Draft. This document is a working draft and is pending review by qualified counsel. It is not yet legal advice.
Annex 1 — Sub-processors
Version 1.0 · 27 July 2026 (draft)
This page is part of our Data Processing Agreement. It lists every third party that processes personal data on your behalf, for each one: the legal entity, what it does, the country where processing actually happens, and the safeguard we rely on if that country is outside the European Economic Area.
Where your data lives
Our application, database, storage and authentication run inEuropean Union regions. Some of the companies operating that infrastructure are established in the United States, which means their parent company may be subject to US law regardless of where the servers are. We do not claim otherwise: your data is hosted in the EU, and our infrastructure is not yet sovereign. Moving to a European-owned provider is on our roadmap.
How you are notified of changes
We notify you at least 30 days before adding or replacing a sub-processor. You do not need to subscribe to anything: we email the Owner of your organisation directly, at the address on the account, and every change is recorded in the log at the bottom of this page.
Infrastructure
| Sub-processor | Purpose | Processing location | Transfer safeguard |
|---|---|---|---|
| Google Cloud EMEA Limited (Ireland), with Google LLC (United States) | Application hosting, database, object storage, authentication, secrets, logs | European Union — europe-west1 | Standard Contractual Clauses under theCloud Data Processing Addendum, which applies automatically. Google LLC iscertified under the EU-US Data Privacy Framework, the UK Extension and the Swiss-US DPF |
| Supabase, Inc. (United States) | Catalogue index for the Data Hub | European Union — Frankfurt | Standard Contractual Clauses under theSupabase DPA. Supabase publishes aTransfer Impact Assessment |
Payments and email
| Sub-processor | Purpose | Processing location | Transfer safeguard |
|---|---|---|---|
| Stripe Payments Europe, Limited (Ireland), with Stripe, Inc. (United States) | Payment processing, subscriptions and top-ups | Ireland and United States | EU-US Data Privacy Framework, plus Standard Contractual Clauses (modules 1 and 2) and the UK addendum under theStripe DPA |
| Brevo (France) | Transactional email — organisation invitations and account notices — and, where you have given your consent, our newsletter and product announcements | France | — (EEA) |
AI model providers
Prompts and the context you supply are transmitted to the provider selected for each request. Providers outside the EEA aredisabled by default for an organisation until an administrator enables them.
| Sub-processor | Purpose | Processing location | Transfer safeguard |
|---|---|---|---|
| Mistral AI (France) | AI assistance, catalogue enrichment and embeddings | European Economic Area — Mistral's own cloud sub-processors operate in Sweden, Norway and the Netherlands | — (EEA) |
| GitHub, Inc. (United States) | AI assistance through the Copilot engine, which routes each request to the model you select. GitHub engagesAnthropic PBC and OpenAI as its own sub-processors for model inference, in the United States | United States | EU-US Data Privacy Framework — GitHub holdsits own certification, separate from Microsoft's — plus Standard Contractual Clauses and the UK addendum under theGitHub Data Protection Agreement |
| DeepSeek | AI assistance, catalogue enrichment | China | None in place — see below |
| Moonshot AI (Kimi) | AI assistance | Under confirmation — see below | None in place — see below |
The two providers without an agreement
We say this plainly rather than leave you to discover it.DeepSeek and Moonshot have no data processing agreement with us, because neither publishes one. Both are disabled by default for every organisation, and no data reaches them unless an administrator has deliberately enabled them and a user has deliberately selected them for a given request.
We have asked DeepSeek for an agreement through its EU representative and are awaiting a reply. For Moonshot, the entity is registered in Singapore while its published policy points to China; we are not willing to state a country we have not confirmed, so the cell above stays open. Until both are resolved, our undertaking in section 7 of theData Processing Agreement — that every sub-processor is bound by obligations no less protective — does not extend to these two.
If your own obligations do not allow processing without a contract in place, disable both providers for your organisation. If you would like us to remove them from the platform entirely, tell us: contact@geonova.be.
Website
We use no sub-processor for our marketing site.
Change log
| Date | Change |
|---|---|
| 27 July 2026 | Initial publication. |
Contact
For any question about this list, a transfer safeguard, or a specific provider: contact@geonova.be. All our legal documents are listed on ourlegal page.