Sub-processors

Which parties are involved, and for what.

We engage as few parties as possible. Below, for each link in the chain, you can see who that is and where the processing takes place. We notify clients in advance of new or replacement sub-processors, so that they can object (Article 28(2) GDPR).

For what	Party	Place of processing	Status
Setting up and managing the hosting: deployment, configuration and secrets	Brewless.eu, the Netherlands	EU	Active
Application, databases, keys and storage of original documents	Scaleway SAS, France	France	Active
Passing on all traffic to the website and the workspace, with the secure connection	BunnyWay d.o.o. (bunny.net), Slovenia	EU: traffic only passes through points of presence in the EU. Only the address lookup (DNS) uses bunny.net's worldwide network.	Active
Sending email: device codes, notifications and system messages	Lettermint, the Netherlands	EU	Active
The semantic search index: only released, pseudonymised passages and pseudonymised search queries	Mistral AI, France	EU and EFTA (Mistral's European endpoint)	Not enabled at present
OCR of scans and PDFs without a text layer (Mistral receives the original document for this)	Mistral AI, France	EU and EFTA (Mistral's European endpoint)	Not enabled at present
Detecting personal data in documents	No external party: the detection model runs in our own environment	EU	Pattern recognition only at present

A sub-processor may engage parties of its own, sometimes outside the EU, for example for support or invoicing. That is only allowed with the safeguards of the GDPR. We send the overview per party on request.

What is not a sub-processor of ours

The AI assistant you connect yourselfIf you connect Claude, ChatGPT Business, Mistral Vibe or another assistant via MCP, its provider receives released, pseudonymised passages and the questions your staff member types. That provider works under your own agreement, not under ours. Anthropic, the maker of Claude, for example processes data in the United States; that is a transfer that you assess and record. Use a business account with a data processing agreement for this, never a consumer subscription.
Your SharePoint environmentMicrosoft remains your processor under your existing agreement. PrivaSearch only reads, changes nothing and checks live at every delivery whether the user may still see the document there.

Keeping it up to date: this overview should match what is actually running. If you see a difference, or if you would like the full overview with country of establishment, storage location and transfer safeguard per party, email privacy@privasearch.ai.

This page was translated from Dutch with the help of AI. In case of differences, the Dutch version applies. Read the Dutch version