Sub-processors
Who processes your data
Every sub-processor we engage, what it is for and the jurisdiction it answers to.
Data as of: . Last reviewed:
Generated from our sub-processor register.
Our sub-processors
These companies process personal data on our behalf: Documents stored in the EU, AI processing in France. Several providers below are incorporated outside the European Economic Area, or have a parent that is, and each such row is marked: jurisdiction is where a company can be legally compelled, which is a separate question from where the data physically sits. Each row states the transfer basis that applies, and who that provider engages in turn.
| Legal entity | Purpose | Data processed | Jurisdiction | Transfer basis |
|---|---|---|---|---|
Legal entity Mistral AI SAS Registered office Paris, France | Purpose Language-model generation (chat answers, planning, tool use, reading images, input moderation) and text embeddings for search. The only managed inference provider; there is no fallback outside the EU. Prompts carry user questions plus retrieved document excerpts. Embedding requests carry document chunks when a document is indexed and the user's question at search time; when self-hosted embeddings are selected, only generation reaches this provider. Zero retention and the training opt-out are account-level settings with this provider, not per-request, so they are recorded here rather than asserted per call. Who they engage in turn
Their disclosure lists 24 parties, several scoped to products we do not use. Recorded here are the infrastructure and inference providers whose stated scope covers the API. Their page states processing regions rather than countries of incorporation, so those regions are given in each purpose and jurisdiction is left unstated. Per their own disclosure, checked July 31, 2026 | Data processed
| Jurisdiction France eu-west (France) | Transfer basis EU only, no third-country transfer Status Live |
Legal entity Supabase, Inc. Registered office Delaware, United States | Purpose Primary datastore: Postgres (documents, chunks, embeddings, tenants), authentication, and default object storage. Being replaced: the database will move to our own Postgres on EU hardware and the files to Scaleway in France. The server and the buckets are provisioned and the application is being moved off this provider's interfaces; the database itself has not moved, and until cutover this provider holds the document corpus. Who they engage in turn
Their list is dated 1 June 2026 and names 19 parties without stating any country, so no jurisdiction is recorded for any of them. Recorded here are the six hosting providers; the remainder are their own support, sales and analytics tooling. Per their own disclosure, checked July 31, 2026 | Data processed
| Jurisdiction United States aws eu-west-1 (Ireland) | Transfer basis Under review Subject to non-EEA jurisdiction Status Live |
Legal entity Upstash, Inc. Registered office California, United States | Purpose Redis: API rate limiting, session revocation, embedding cache, and impossible-travel detection. This provider serves the rate-limit and cache layer until a Valkey instance we host on EU hardware replaces it. Every part of the application reaches the store through one connection setting, so the move is a configuration change. A deployment that handles customer data cannot use this provider: it refuses at startup any Redis host other than one we operate or one internal to the deployment. Who they engage in turn
Their document states an address per party, used here as the jurisdiction. Several entries are scoped to products of theirs we do not use; those are excluded. Recorded here are the providers that could sit under the Redis service we consume. Per their own disclosure, checked July 31, 2026 | Data processed
| Jurisdiction United States Region not confirmed. Not used for customer content: a deployment that handles customer data refuses this provider at startup. | Transfer basis Under review Subject to non-EEA jurisdiction Status Live |
Legal entity Cloudflare, Inc. Registered office Delaware, United States | Purpose DNS for our domain. DNS only since 2026-09-28: the web hostnames are no longer proxied, so this provider no longer terminates TLS or sees requests. Name resolution moves to an EU provider when we move to our own EU infrastructure; this row is then marked as being replaced, and it is removed thirty days later when the zone is deleted. Who they engage in turn Their published list attributes no provider to the product we use (DNS). It does not state that none is involved. Their list is dated 1 October 2025 and states processing regions rather than countries of incorporation, so regions are given in each purpose. It also names 16 of their own group affiliates, which are not recorded here as external parties. Every entry listed is scoped by them to a specific product, and none is attributed to DNS; that does not show that no party is involved in DNS. Per their own disclosure, checked July 31, 2026 | Data processed
| Jurisdiction United States global edge (anycast) | Transfer basis Under review Subject to non-EEA jurisdiction Status Live |
Legal entity Functional Software, Inc. Registered office California, United States | Purpose Application error and performance monitoring. Error events, spans and logs are sent to the ingest endpoint in Germany and stored in Frankfurt; error reporting switches itself off when it is configured with an endpoint outside the EU. Sentry stores account and operational metadata in the US whatever region is selected (scheduled-job check-ins, organisation settings and audit logs, project metadata, keys, access tokens, usage data), and stores uptime checks in both regions. None of it carries customer personal data, so no Chapter V transfer arises from it. This US storage ends when error tracking, scheduled-job monitoring and uptime checks move to infrastructure we host. Who they engage in turn
