note": "Region is not pinned in code and the vendor's deployment region for this database has not been evidenced. Holds IP addresses and session identifiers, so Art. 30(1)(d)-(e) cannot be answered for it." } ], "to": [ { "kind": "unconfirmed", "note": "The region holding this database has not been evidenced. Its hostname is an alias for a latency-routed name the vendor shares across regions: on 2026-10-02, queried with Danish, US and Brazilian client subnets, it answered with addresses AWS publishes for eu-central-1 (Frankfurt), us-east-2 (Ohio) and sa-east-1 (São Paulo). DNS therefore shows the vendor edge nearest the client, not where the data, its replicas or its backups are held. Holds IP addresses and session identifiers, so Art. 30(1)(d)-(e) cannot be answered for it." } ], "noticeWaived": "A correction of the record and a narrowing: no provider processes anything new, anywhere new, or for a new purpose, and a deployment handling customer data can no longer reach this one" }, { "op": "changed", "id": "upstash", "field": "scope", "from": "This provider serves the rate-limit and cache layer until a Valkey instance we host on EU hardware replaces it. Every part of the application reaches the store through one connection setting, so the move is a configuration change.", "to": "This provider serves the rate-limit and cache layer until a Valkey instance we host on EU hardware replaces it. Every part of the application reaches the store through one connection setting, so the move is a configuration change. A deployment that handles customer data cannot use this provider: it refuses at startup any Redis host other than one we operate or one internal to the deployment.", "noticeWaived": "A correction of the record and a narrowing: no provider processes anything new, anywhere new, or for a new purpose, and a deployment handling customer data can no longer reach this one" }, { "op": "changed", "id": "upstash", "field": "transferBasis", "from": { "kind": "unresolved", "reason": "US-incorporated processor holding IP addresses and session identifiers. Region is not pinned in code and the basis is not evidenced. The database is reached over the Redis protocol through REDIS_URL, which is required wherever the deployment handles customer data." }, "to": { "kind": "unresolved", "reason": "US-incorporated processor holding IP addresses and session identifiers, reached over the Redis protocol through REDIS_URL. No transfer basis is evidenced." } } ], "stateHash": "sha256:edf085f5b3189a0868cbdfb00486dab3df8a3fd3d8857d1fb59b18454aec9703" }, { "revision": 20, "recordedOn": "2026-10-17", "summary": "Scope Cloudflare's listed fourth parties to the DNS product we use, and state the Upstash region gap in one sentence; no provider added or engaged.", "changes": [ { "op": "changed", "id": "cloudflare", "field": "productsUsed", "to": [ "DNS" ], "noticeWaived": "A narrowing: the register now records that only the DNS product is used since 2026-09-28, so the fourth-party chain shown is limited to that product. No processing is added and none begins." }, { "op": "changed", "id": "cloudflare", "field": "subProcessors", "from": { "finding": "named", "entries": [ { "legalName": "Amazon Web Services (AWS)", "jurisdiction": null, "purpose": "Email Security product. Processing stated as United States and EEA." }, { "legalName": "Google LLC", "jurisdiction": null, "purpose": "Developer Platform, Zero Trust and AI Gateway. Processing stated as EEA, United States, Australia and India." }, { "legalName": "Oracle America, Inc.", "jurisdiction": null, "purpose": "Developer Platform and Cache Reserve. Processing stated across United States, EEA, UK, Japan, Australia, Canada and Singapore." }, { "legalName": "CoreWeave, Inc.", "jurisdiction": null, "purpose": "Workers AI. Processing stated as United States." }, { "legalName": "Nebius BV", "jurisdiction": null, "purpose": "Workers AI. Processing stated as England." } ], "sourceUrl": "https://www.cloudflare.com/gdpr/subprocessors/cloudflare-services", "verifiedOn": "2026-07-31", "note": "Their list is dated 1 October 2025 and states processing regions rather than countries of incorporation, so regions are given in each purpose. It also names 16 of their own group affiliates, which are not recorded here as external parties. Every entry below is scoped by them to a specific product; none is stated to apply to DNS." }, "to": { "finding": "named", "entries": [ { "legalName": "Amazon Web Services (AWS)", "jurisdiction": null, "purpose": "Email Security product. Processing stated as United States and EEA.", "products": [ "Email Security" ] }, { "legalName": "Google LLC", "jurisdiction": null, "purpose": "Developer Platform, Zero Trust and AI Gateway. Processing stated as EEA, United States, Australia and India.", "products": [ "Developer Platform", "Zero Trust", "AI Gateway" ] }, { "legalName": "Oracle America, Inc.", "jurisdiction": null, "purpose": "Developer Platform and Cache Reserve. Processing stated across United States, EEA, UK, Japan, Australia, Canada and Singapore.", "products": [ "Developer Platform", "Cache Reserve" ] }, { "legalName": "CoreWeave, Inc.", "jurisdiction": null, "purpose": "Workers AI. Processing stated as United States.", "products": [ "Workers AI" ] }, { "legalName": "Nebius BV", "jurisdiction": null, "purpose": "Workers AI. Processing stated as England.", "products": [ "Workers AI" ] } ], "sourceUrl": "https://www.cloudflare.com/gdpr/subprocessors/cloudflare-services", "verifiedOn": "2026-07-31", "note": "Their list is dated 1 October 2025 and states processing regions rather than countries of incorporation, so regions are given in each purpose. It also names 16 of their own group affiliates, which are not recorded here as external parties. Every entry listed is scoped by them to a specific product, and none is attributed to DNS; that does not show that no party is involved in DNS." }, "noticeWaived": "No processing change: the register now records which Cloudflare product each listed party serves. No party was added and none begins processing." }, { "op": "changed", "id": "upstash", "field": "processingLocations", "from": [ { "kind": "unconfirmed", "note": "The region holding this database has not been evidenced. Its hostname is an alias for a latency-routed name the vendor shares across regions: on 2026-10-02, queried with Danish, US and Brazilian client subnets, it answered with addresses AWS publishes for eu-central-1 (Frankfurt), us-east-2 (Ohio) and sa-east-1 (São Paulo). DNS therefore shows the vendor edge nearest the client, not where the data, its replicas or its backups are held. Holds IP addresses and session identifiers, so Art. 30(1)(d)-(e) cannot be answered for it." } ], "to": [ { "kind": "unconfirmed", "note": "The region holding this database has not been evidenced. Its hostname is an alias for a latency-routed name the vendor shares across regions: on 2026-10-02, queried with Danish, US and Brazilian client subnets, it answered with addresses AWS publishes for eu-central-1 (Frankfurt), us-east-2 (Ohio) and sa-east-1 (São Paulo). DNS therefore shows the vendor edge nearest the client, not where the data, its replicas or its backups are held. Holds IP addresses and session identifiers, so Art. 30(1)(d)-(e) cannot be answered for it.", "summary": "Region not confirmed. Not used for customer content: a deployment that handles customer data refuses this provider at startup." } ], "noticeWaived": "A rewording only: the unconfirmed region is described in one shorter sentence, and no location changed." } ], "stateHash": "sha256:8047fc4231b8d8a473e5b8c66347e58e1512b981f3ac4f013835984edd886139" }, { "revision": 21, "recordedOn": "2026-10-19", "summary": "Supabase scope states that the migration is under way", "changes": [ { "op": "changed", "id": "supabase", "field": "scope", "from": "Being replaced by our own Postgres and object storage on EU hardware. That migration has not started; until it lands, this provider holds the document corpus.", "to": "Being replaced by our own Postgres and object storage on EU hardware. The server and the storage buckets are provisioned and the migration is under way; until cutover, this provider holds the document corpus.", "noticeWaived": "A record correction only: the migration status was stale, and no location, scope of processing or basis changed." } ], "stateHash": "sha256:a2fb7959f0de4746c9105484f393be6d7cbee50198a292c6d1de1df772e94128" }, { "revision": 22, "recordedOn": "2026-10-19", "summary": "Supabase scope says the database has not moved and names where files go", "changes": [ { "op": "changed", "id": "supabase", "field": "scope", "from": "Being replaced by our own Postgres and object storage on EU hardware. The server and the storage buckets are provisioned and the migration is under way; until cutover, this provider holds the document corpus.", "to": "Being replaced by our own Postgres on EU hardware, with files at Scaleway in France. The server and the buckets are provisioned and the application is being moved off this provider's interfaces; the database itself has not moved, and until cutover this provider holds the document corpus.", "noticeWaived": "A record correction only: the migration status is stated more precisely, and no location, scope of processing or basis changed." } ], "stateHash": "sha256:42405ac7b7e6b312b353fd0489049834b354bc8933fafbc28353b5c13df378e1" }, { "revision": 23, "recordedOn": "2026-10-19", "summary": "Supabase scope states in the future tense where the files will go", "changes": [ { "op": "changed", "id": "supabase", "field": "scope", "from": "Being replaced by our own Postgres on EU hardware, with files at Scaleway in France. The server and the buckets are provisioned and the application is being moved off this provider's interfaces; the database itself has not moved, and until cutover this provider holds the document corpus.", "to": "Being replaced: the database will move to our own Postgres on EU hardware and the files to Scaleway in France. The server and the buckets are provisioned and the application is being moved off this provider's interfaces; the database itself has not moved, and until cutover this provider holds the document corpus.", "noticeWaived": "A record correction only: no file has moved and no location, scope of processing or basis changed; the sentence now says the move is future." } ], "stateHash": "sha256:f3d36178677e6d3a06d4388737c09968267f7202bda26d94858842444ad54330" } ] }