# Data Residency Statement

## Statement

Your data and backups are stored in Germany, in a Hetzner data centre in Falkenstein. Noveu Solutions is a Dutch company (sole proprietorship) under Dutch law. Cloudflare is the only sub-processor with a US establishment; the EU-US Data Privacy Framework and SCCs apply to that party. Since 29 August 2026, the AI processor has been Mistral AI SAS (French company; according to Mistral, in the EU by default). The current overview is on [the sub-processors page](https://noveu.eu/en/legal/sub-processors).

## Scope

This statement concerns the place where we store customer data:
- email, files, documents and identity data
- backups
- log files and audit logs

Traffic in transit runs via the edge network of Cloudflare; see Edge / DDoS / CDN below.

## Data Centre Locations

### Primary Data Centre

| Aspect | Details |
|--------|---------|
| Location | Falkenstein, Germany (data and backups) |
| Operator | Hetzner Online GmbH |
| Site security | Fenced site with camera surveillance and electronic access control, according to the [data centre description of Hetzner](https://www.hetzner.com/unternehmen/rechenzentrum/), consulted 28 September 2026 |
| Certifications | Hetzner is certified according to ISO/IEC 27001:2022 for the infrastructure and operations of its data centre parks, according to the [certification of Hetzner](https://www.hetzner.com/unternehmen/zertifizierung/), consulted 28 September 2026 |
| Ownership | European (German GmbH) |

### Edge / DDoS / CDN

| Aspect | Details |
|--------|---------|
| Operator | Cloudflare, Inc. (US) |
| Role | DNS, CDN, DDoS protection and TLS at the edge of the network; the content of the traffic is visible to Cloudflare during edge processing |
| Location | Worldwide edge network; a connection can end up at a location outside the EU |
| Jurisdiction safeguards | EU-US DPF + SCCs + Cloudflare DPA |

## Legal Shielding

### Jurisdiction of the main processor

Noveu Solutions:
- Is a Dutch company (sole proprietorship, registered with the Dutch Chamber of Commerce (KvK) under number 42030979)

### Recognised sub-processors with a US nexus

For edge services we **do** use a sub-processor with a US nexus. It is listed transparently on [the sub-processors page](https://noveu.eu/en/legal/sub-processors) and works under the EU-US DPF + SCCs + DPA:
- Cloudflare, Inc., edge, DDoS, CDN, DNS. Cloudflare terminates TLS at the edge and processes traffic and metadata in transit; payload content is visible to Cloudflare during edge processing. Persistent customer data remains stored at Hetzner, in Falkenstein (Germany). Backups are encrypted.

Since 29 August 2026, Cloudflare has been the **only** sub-processor with a US nexus. Until that date, the AI processor was Google LLC (Gemini API, US) and it is now an EU party.

### AI processor (EU)

- Mistral AI SAS (French company; according to Mistral, in the EU by default), for the text of all AI functions (**LLM text generation**). For the assistant, what goes to Mistral is your question, up to five earlier turns, the passages found with their source address and what the assistant looks up for you, such as emails, tickets and invoices; for the mail helper, the sender, subject and text of the email. According to Mistral itself, data stays in the EU by default, but can temporarily go to sub-processors of Mistral per function. The embeddings (vectorisation) and the vector store run on our own infrastructure in Falkenstein (BAAI `bge-m3` via self-hosted Text-Embeddings-Inference + pgvector).

### Law

The GDPR and Dutch law apply to our processing and our agreements. Whether the Cybersecurity Act (the Dutch implementation of NIS2) applies to your organisation depends on your sector and size.