Their list is version 2.3.0 dated 1 June 2026 and states processing regions rather than countries of incorporation. Recorded here are the three cloud providers; the remainder are their email, support and group affiliates. Per their own disclosure, checked July 31, 2026 | Data processed
| Jurisdiction United States ingest.de.sentry.io (Germany), US region (Iowa) for account and operational metadata, whatever region is selected (scheduled-job check-ins, organisation settings and audit logs, project metadata, keys, tokens, usage data); uptime checks are stored in both regions. No customer personal data. | Transfer basis Under review Subject to non-EEA jurisdiction Status Live |
Legal entity Sendinblue SAS (Brevo) Registered office Paris, France | Purpose Transactional email (notifications, account mail). Not in use yet: no mail goes through this provider until its account key is set. Who they engage in turn
Their DPA annex separates infrastructure sub-processors from the rest and states a registered office for each, used here as the jurisdiction. Recorded here is that infrastructure section. Per their own disclosure, checked July 31, 2026 | Data processed
| Jurisdiction France eu-west (France) | Transfer basis EU only, no third-country transfer Status Live |
Legal entity Scaleway SAS Parent: Iliad S.A. (France) Registered office Paris, France | Purpose S3-compatible object storage for the original files of documents, and for database backups. Not in use yet. Two private buckets in the Paris region were created on 13 September 2026, one for documents with server-side encryption and versioning and one for backups. No customer data reaches them before this provider's effective date, the earliest the notice period allows, and none until document storage is switched to this provider. Who they engage in turn
Their list (last reviewed July 2025) names seven data-centre operators, each with an EU processing location, and four service parties. We use Object Storage in the Paris region only, so the in-path parties are the French colocation operator and the cold-storage archiving supplier the list attaches to Object Storage; the three US-headquartered operators serve Italian, Dutch and Polish sites we do not select. Changes are notified 30 days ahead to customers subscribed on that page (DPA section 7.4), with a right to object. Per their own disclosure, checked September 13, 2026 | Data processed
| Jurisdiction France fr-par (Paris) | Transfer basis EU only, no third-country transfer Status Live |
Legal entity Vercel Inc. Registered office California, United States | Purpose Application hosting and scheduled jobs (former deployment target). No longer serves the application: since 2026-09-28 the domain points at our own server in the EU. The provider still holds the frozen old deployment, its request logs and the configuration stored with it until the projects are deleted; the row is marked removed once that deletion and the rotation of the credentials it held are recorded. Who they engage in turn
Their list names 28 parties with a location each, used here as the jurisdiction. Recorded here are the six providing hosting or storage; the remainder are their monitoring, support and AI-feature vendors. Per their own disclosure, checked July 31, 2026 | Data processed
| Jurisdiction United States global edge | Transfer basis Under review Subject to non-EEA jurisdiction Status Being replaced |
Legal entity netcup GmbH Parent: Anexia Cloud Solutions GmbH (Austria) Registered office Karlsruhe, Germany | Purpose Hosting on our own EU server: the Next.js web application today, and at the cutover the BullMQ worker and the self-hosted sidecars (Valkey, SearXNG, MarkItDown, Bugsink, embedding/rerank). Replaced Vercel. Server in the Vienna data centre (the site chosen at order); the Art. 28 agreement was concluded on 2026-09-14 (contract generator in the customer panel, template version 2026/07, Annex 3 completed by us). Serves the web application since 2026-09-28, ahead of the full move; the worker and the other services we host ourselves follow at the cutover. Software we run on it is our own and is not a separate sub-processor. Who they engage in turn
The vendor publishes no sub-processor page; the parties are named in Annex 2 of the Art. 28 agreement, which a customer receives only on concluding it through the customer panel (the linked help-centre page describes that path). Read from our executed copy on 2026-09-14. Further subcontractors are announced in writing with a 14-calendar-day objection window, and the agreement excludes pure infrastructure provision from its definition of a subcontractor, so the list is narrower than the click-through lists other vendors here publish. The earlier reading of this row named a colocation provider that the executed agreement does not, so that entry is gone. Per their own disclosure, checked September 14, 2026 | Data processed
| Jurisdiction Germany Vienna (EU) | Transfer basis EU only, no third-country transfer Status Live |
Subject to non-EEA jurisdiction
This company, or its parent, is incorporated outside the EEA, so it may be subject to foreign compulsory process even where the data itself rests in the EU.
