Under GDPR Article 44 we disclose the sub-processors we use, the purpose each serves, the storage region, and the legal basis for transfer. Naming LLM providers here is a matter-of-fact legal disclosure. Nothing in the app UI, marketing site, or export names them.
Virtual machine hosting the app, database, and background workers.
Personal data scope. Whatever the app processes, at rest on encrypted volumes.
REGION · AMSTERDAM, NETHERLANDS (EU) · CATEGORY · INFRASTRUCTURE
Legal basis. Contract performance. Data processing agreement in place.
Primary database. Runs inside our own VM; listed for completeness.
Personal data scope. Account records, filings, corrections, watchlists, audit trail.
REGION · AMSTERDAM, NETHERLANDS (EU) · CATEGORY · INFRASTRUCTURE
Legal basis. Contract performance. Data processing agreement in place.
Structured extraction + narrative generation for CbCR analyses.
Personal data scope. Filing text extracted from the uploaded PDF. Raw bytes never sent.
REGION · PRC · CATEGORY · LLM
Legal basis. Contract performance. Data processing agreement in place.
Transfer. Standard Contractual Clauses + admin runtime provider swap available under GDPR Article 44 (see Invariant #2). An EU-hosted adapter is on the backlog as the standing option if transfer risk materialises.
Standby extraction + narrative provider. Runs on 5% cross-provider divergence sampling and 100% on any RED-jurisdiction analysis.
Personal data scope. Filing text extracted from the uploaded PDF. Raw bytes never sent.
REGION · PRC · CATEGORY · LLM
Legal basis. Contract performance. Data processing agreement in place.
Transfer. Standard Contractual Clauses + admin runtime provider swap available.
Standby · not on the primary request path unless the operator swaps.
Standing GDPR Article 44 fallback. Flipped from the admin panel if PRC transfer risk materialises.
Personal data scope. Same as active LLM provider when active.
REGION · EU (CANDIDATE: MISTRAL / ALEPH ALPHA / SELF-HOSTED) · CATEGORY · LLM
Legal basis. Contract performance. Data processing agreement in place.
Planned · listed for advance disclosure; not yet in production.
Payment processor for account tier upgrades + wallet top-ups. Handles card auth, SEPA, iDEAL, and issues receipts.
Personal data scope. Cardholder name, billing address, email, transaction amount + reference. Card number NEVER touches AYVES servers. Mollie hosts the payment iframe under PCI-DSS SAQ A scope.
REGION · AMSTERDAM, NETHERLANDS (EU) · CATEGORY · PAYMENTS
Legal basis. Contract performance. Data processing agreement in place.
Transfer. Mollie is an EU-established payment institution supervised by DNB (Dutch central bank). No third-country transfer applies for the payment surface.
Transactional email: magic-link sign-in, corrections status, watchlist alerts, digest.
Personal data scope. Email address + message body.
REGION · EU REGION (FRANKFURT) · CATEGORY · EMAIL
Legal basis. Contract performance. Data processing agreement in place.
Planned · listed for advance disclosure; not yet in production.
Client-side + server-side error tracking. Load-gated on the cookie consent category 'error tracking'.
Personal data scope. Stack traces, user session id, request path. IP scrubbed at ingest.
REGION · EU REGION (FRANKFURT) · CATEGORY · OBSERVABILITY
Legal basis. User consent required: loaded only after the relevant cookie category is accepted per PECR / ePrivacy.
Planned · listed for advance disclosure; not yet in production.
Cookieless page analytics on marketing surfaces. Load-gated on the cookie consent category 'anonymous analytics'.
Personal data scope. Anonymised page view counts. No IP retained.
REGION · EU REGION (SELF-HOSTED CANDIDATE) · CATEGORY · OBSERVABILITY
Legal basis. User consent required: loaded only after the relevant cookie category is accepted per PECR / ePrivacy.
Planned · listed for advance disclosure; not yet in production.
Uptime probing. Self-hosted on a separate box so an outage of the primary host does not silence the monitor.
Personal data scope. Ping metadata only.
REGION · EU · CATEGORY · OBSERVABILITY
Legal basis. Legitimate interest (documented balancing test on file).
Planned · listed for advance disclosure; not yet in production.
Historical entry. Fonts self-hosted from AYVES origin. Google Fonts no longer used. Retained in the register as a planned fallback should the self-hosted bundle be withdrawn.
Personal data scope. None while the entry is planned. If ever re-enabled: IP address during font fetch on first paint.
REGION · UNITED STATES · CATEGORY · CDN
Legal basis. Contract performance. Data processing agreement in place.
Transfer. SCCs would apply if re-enabled. Current serving path is same-origin; no third-party font network call is made.
Planned · listed for advance disclosure; not yet in production.
Register last reviewed 2026-07-20. Every change ships in the same commit as the change it documents.