Sub-processors

Sub-processors Noveu Solutions

Version: 1.8.3 Last updated: 23 October 2026 Context: This overview belongs to Annex 2 of the Data Processing Agreement (DPA) and is a mandatory GDPR transparency publication (Art. 28(2) GDPR).

Noveu Solutions engages a limited number of sub-processors to deliver its services. Changes are announced at least 30 days in advance, so that Clients can object on reasoned grounds in accordance with article 6 of the DPA. This page is the current, publicly available overview.

Notice of change of sub-processor (DPA art. 6.3)

Announced on: 31 August 2026 End of objection period: 31 October 2026 (extended; previously 30 September 2026)

What changes. The AI sub-processor for language model generation is Mistral AI SAS (Paris, France), with processing within the EU. As a result, Google LLC (Gemini API, United States) is no longer an AI sub-processor.

Why this notice is retroactive. The technical switch to Mistral took place on 29 August 2026; Google has not been in use as an AI processor since then. The notice under article 6.3 should have preceded that and did not. We correct that explicitly here instead of quietly: the switch was on 29 August 2026 and the notice only followed on 31 August 2026. The objection period first ran until and including 30 September 2026 and has been extended until and including 31 October 2026.

What this means for you.

• It is a replacement, not an addition: Mistral takes over the role of Google and the total at that time remained five sub-processors. The AI processing thereby moves from outside to inside the EEA. Since 21 October 2026 there have been four (see the change in version 1.8.1).
• If you want to object, you can do so until and including 31 October 2026 via privacy@noveu.eu. The procedure is in article 6.4 of the DPA and further down this page.

Overview of current sub-processors

Explanation per sub-processor

1. Hetzner Online GmbH (primary hosting)

• Role: core supplier of compute, storage and network capacity.
• Location: production and backups are in the Hetzner data centre in Falkenstein (Germany). Backups have been stored encrypted since 30 September 2026. The disks themselves are not yet encrypted; we are not giving a date for that yet.
• Architecture: own dedicated hardware under Proxmox VE; no multi-tenant hyperscaler.
• Safeguards: German GDPR jurisdiction, ISO 27001-certified data centre, Hetzner DPA applied.

2. Cloudflare, Inc.

• Role: edge network in front of the platform: CDN, DDoS mitigation, WAF, DNS and Cloudflare Tunnel.
• Inbound architecture: the HTTP/HTTPS traffic of the platform runs via Cloudflare Tunnel, which keeps the origin IPs of the web services shielded. Mail traffic (the SMTP, IMAP and JMAP protocols) and real-time communication (STUN and TURN) do not run via Cloudflare, but directly to our own server at Hetzner in Falkenstein; for those services Cloudflare only provides the DNS.
• Safeguards: EU-US Data Privacy Framework, Standard Contractual Clauses (SCCs) and the Cloudflare Data Processing Addendum.

3. Stripe Payments Europe Ltd.

• Role: payment processing for business subscriptions (cards, iDEAL, SEPA).
• Location: EU, processing via Stripe's Irish entity within the EEA.
• Safeguards: Stripe DPA, PCI-DSS Level 1, GDPR-compliant processing.

4. Mistral AI SAS (AI, only after activation, LLM only)

• Role: LLM provider for Noveu AI functionality. Since 29 August 2026 the production AI has used the Mistral API solely for text generation.
• Establishment and processing location: Mistral AI SAS is a French company. Noveu calls Mistral's EU API (api.mistral.ai), which keeps the processing within the EU. For this sub-processor, the transfer is therefore not based on the EU-US Data Privacy Framework or on Standard Contractual Clauses, as was the case with the previous AI processor.
• Embeddings on-premise: the embeddings (vectorisation) for AI knowledge retrieval do not go to Mistral. Since June 2026 they have run on our own infrastructure (BAAI bge-m3 via self-hosted Text-Embeddings-Inference on vm-platform). The (pseudonymised) text does not leave our infrastructure.
• Activation: used only if the Client explicitly activates AI functions per feature or user. Without activation, no content is sent to Mistral.
• Processing: only the content that the user submits to the AI function is sent to the Mistral API. This paid API tier is not used to train Mistral models.
• Safeguards: GDPR processing within the EU, Mistral Data Processing Agreement, additional data minimisation and pseudonymisation in the Noveu AI gateway.

Self-hosted infrastructure (no separate sub-processor)

The following components run on our own infrastructure (Hetzner Dedicated, EU). They are not independent sub-processors; the processing falls under Hetzner (no. 1 above).

• pgvector (vector store for AI knowledge retrieval / embeddings), a self-hosted PostgreSQL extension on our own infrastructure; there is no external/third-party vector database.
• AI embeddings, on-premise (BAAI bge-m3 via self-hosted Text-Embeddings-Inference on vm-platform), the vectors for AI knowledge retrieval are generated locally; the (pseudonymised) text does not leave our infrastructure and no external embedding API is used.
• LiveKit (video and audio for meetings in Noveu Meet), a self-hosted server on our own server at Hetzner in Falkenstein; video and audio go live between the participants only and nothing is recorded.
• coturn (STUN/TURN), a self-hosted relay server on the same infrastructure. It helps set up the participants' connection and can relay video and audio; it does not store video or audio. Its error log lines can contain a participant's IP address and port. We keep them for at most 15 days; an archive of the error log lines up to and including 22 October 2026 is kept until 19 November 2026 at the latest.

Retired sub-processors

The Gemini integration is still in the AI service as an unused code path and is being removed in a separate change. There is no configuration in which that path is called in production; it is mentioned here because "removed from the configuration" and "removed from the source code" are not the same, and we do not want to gloss over that difference.

Intended changes

At the moment no further changes to the sub-processor list are planned. The ongoing change (Google to Mistral) is at the top of this page.

Intended additions or replacements are published here, together with:

• the name, establishment and processing location of the (new) sub-processor;
• the purpose and the categories of personal data;
• the intended effective date (at least 30 days after the notice);
• the safeguards (DPA, SCCs, certifications).

Objecting to a sub-processor

Clients can object on reasoned grounds to an intended change within 30 days of the notice. If consultation does not lead to agreement within 14 days, the Client may terminate the Main Agreement with a notice period of 30 days, without compensation (DPA art. 6.4).

Submitting an objection: privacy@noveu.eu or via the customer portal.

Changelog

Contact

• Privacy / GDPR: privacy@noveu.eu
• Legal: legal@noveu.eu
• General DPA: /en/legal/data-processing-agreement
• General Terms and Conditions: /en/legal/terms