SovEU · Trust
Sub-processors
The third parties we rely on to run SovEU, where they process data, and whether they're required or optional. Everything that runs SovEU sits in the EU, UK or Switzerland — all under EU adequacy decisions — and we'd rather you audit that than take it on faith.
| Sub-processor | Purpose | Region | Use |
|---|---|---|---|
| NorthflankHosting, database, storage & queue | Runs the SovEU applications and hosts the PostgreSQL database, object storage and the background-job queue.Managed container platform; SovEU's data resides in the EU region. Northflank is a UK company (the UK holds an EU adequacy decision). Stored objects are never public and are served via short-lived signed links. | EU | Required |
| Proton (Proton Mail)Transactional email | Delivers sign-in links, alerts, digests and notifications.Swiss email provider; Switzerland holds an EU adequacy decision. Emails carry names, links and summaries — never document contents. | Switzerland | Required |
| Mistral AIAI assist (drafting, extraction & search) | Powers SovEU's AI assist — the Brain: human-reviewed drafting and extraction, and the embeddings behind document and knowledge search.EU AI provider (Mistral, France). Used only for AI features; it never sets compliance values, deadlines or risk classes, and every output is human-reviewed before it is saved. | EU | Optional |
AI assist runs on an EU model
SovEU's AI assist — Ask SovEU (drafting, extraction and document/knowledge search) — runs on Mistral (France), not a US model. It is feature-gated, every output is human-reviewed before it is saved, and it never sets a compliance value, deadline or risk class. We previously used Anthropic for this and have since moved fully to Mistral.
What we don't use
No third-party analytics, no advertising trackers, and no error-tracking SDK that ships data off-platform. Fonts are self-hosted — no font CDN.
Last reviewed 2026-06-19. Questions about our processing or a DPA? hello@soveu.io