## Supply Chain Transparency

### Infrastructure Partners

| Partner Type | Jurisdiction | Function |
|--------------|-------------|---------|
| Data centre | Falkenstein, Germany (Hetzner Online GmbH) | Physical hosting on a dedicated server |
| Edge and DNS | US (Cloudflare, Inc.) | DNS, CDN, DDoS protection, TLS at the edge |
| Software | Open source | Platform components such as PostgreSQL, Stalwart and Zitadel |

## Technical Measures

### Encryption

| Data State | Method | Explanation |
|------------|---------|-------------|
| In Transit | TLS 1.2 or higher, TLS 1.3 is supported | At the edge, Cloudflare terminates the TLS connection |
| Backup | Backups are in the Hetzner data centre in Falkenstein (Germany). Backups are encrypted | |

### Access control

- Signing in via one Noveu login (OpenID Connect)
- MFA (TOTP) and passkeys are available
- The audit log per organisation can be exported as CSV
- Principle of least privilege, via roles per organisation

### Transparency

- Open source components where possible
- Transparent subprocessor list, current at /juridisch/sub-verwerkers

## Subprocessors

### Approved Subprocessors

This is the complete list of approved subprocessors. The same parties
are in the legal overview at
[the sub-processors page](https://noveu.eu/en/legal/sub-processors).

| Subprocessor | Establishment | Processing location | Service | Data Access | Safeguard |
|--------------|-----------|--------------------|--------|--------------|----------|
| Hetzner Online GmbH | Germany (EU) | Falkenstein (DE) | Hosting / compute / storage / backups | Backups are encrypted | GDPR: EU entity + DPA |
| Cloudflare, Inc. | US (EU entity available) | Worldwide network of Cloudflare | DNS, CDN, DDoS mitigation, edge, Cloudflare Tunnel | IP addresses, metadata, TLS termination at the edge | EU-US DPF + SCCs + DPA |
| Stripe Payments Europe Ltd. | Ireland (EU) | EU | Payment processing (card, iDEAL, SEPA) | Billing, company and payment data | GDPR: EU entity + DPA |
| Mistral AI SAS | France (EU) | EU (according to Mistral, by default) | AI support, **only LLM text generation** (the text of all AI functions). Embeddings run on-premise on our own EU infrastructure | For the assistant, the question, up to five earlier turns, the passages found with source address and what the assistant looks up (emails, tickets, invoices); for the mail helper, the sender, subject and text of the email | GDPR: EU entity + Mistral DPA + data minimisation/pseudonymisation |

Phased out as of 29 August 2026: Google LLC (Gemini API, US), replaced by
Mistral AI SAS. The announcement in accordance with DPA art. 6.3 is on
[the sub-processors page](https://noveu.eu/en/legal/sub-processors).

The external AI subprocessor (Mistral AI) is
used for LLM text generation, the text of all AI functions. The embeddings and the vector store
are self-hosted (BAAI `bge-m3` via self-hosted Text-Embeddings-Inference
+ pgvector, EU).
The legal
overview, with the explanation per
subprocessor, is on
[the sub-processors page](https://noveu.eu/en/legal/sub-processors)
and in the DPA (Data Processing Agreement).

### Change procedure

Changes to subprocessors:
1. Are announced at least 30 days in advance
2. Are then listed on [the sub-processors page](https://noveu.eu/en/legal/sub-processors)
3. Give you the option to object on reasoned grounds and, if necessary, terminate with a notice period of 30 days

## Government requests

### Procedure

For requests from governments:
1. We check whether the request has a valid legal basis
2. We provide no more than the request asks for
3. We inform the customer, unless the law prohibits this

## Auditing

### Customer Audit Right

Under article 10 of the data processing agreement, you may carry out an audit, or have one carried out, once per calendar year by an independent, qualified auditor under confidentiality, and additionally in the event of a data breach or an investigation by the supervisory authority.

### Available Documentation

- ISO 27001 certificate of the data centre (Hetzner Falkenstein)
- The public data centre description of Hetzner
- Technical and organisational measures on request

## Contact

**Privacy and data protection**: privacy@noveu.eu

**Dutch Data Protection Authority (Autoriteit Persoonsgegevens)**:
- Website: autoriteitpersoonsgegevens.nl
- For complaints about data processing