Data Residency Statement
Data residency and jurisdiction: where primary customer data is processed and stored, under which law, and which parties are in the chain.
Statement
Your data and backups are stored in Germany, in a Hetzner data centre in Falkenstein. Noveu Solutions is a Dutch company (sole proprietorship) under Dutch law. Cloudflare is the only sub-processor with a US establishment; the EU-US Data Privacy Framework and SCCs apply to that party. Since 29 August 2026, the AI processor has been Mistral AI SAS (French company; according to Mistral, in the EU by default). The current overview is on the sub-processors page.
Scope
This statement concerns the place where we store customer data:
- email, files, documents and identity data
- backups
- log files and audit logs
Traffic in transit runs via the edge network of Cloudflare; see Edge / DDoS / CDN below.
Data Centre Locations
Primary Data Centre
| Aspect | Details |
|---|---|
| Location | Falkenstein, Germany (data and backups) |
| Operator | Hetzner Online GmbH |
| Site security | Fenced site with camera surveillance and electronic access control, according to the data centre description of Hetzner, consulted 28 September 2026 |
| Certifications | Hetzner is certified according to ISO/IEC 27001:2022 for the infrastructure and operations of its data centre parks, according to the certification of Hetzner, consulted 28 September 2026 |
| Ownership | European (German GmbH) |
Edge / DDoS / CDN
| Aspect | Details |
|---|---|
| Operator | Cloudflare, Inc. (US) |
| Role | DNS, CDN, DDoS protection and TLS at the edge of the network; the content of the traffic is visible to Cloudflare during edge processing |
| Location | Worldwide edge network; a connection can end up at a location outside the EU |
| Jurisdiction safeguards | EU-US DPF + SCCs + Cloudflare DPA |
Legal Shielding
Jurisdiction of the main processor
Noveu Solutions:
- Is a Dutch company (sole proprietorship, registered with the Dutch Chamber of Commerce (KvK) under number 42030979)
Recognised sub-processors with a US nexus
For edge services we do use a sub-processor with a US nexus. It is listed transparently on the sub-processors page and works under the EU-US DPF + SCCs + DPA:
- Cloudflare, Inc., edge, DDoS, CDN, DNS. Cloudflare terminates TLS at the edge and processes traffic and metadata in transit; payload content is visible to Cloudflare during edge processing. Persistent customer data remains stored at Hetzner, in Falkenstein (Germany). Backups are encrypted.
Since 29 August 2026, Cloudflare has been the only sub-processor with a US nexus. Until that date, the AI processor was Google LLC (Gemini API, US) and it is now an EU party.
AI processor (EU)
- Mistral AI SAS (French company; according to Mistral, in the EU by default), for the text of all AI functions (LLM text generation). For the assistant, what goes to Mistral is your question, up to five earlier turns, the passages found with their source address and what the assistant looks up for you, such as emails, tickets and invoices; for the mail helper, the sender, subject and text of the email. According to Mistral itself, data stays in the EU by default, but can temporarily go to sub-processors of Mistral per function. The embeddings (vectorisation) and the vector store run on our own infrastructure in Falkenstein (BAAI
bge-m3via self-hosted Text-Embeddings-Inference + pgvector).
Law
The GDPR and Dutch law apply to our processing and our agreements. Whether the Cybersecurity Act (the Dutch implementation of NIS2) applies to your organisation depends on your sector and size.
Supply Chain Transparency
Infrastructure Partners
| Partner Type | Jurisdiction | Function |
|---|---|---|
| Data centre | Falkenstein, Germany (Hetzner Online GmbH) | Physical hosting on a dedicated server |
| Edge and DNS | US (Cloudflare, Inc.) | DNS, CDN, DDoS protection, TLS at the edge |
| Software | Open source | Platform components such as PostgreSQL, Stalwart and Zitadel |
Technical Measures
Encryption
| Data State | Method | Explanation |
|---|---|---|
| In Transit | TLS 1.2 or higher, TLS 1.3 is supported | At the edge, Cloudflare terminates the TLS connection |
| Backup | Backups are in the Hetzner data centre in Falkenstein (Germany). Backups are encrypted |
Access control
- Signing in via one Noveu login (OpenID Connect)
- MFA (TOTP) and passkeys are available
- The audit log per organisation can be exported as CSV
- Principle of least privilege, via roles per organisation
Transparency
- Open source components where possible
- Transparent subprocessor list, current at /juridisch/sub-verwerkers
Subprocessors
Approved Subprocessors
This is the complete list of approved subprocessors. The same parties are in the legal overview at the sub-processors page.
| Subprocessor | Establishment | Processing location | Service | Data Access | Safeguard |
|---|---|---|---|---|---|
| Hetzner Online GmbH | Germany (EU) | Falkenstein (DE) | Hosting / compute / storage / backups | Backups are encrypted | GDPR: EU entity + DPA |
| Cloudflare, Inc. | US (EU entity available) | Worldwide network of Cloudflare | DNS, CDN, DDoS mitigation, edge, Cloudflare Tunnel | IP addresses, metadata, TLS termination at the edge | EU-US DPF + SCCs + DPA |
| Stripe Payments Europe Ltd. | Ireland (EU) | EU | Payment processing (card, iDEAL, SEPA) | Billing, company and payment data | GDPR: EU entity + DPA |
| Mistral AI SAS | France (EU) | EU (according to Mistral, by default) | AI support, only LLM text generation (the text of all AI functions). Embeddings run on-premise on our own EU infrastructure | For the assistant, the question, up to five earlier turns, the passages found with source address and what the assistant looks up (emails, tickets, invoices); for the mail helper, the sender, subject and text of the email | GDPR: EU entity + Mistral DPA + data minimisation/pseudonymisation |
Phased out as of 29 August 2026: Google LLC (Gemini API, US), replaced by Mistral AI SAS. The announcement in accordance with DPA art. 6.3 is on the sub-processors page.
The external AI subprocessor (Mistral AI) is
used for LLM text generation, the text of all AI functions. The embeddings and the vector store
are self-hosted (BAAI bge-m3 via self-hosted Text-Embeddings-Inference
- pgvector, EU). The legal overview, with the explanation per subprocessor, is on the sub-processors page and in the DPA (Data Processing Agreement).
Change procedure
Changes to subprocessors:
- Are announced at least 30 days in advance
- Are then listed on the sub-processors page
- Give you the option to object on reasoned grounds and, if necessary, terminate with a notice period of 30 days
Government requests
Procedure
For requests from governments:
- We check whether the request has a valid legal basis
- We provide no more than the request asks for
- We inform the customer, unless the law prohibits this
Auditing
Customer Audit Right
Under article 10 of the data processing agreement, you may carry out an audit, or have one carried out, once per calendar year by an independent, qualified auditor under confidentiality, and additionally in the event of a data breach or an investigation by the supervisory authority.
Available Documentation
- ISO 27001 certificate of the data centre (Hetzner Falkenstein)
- The public data centre description of Hetzner
- Technical and organisational measures on request
Contact
Privacy and data protection: privacy@noveu.eu
Dutch Data Protection Authority (Autoriteit Persoonsgegevens):
- Website: autoriteitpersoonsgegevens.nl
- For complaints about data processing
Read more
- PageChoosing a sovereign workplace: seven questions up frontWhat you ask a provider before you sign.
- BlogWorking without a US cloud: how far do you get today?Per service what already works and where it still pinches, also in our own chain.
- PageThe list of sub-processorsWhich parties we engage and for what.
What is your next step?
Want to know what this looks like for your organisation? See how Noveu approaches it, or schedule a conversation.