Payments
Payments go through Mollie B.V. in the Netherlands, a licensed payment institution. Mollie handles payment data under its own legal duties as an independent controller, so it is listed here as a recipient instead of in the sub-processor table. From Nordvec it receives an amount, a plan description and reference numbers, and no document content.
Change log
Every change to this register, newest first. The notice column says whether you had a window to object.
| Date | Change | Provider | Notice | Effective |
|---|---|---|---|---|
Date | Change what a sub-processor does for us, or what data it receives, changed | Provider Supabase, Inc. | Notice Notice waived: A record correction only: no file has moved and no location, scope of processing or basis changed; the sentence now says the move is future. | Effective |
Date | Change what a sub-processor does for us, or what data it receives, changed | Provider Supabase, Inc. | Notice Notice waived: A record correction only: the migration status is stated more precisely, and no location, scope of processing or basis changed. | Effective |
Date | Change what a sub-processor does for us, or what data it receives, changed | Provider Supabase, Inc. | Notice Notice waived: A record correction only: the migration status was stale, and no location, scope of processing or basis changed. | Effective |
Date | Change the sub-processor's own disclosed sub-processors changed, or were recorded | Provider Cloudflare, Inc. | Notice Notice waived: A narrowing: the register now records that only the DNS product is used since 2026-09-28, so the fourth-party chain shown is limited to that product. No processing is added and none begins; No processing change: the register now records which Cloudflare product each listed party serves. No party was added and none begins processing. | Effective |
Date | Change where a sub-processor processes changed, or was corrected | Provider Upstash, Inc. | Notice Notice waived: A correction of the record and a narrowing: no provider processes anything new, anywhere new, or for a new purpose, and a deployment handling customer data can no longer reach this one | Effective |
Date | Change what a sub-processor does for us, or what data it receives, changed | Provider Cloudflare, Inc. | Notice Notice waived: No controller's data moves: the product has not launched and the deployment serving it is declared as holding no customer data. netcup was announced on 2026-08-14 under an agreement concluded on 2026-09-14, and the other two changes take providers out of the request path | Effective |
Date | Change a sub-processor starts processing | Provider netcup GmbH | Notice Notice waived: No controller's data moves: the product has not launched and the deployment serving it is declared as holding no customer data. netcup was announced on 2026-08-14 under an agreement concluded on 2026-09-14, and the other two changes take providers out of the request path | Effective |
Date | Change a sub-processor stops processing (its decommission record is cited) | Provider Vercel Inc. | Notice Notice waived: No controller's data moves: the product has not launched and the deployment serving it is declared as holding no customer data. netcup was announced on 2026-08-14 under an agreement concluded on 2026-09-14, and the other two changes take providers out of the request path | Effective |
Date | Change what a sub-processor does for us, or what data it receives, changed | Provider Sendinblue SAS (Brevo); Cloudflare, Inc.; Mistral AI SAS; Scaleway SAS; Upstash, Inc. | Notice Notice waived: A correction of the record's wording: no provider processes anything new, anywhere new, or for a new purpose | Effective |
Date | Change where a sub-processor processes changed, or was corrected | Provider Functional Software, Inc. | Notice Notice waived: A correction of the record's wording: no provider processes anything new, anywhere new, or for a new purpose | Effective |
Date | Change where a sub-processor processes changed, or was corrected | Provider netcup GmbH | Notice Notice waived: The vendor is planned and not yet processing, so no controller's data moves; the row is corrected to the site the server order names, an EU site under the same agreement and TOMs | Effective |
Date | Change where a sub-processor processes changed, or was corrected | Provider netcup GmbH | Notice Notice waived: The vendor is planned and not yet processing, so no controller's data is affected; the chain and parent are corrected to what the executed agreement states, and the previous chain named a party it does not | Effective |
Older changes are in the JSON copy and the change feed.
Changes and your right to object
We give at least 30 days notice before a new sub-processor starts processing your data, and you may object. Each entry records the date it starts, not the date we edited this page.
No customer agreement is signed yet, so a change made now owes no notice and is logged with that stated. From the first customer agreement, a new or changed sub-processor is listed in the change log above at least 30 days before the date it takes effect, and the change feed carries the same entries. To object, email trust@nordvec.com before that date and name the provider. A correction or a narrowing that adds no processing is logged with the reason no notice was owed.
Machine-readable
This page and its JSON copy are rendered from one register in our source tree. The JSON lists every entry with its status, including planned additions during their notice period and removed vendors, so any change can be compared with an earlier copy.
/api/trust/subprocessorsAsk us
Security questionnaires and evidence requests go to one address. Send your questionnaire there and we answer it by email.
trust@nordvec.comThis page is not legal advice.
DPA terms, SLA and invoicing
Talk to us