Skip to main content

Trust

Who computes on your documents, where, and who else keeps a copy.

Where Nordvec runs: Documents stored in the EU, AI processing in France.

Data as of: . Last reviewed:

Being replaced by EU providers: Supabase, Inc., Upstash, Inc., Cloudflare, Inc., Functional Software, Inc., and Vercel Inc. (5 providers based outside the EU).

Two things to know first

  • We have not yet confirmed with Mistral AI SAS whether it keeps a copy of what we send it for abuse monitoring, or for how long, so we print no number. We will publish the answer here. Zero data retention is not active today.
  • The EU promise does not fully cover Mistral AI SAS, Supabase, Inc., Upstash, Inc., Cloudflare, Inc., Functional Software, Inc., Sendinblue SAS (Brevo), and Vercel Inc.. Web search also sends the text of a query to the engines it asks. See what the EU promise does not cover

Your data, station by station

A request passes through five stations. Each row says who computes or holds your data, where, who else keeps a copy, and whether that is changing.

Your data, station by station
StationWho computes or holds itWhereWho else keeps a copyStatus
StationStorage at restYour documents and their search index.Who computes or holds itSupabase, Inc., Upstash, Inc., Scaleway SAS, and netcup GmbHWhereStored in Austria, France, and Ireland, plus 1 provider without a pinned regionWho else keeps a copy25 providers sit beneath them. Named in the details.StatusMovingChanged on October 19, 2026. See the change log. Change log
Providers, contract and retention

Supabase, Inc.

What it does here:
Primary datastore: Postgres (documents, chunks, embeddings, tenants), authentication, and default object storage.
Contract basis:
Under review. Data processing agreement not signed.
Retention:
unknown. We have no primary source.
Beneath it:
Amazon Web Services, Inc, Cloudflare, Inc, Google, LLC, Fly.io, Inc, Upstash, Inc, and Vercel, Inc

Upstash, Inc.

What it does here:
Redis: API rate limiting, session revocation, embedding cache, and impossible-travel detection.
Contract basis:
Under review. Data processing agreement not signed.
Retention:
unknown. We have no primary source.
Beneath it:
Amazon Web Services, Google, Cloudflare, Inc., and Humio (CrowdStrike Falcon LogScale)

Scaleway SAS

What it does here:
S3-compatible object storage for the original files of documents, and for database backups.
Contract basis:
EU only, no third-country transfer. Data processing agreement signed.
Retention:
Retention is the customer's choice for the duration of the contract (DPA 2024, section 2, Duration); at the end of the contract the vendor ceases processing and deletes the personal data and every copy, save what applicable law or its legitimate interests require, within the limits those set (section 13.1). Services are located in the EU by default and the region is the customer's selection at order (section 11.1); the vendor undertakes not to store personal data outside the EU without informing the customer in advance (section 11.2.2). Source read September 13, 2026.
Beneath it:
OpCore, Atempo, Atnorth, 3S Data Center S.A., Atman sp. z o.o., Equinix EMEA, Iron Mountain, Digital Realty, BrainStorm Network Inc., Clever Cloud, and Confia

netcup GmbH

What it does here:
Hosting on our own EU server: the Next.js web application today, and at the cutover the BullMQ worker and the self-hosted sidecars (Valkey, SearXNG, MarkItDown, Bugsink, embedding/rerank). Replaced Vercel.
Contract basis:
EU only, no third-country transfer. Data processing agreement signed.
Retention:
At the end of the service the vendor deletes or returns all personal data at our choice and deletes existing copies; data still held in the vendor's backups is deleted at most 14 days later (executed agreement, section 3(9)). Erasure promises for the hosting layer therefore carry a 14-day backup tail. Source read September 14, 2026.
Beneath it:
Anexia Cloud Solutions GmbH, Anexia Cloud Solutions GmbH (Germany), Anexia Holding GmbH, and DATASIX Rechenzentrumsbetriebs GmbH
StationAI model callsThe model reads your question and passages from your documents, then writes the answer.Who computes or holds itMistral AI SASWhereComputed in FranceWho else keeps a copy5 providers sit beneath them. Named in the details.StatusTodayChanged on September 27, 2026. See the change log. Change log
Providers, contract and retention

Mistral AI SAS

What it does here:
Language-model generation (chat answers, planning, tool use, reading images, input moderation) and text embeddings for search. The only managed inference provider; there is no fallback outside the EU.
Contract basis:
EU only, no third-country transfer. Data processing agreement signed.
Retention:
unknown. We have no primary source.
Beneath it:
Mistral Compute, Microsoft Inc., Google LLC, CoreWeave Inc., and Cloudflare Inc.
StationAbuse monitoringWhether the model provider keeps a copy of what we send it to detect misuse.Who computes or holds itMistral AI SASWhereNot yet confirmed. If a copy is kept, we have no primary source for where.Who else keeps a copyWe have not yet confirmed with Mistral AI SAS whether it keeps a copy for abuse monitoring, or for how long. Zero retention is not active today.StatusTodayChanged on September 27, 2026. See the change log. Change log
Providers, contract and retention

Not yet confirmed whether a copy is kept, or for how long. We print no number.

