Draft. This document is a working draft and is pending review by qualified counsel. It is not yet legal advice.
Annex 1 — Sub-processors
Version 0.3 · 10 August 2026 (draft)
This page is part of our Data Processing Agreement. It lists every third party that processes personal data on your behalf, for each one: the legal entity, what it does, the country where processing actually happens, and the safeguard we rely on if that country is outside the European Economic Area.
Where your data lives
Our application, database, storage and authentication run in European Union regions. Some of the companies operating that infrastructure are established in the United States, which means their parent company may be subject to US law regardless of where the servers are. We do not claim otherwise: your data is hosted in the EU, and our infrastructure is not yet sovereign. Moving to a European-owned provider is on our roadmap.
An order from outside the EU does not by itself open your data
A judgment or an administrative decision from a third country requiring us to hand over personal data can only be recognised or enforced where it rests on an international agreement, such as a mutual legal assistance treaty (Article 48 GDPR). We do not act on such a request outside that framework.
Which mechanism carries a transfer
Where the European Commission has decided that a country offers an adequate level of protection, the transfer rests on that decision and needs nothing else. Where it has not, we rely on the Commission's standard contractual clauses.
Some rows below name both. In that case the adequacy decision is what carries the transfer today, and the clauses sit underneath it. That is deliberate: an adequacy decision is reviewed periodically and can be suspended, and we would rather not have to renegotiate anything the day one is. Every provider outside the EEA is bound by clauses that give you enforceable rights and effective remedies.
How you are notified of changes
We notify you at least 30 days before adding or replacing a sub-processor. You do not need to subscribe to anything: we email the Owner of your organisation directly, at the address on the account, and every change is recorded in the log at the bottom of this page.
If you have a reasonable objection on data protection grounds, you can raise it during that period. We will look for a solution with you in good faith, and if none is found you may terminate the affected part of the Service without penalty for the remainder of its term. Section 7 of the Data Processing Agreement governs.
Infrastructure
| Sub-processor | Purpose | Processing location | Transfer safeguard |
|---|---|---|---|
| Google Cloud EMEA Limited (Ireland), with Google LLC (United States) | Application hosting, database, object storage, authentication, secrets, logs | European Union — europe-west1 |
Standard Contractual Clauses under the Cloud Data Processing Addendum, which applies automatically. Google LLC is certified under the EU-US Data Privacy Framework, the UK Extension and the Swiss-US DPF |
| Supabase, Inc. (United States) | Catalogue index for the Data Hub | European Union — Frankfurt | Standard Contractual Clauses under the Supabase DPA. Supabase publishes a Transfer Impact Assessment |
Payments and email
| Sub-processor | Purpose | Processing location | Transfer safeguard |
|---|---|---|---|
| Stripe Payments Europe, Limited (Ireland), with Stripe, Inc. (United States) | Payment processing, subscriptions and top-ups | Ireland and United States | EU-US Data Privacy Framework, plus Standard Contractual Clauses (modules 1 and 2) and the UK addendum under the Stripe DPA |
| Brevo (France) | Transactional email — organisation invitations and account notices — and, where you have given your consent, our newsletter and product announcements | France | — (EEA) |
AI model providers
Prompts and the context you supply are transmitted to the provider selected for each request. Providers outside the EEA are disabled by default for an organisation until an administrator enables them.
| Sub-processor | Purpose | Processing location | Transfer safeguard |
|---|---|---|---|
| Mistral AI (France) | AI assistance, catalogue enrichment and embeddings | European Economic Area — Mistral's own cloud sub-processors operate in Sweden, Norway and the Netherlands | — (EEA) |
| GitHub, Inc. (United States) | AI assistance through the Copilot engine, which routes each request to the model you select. GitHub engages Anthropic PBC and OpenAI as its own sub-processors for model inference, in the United States. Open-weight models, such as Kimi K2.7, are hosted by GitHub itself on Microsoft Azure and not by the vendor that trained them, so your prompts do not reach that vendor's infrastructure | United States | EU-US Data Privacy Framework — GitHub holds its own certification, separate from Microsoft's — plus Standard Contractual Clauses and the UK addendum under the GitHub Data Protection Agreement |
Every provider on this list is under contract
We hold a data processing agreement with each sub-processor named above, and each is bound by obligations no less protective than those in section 7 of our Data Processing Agreement. Where a provider could not offer one, we removed it from the platform rather than list it with a gap.
Only two providers can receive the content you send to the AI, and both are under contract: Mistral AI, in France, and GitHub, which routes to the model you select and hosts the open-weight ones on its own Azure infrastructure.
Search, geocoding and navigation
The address search bar, reverse geocoding and route calculation are provided by ALIGN using our own key, server side. What is sent to the provider is the address you type or the coordinates of the points concerned. Your IP address is not sent: the request leaves our servers, not your browser.
A map creator may replace this default with a provider of their own choice, using their own key. When they do, that provider is under contract with them, not with us, and does not appear on this list.
| Sub-processor | Purpose | Processing location | Transfer safeguard |
|---|---|---|---|
| HERE (HERE Global B.V. group) | Default address search, reverse geocoding, route and public transport calculation, on ALIGN's platform key | [ TO COMPLETE: processing location ] | Standard Contractual Clauses under the HERE Data Processing Agreement. [ TO VERIFY: the version we hold cites Decision 2010/87/EU, which is repealed ] |
Website
We use no sub-processor for our marketing site.
Change log
| Date | Change |
|---|---|
| 27 July 2026 | Initial publication. |
| 4 August 2026 | DeepSeek and Moonshot AI removed. No new sub-processor was added. |
| 7 August 2026 | GitHub entry clarified: open-weight models, such as Kimi K2.7, are hosted by GitHub itself on Microsoft Azure and not by the vendor that trained them. |
| 10 August 2026 | HERE listed, for address search, reverse geocoding and route calculation. This service was already in use; listing it here corrects an omission. |
Contact
For any question about this list, a transfer safeguard, or a specific provider: contact@aligngeo.com. All our legal documents are listed on our legal page.