Draft. This document is a working draft and is pending review by qualified counsel. It is not yet legal advice.
Annex 1 — Sub-processors
Version 0.4 · 10 September 2026 (draft)
This page is part of our Data Processing Agreement. It lists every third party that processes personal data on your behalf, for each one: the legal entity, what it does, the country where processing actually happens, and the safeguard we rely on if that country is outside the European Economic Area.
Where your data lives
Our application, database, storage and authentication run in European Union regions. Some of the companies operating that infrastructure are established in the United States, which means their parent company may be subject to US law regardless of where the servers are. We do not claim otherwise: your data is hosted in the EU, and our infrastructure is not yet sovereign. Moving to a European-owned provider is on our roadmap.
An order from outside the EU does not by itself open your data
A judgment or an administrative decision from a third country requiring us to hand over personal data can only be recognised or enforced where it rests on an international agreement, such as a mutual legal assistance treaty (Article 48 GDPR). We do not act on such a request outside that framework.
Which mechanism carries a transfer
Where the European Commission has decided that a country offers an adequate level of protection, the transfer rests on that decision and needs nothing else. Where it has not, we rely on the Commission's standard contractual clauses.
Some rows below name both. In that case the adequacy decision is what carries the transfer today, and the clauses sit underneath it. That is deliberate: an adequacy decision is reviewed periodically and can be suspended, and we would rather not have to renegotiate anything the day one is. Every provider outside the EEA is bound by clauses that give you enforceable rights and effective remedies.
How you are notified of changes
We notify you at least 30 days before adding or replacing a sub-processor. You do not need to subscribe to anything: we email the Owner of your organisation directly, at the address on the account, and every change is recorded in the log at the bottom of this page.
If you have a reasonable objection on data protection grounds, you can raise it during that period. We will look for a solution with you in good faith, and if none is found you may terminate the affected part of the Service without penalty for the remainder of its term. Section 7 of the Data Processing Agreement governs.
Infrastructure
| Sub-processor | Purpose | Processing location | Transfer safeguard |
|---|---|---|---|
| Google Cloud EMEA Limited (Ireland), with Google LLC (United States) | Application hosting, database, object storage, authentication, secrets, logs | European Union — europe-west1 |
Standard Contractual Clauses under the Cloud Data Processing Addendum, which applies automatically. Google LLC is certified under the EU-US Data Privacy Framework, the UK Extension and the Swiss-US DPF |
| Supabase, Inc. (United States) | Catalogue index for the Data Hub | European Union — Frankfurt | Standard Contractual Clauses under the Supabase DPA. Supabase publishes a Transfer Impact Assessment |
Payments and email
| Sub-processor | Purpose | Processing location | Transfer safeguard |
|---|---|---|---|
| Stripe Payments Europe, Limited (Ireland), with Stripe, Inc. (United States) | Payment processing, subscriptions and top-ups | Ireland and United States | EU-US Data Privacy Framework, plus Standard Contractual Clauses (modules 1 and 2) and the UK addendum under the Stripe DPA |
| Brevo (France) | Transactional email — organisation invitations and account notices — and, where you have given your consent, our newsletter and product announcements | France | — (EEA) |
AI model providers
Prompts and the context you supply are transmitted to the provider selected for each request. Adding or replacing a provider follows the same thirty (30) day notice period as any other sub-processor, set out in our Data Processing Agreement.
Each provider below is under direct contract with us, and we call it with our own key. There is no other party in the chain: no reseller, no routing layer, and no marketplace intermediary receives your prompts.
| Sub-processor | Purpose | Processing location | Transfer safeguard |
|---|---|---|---|
| Mistral AI (France) | AI assistance, catalogue enrichment and embeddings | European Economic Area — Mistral's own cloud sub-processors operate in Sweden, Norway and the Netherlands | — (EEA) |
| Anthropic Ireland, Limited (Ireland), with Anthropic PBC (United States) | AI assistance, the Claude models (Opus, Sonnet) | United States | Standard Contractual Clauses, modules two and three, under the Anthropic Data Processing Addendum (effective 24 February 2025), incorporated by reference into the Commercial Terms. Data is retained for the term of the agreement and deleted within 30 days of its end. Anthropic states that inputs and outputs from its commercial products, the API included, are not used to train its models by default. Its own sub-processor list is published separately |
| Microsoft Ireland Operations Limited (Ireland), with Microsoft Corporation (United States) | AI assistance, the Kimi 2.7 Code model, served by Microsoft as an Azure Direct Model. The vendor that trained the model receives nothing: the open weights run on Microsoft infrastructure. This model is currently offered in preview, and Microsoft's preview terms may apply different practices, including for abuse review | Our Foundry resource is located in Sweden, and everything stored at rest, including any sample retained for abuse review, stays in that geography. The model itself runs on a global deployment, so a prompt may be processed in any geography where Microsoft serves it, including outside the European Economic Area | EU-US Data Privacy Framework, Microsoft holds its own certification, plus Standard Contractual Clauses under the Microsoft Products and Services Data Protection Addendum. Microsoft states that prompts and completions are not available to the model's provider and are not used to train any foundation model. Where a sample is retained for abuse review, it is stored in the geography of our own resource, and for resources deployed in the European Economic Area the authorised human reviewers are located in the European Economic Area |
Every provider on this list is under contract
We hold a data processing agreement with each sub-processor named above, and each is bound by obligations no less protective than those in section 7 of our Data Processing Agreement. Where a provider could not offer one, we removed it from the platform rather than list it with a gap.
Three providers can receive the content you send to the AI, and each is under direct contract: Mistral AI in France, Anthropic for the Claude models, and Microsoft for Kimi 2.7 Code, served on its own infrastructure. No request reaches any other party.
Search, geocoding and navigation
The address search bar, reverse geocoding and route calculation are provided by ALIGN using our own key, server side. What is sent to the provider is the address you type or the coordinates of the points concerned. Your IP address is not sent: the request leaves our servers, not your browser.
A map creator may replace this default with a provider of their own choice, using their own key. When they do, that provider is under contract with them, not with us, and does not appear on this list.
| Sub-processor | Purpose | Processing location | Transfer safeguard |
|---|---|---|---|
| HERE (HERE Global B.V. group) | Default address search, reverse geocoding, route and public transport calculation, on ALIGN's platform key | [ TO COMPLETE: processing location ] | Standard Contractual Clauses under the HERE Data Processing Agreement. [ TO VERIFY: the version we hold cites Decision 2010/87/EU, which is repealed ] |
Website
We use no sub-processor for our marketing site.
Change log
| Date | Change |
|---|---|
| 27 July 2026 | Initial publication. |
| 4 August 2026 | DeepSeek and Moonshot AI removed. No new sub-processor was added. |
| 7 August 2026 | GitHub entry clarified: open-weight models, such as Kimi K2.7, are hosted by GitHub itself on Microsoft Azure and not by the vendor that trained them. |
| 10 August 2026 | HERE listed, for address search, reverse geocoding and route calculation. This service was already in use; listing it here corrects an omission. |
| 10 September 2026 | GitHub removed. AI requests no longer reach GitHub: each model is now called directly under our own contract, with our own key. Anthropic and Microsoft are listed as the two new AI sub-processors, alongside Mistral AI. Processing locations are stated for each: Anthropic in the United States, Microsoft on a global deployment with storage in Sweden. |
Contact
For any question about this list, a transfer safeguard, or a specific provider: contact@aligngeo.com. All our legal documents are listed on our legal page.