Zero data retention: not active.

StationLogs and metadataError reports, request records, mail delivery records and network traffic.Who computes or holds itCloudflare, Inc., Functional Software, Inc., Sendinblue SAS (Brevo), Vercel Inc., and netcup GmbHWhereKept in Austria, Germany, France, and United States, plus 2 providers without a pinned regionWho else keeps a copy16 providers sit beneath them. Named in the details.StatusMovingChanged on October 17, 2026. See the change log. Change log
Providers, contract and retention

Cloudflare, Inc.

What it does here:
DNS for our domain.
Contract basis:
Under review. Data processing agreement not signed.
Retention:
unknown. We have no primary source.

Functional Software, Inc.

What it does here:
Application error and performance monitoring.
Contract basis:
Under review. Data processing agreement not signed.
Retention:
90-day rolling event retention (vendor-documented: 90 days on paid plans, 30 on free; mirrored in docs/compliance/data-retention-policy.md); event.user.email attaches for consent-granted users and has no erasure hook, so it outlives an erasure request until the 90-day roll-off. Named residual in the erasure-propagation register; closes at the 0F Bugsink cutover. Source read July 22, 2026.
Beneath it:
Amazon Web Services, Inc., Cloudflare, Inc., and Google LLC

Sendinblue SAS (Brevo)

What it does here:
Transactional email (notifications, account mail).
Contract basis:
EU only, no third-country transfer. Data processing agreement not signed.
Retention:
Transactional EVENT logs (recipient, subject, delivery events) are stored indefinitely by default until an account retention rule is set (1 month to 5 years); email BODIES are not stored by default ("Never store previews" is the default). Provisioning checklist sets the 1-3 month rule in the same session as the key. Source read July 22, 2026.
Beneath it:
Google Cloud Platform, Scaleway (Iliad), OVH, Hetzner Online GmbH, and Cloudflare

Vercel Inc.

What it does here:
Application hosting and scheduled jobs (former deployment target).
Contract basis:
Under review. Data processing agreement not signed.
Retention:
unknown. We have no primary source.
Beneath it:
Amazon Web Services, Inc., Google LLC, Microsoft Corporation, Upstash, Inc., Neon, and Redis Labs, Inc.

netcup GmbH

What it does here:
Hosting on our own EU server: the Next.js web application today, and at the cutover the BullMQ worker and the self-hosted sidecars (Valkey, SearXNG, MarkItDown, Bugsink, embedding/rerank). Replaced Vercel.
Contract basis:
EU only, no third-country transfer. Data processing agreement signed.
Retention:
At the end of the service the vendor deletes or returns all personal data at our choice and deletes existing copies; data still held in the vendor's backups is deleted at most 14 days later (executed agreement, section 3(9)). Erasure promises for the hosting layer therefore carry a 14-day backup tail. Source read September 14, 2026.
Beneath it:
Anexia Cloud Solutions GmbH, Anexia Cloud Solutions GmbH (Germany), Anexia Holding GmbH, and DATASIX Rechenzentrumsbetriebs GmbH

Announced, not yet processing: BunnyWay d.o.o. (Bunny.net).

StationExternal servicesWeb search and the connectors you switch on.Who computes or holds itOur own search service on our EU servers, and the source you connect.WhereSearch runs on our EU servers. We do not control where the engines it asks run.Who else keeps a copyThe search engines receive your query text. They do not receive your name, address or account.StatusToday
Providers, contract and retention

Our own search service runs on our EU servers and sends your query text to the engines it asks. Your address, cookies and account never reach them. Those engines run where their operators choose, so we print no country.

Retention at the engines: unknown. We have no primary source.

A connector reads from the source you authorised, under your own agreement with that source. That source is not our provider. What it sends us is processed at the five stations on this page.

Today: it works this way now and stays this way. Moving: it works this way now and a provider is being replaced by an EU provider. Planned: it is not in place yet.

Verify it yourself

Three records you can download and check without asking us.

What we hold and what we do not

No certifications held.

Not held: SOC 2 Type II, ISO 27001, and ISAE 3000 report (an international assurance standard that Danish practice uses for processor reports).

Instead we publish the evidence behind each control, so you can check it yourself. Open the evidence page

We also publish the claims we decline to make, each beside the fact that rules it out: 3 claims today. See the refused claims

We will notify you within 24 hours of detecting a personal data breach. We assist you in complying with breach notification obligations under GDPR Articles 33 and 34, including notifications to your supervisory authority and affected data subjects. This is our contractual commitment to customers. The law sets its own deadlines for notifying authorities.

Ask us

Security questionnaires and evidence requests go to one address. Send your questionnaire there and we answer it by email.

trust@nordvec.com

This page is not legal advice.

Data processing agreement

DPA terms, SLA and invoicing

Talk to us