last_updated: 2026-09-27
change_notice_period_days: 30
notify: avijeet@vortx.ai

Sub-processors

Last reviewed 2026-09-27. Served live at /legal/subprocessors.

This page lists every sub-processor that may handle personal data for the hosted eudr.dev instance under Art. 28(2) and 28(4) GDPR. The Customer's signature on the Data Processing Agreement (/legal/dpa) constitutes prior general written authorisation for the entries below. Changes are notified at least 30 days in advance to the address on file and to avijeet@vortx.ai subscribers.

Active sub-processors

Sub-processor	Service	Region	Lawful-basis route	Notes
Amazon Web Services EMEA SARL	Compute, primary data store	`eu-north-1` (Stockholm, Sweden)	Art. 28 GDPR; processing inside the Union; AWS EU Data Processing Addendum and EU SCCs (Decision (EU) 2021/914) in place for any incidental support access from outside the EEA.	Encryption at rest via KMS; TLS in transit.
Amazon Web Services EMEA SARL (SES)	Transactional email (magic-link sign-in, account notifications)	`eu-north-1` (Stockholm, Sweden)	Art. 28 GDPR; processing inside the Union.	Outbound mail only; recipient address + message body for the sign-in flow. Region changed from `eu-west-1` (Dublin) on 2026-05-19 to keep the SES processing region alongside compute inside the EU/EEA.
Amazon Web Services EMEA SARL (Lambda — SES bounce handler)	SES bounce/complaint webhook processing (via SNS subscription)	`eu-north-1` (Stockholm, Sweden)	Art. 28 GDPR; processing inside the Union.	Receives SES bounce + complaint notifications via SNS topic; adds the offending recipient to the SES account-level suppression list via `PutSuppressedDestination`. No message content processed — only bounce metadata.
Vortx AI Private Limited (`emem.dev`)	Satellite-derived signal lookup (deforestation, ecosystem, legality features)	India / global responders	Art. 6(1)(c) GDPR (EUDR due-diligence duty). Intra-entity remote processing — eudr.dev and emem.dev are operated by the same legal person (Vortx AI Private Limited), so per EDPB Guidelines 05/2021 this is not a Chapter V transfer and SCCs are structurally unavailable; Art. 49(1)(d) is retired as the transfer basis, retained only for completeness. See the Transfer impact assessment. Data restricted to plot geometry, HS code, country, quantity; no operator or supplier identity sent. Since 28 September 2026, when `EUDR_EMEM_DOCS` is on, also photos of residue lab reports and land records taken in those places on a visit form, for OCR and parsing (`lab_report_parse@1`, `land_record_parse@1`); a land record names its owner. No farm, farmer, organisation or price goes with the photo, and the signed reading is kept with the file. When an organisation turns on `share_ground_truth`, also field pairs (#189): gate crate counts and grades, the day a lot was weighed, at emem cell ids; no names, prices, farm, lot or organisation ids.	Same legal person as the Processor (Vortx AI Private Limited).
Vortx AI Private Limited (`geo.qa`)	Measuring banana photos (finger length, grade, colour stage, dark peel); since 27 September 2026	United States (Amazon Web Services `us-east-1`)	Same legal person as the Processor (Vortx AI Private Limited): intra-entity remote processing, as for emem.dev (see the Transfer impact assessment). The infrastructure provider, Amazon Web Services, Inc., participates in the EU-US Data Privacy Framework.	Only visit photos the farmer agreed to, with EXIF, XMP and comments stripped: pixels only, with no name, farm or organisation. Each reply carries an ed25519 receipt, checked on receipt against a pinned key. Switched by `EUDR_GEOQA_MEASURE`. Since 28 September 2026 also farm coordinates (a pin or a point in the field, with a photo's capture time for the photo check), with no name, farmer, organisation or price, for the trip pre-screen, the photo-against-field check and the distance to water; switched by `EUDR_GEOQA_PRESCREEN`. When an organisation turns on `share_ground_truth`, also the field pairs described for emem.dev (#189), read by geo.qa with its own token.
Google Ireland Limited	Analytics (Google Analytics 4 — aggregate dashboard usage)	EU/EEA collection endpoints; onward transfer to Google LLC (United States) under the EU-US Data Privacy Framework (adequacy decision of 10 July 2023).	Art. 28 GDPR; loaded only after the visitor clicks "Accept analytics" on the consent banner; no analytics cookies are set on rejection. Consent Mode v2 signals are emitted; IP anonymisation enabled. The Customer's signed-in session and any submitted shipment data never reach Google.	The Customer may withdraw consent at any time via the "Manage cookies" link in the footer. See Google's sub-processor list at `https://business.safety.google/subprocessors/`.

Independent controllers

The following parties act as independent controllers for data they receive directly from the operator (or the operator's buyer) and are not sub-processors of eudr.dev. They are listed here for transparency.

Party	Role	Region	Notes
Razorpay Payments Private Limited	Card, bank and UPI payments for buying credits	Bengaluru, India	Razorpay states it is the Data Fiduciary for the data a payer enters in its Checkout, under India's DPDP Act, 2023 (buyer privacy notice). The payer gives card and contact details to Razorpay directly; they never reach eudr.dev. eudr.dev sends it the amount, the currency and an organisation identifier. In use since 15 September 2026; this entry was missing until 27 September 2026.
TRACES NT (DG ENV, European Commission)	Recipient of the filed Due Diligence Statement	Brussels, Belgium	Acts as a controller for any DDS submitted by the operator through TRACES. The engine only generates the artefact; the operator initiates the submission.

Change-notice procedure

New or replacing sub-processors are announced at least 30 days before processing begins.
Notification channels: this page, and email to avijeet@vortx.ai subscribers and to the address on the Customer's account.
The Customer may object on data-protection grounds within the notice period under the terms of the DPA.

Discontinued sub-processors

None as of the date above.

Supported but not enabled on eudr.dev

The software can also settle through PayPal (Europe) S.à r.l. et Cie, S.C.A. (Luxembourg; an independent controller for the payer's data) and through an x402 facilitator (on-chain USDC). Neither is enabled on the hosted eudr.dev instance. Enabling one would add it to the tables above first, with the 30-day notice.

Inbound data-source connectors

Inbound connectors (CSV upload, GS1 EPCIS 2.0) accept operator-side data into the engine. They do not transfer data to any new recipient and therefore do not introduce a new sub-processor under Art. 28(2) GDPR (no new sub-processor without prior authorisation). The ERP adapters listed as "planned" in the connector catalogue each carry their own outbound flow and will be added to the table above, with the 30-day prior-authorisation notice, before they go live.

Server-side reference-data fetches (not sub-processors)

For full transparency, the engine fetches the following public reference data from third-party servers server-side, with no operator personal data attached and no operator IP forwarded. Because no personal data is shared, these parties are not sub-processors under Art. 28 GDPR, but they are listed here so the data flow is auditable end-to-end:

Source	What we fetch	Why	Operator data sent
OpenStreetMap tile servers (`tile.openstreetmap.org`)	OSM Standard raster map tiles for the intake-form basemap	Visual context so the operator can orient themselves before drawing a plot polygon	None. Tiles are addressed by `(z, x, y)` and fetched by our origin server, then proxied to the browser through `/api/basemap/osm/`. The operator's IP never reaches the OSM Foundation.

Map tiles are cached aggressively in our origin (in-process LRU, 2048 entries) and via cache-control: public, max-age=2592000 on the response so the browser caches too. The User-Agent on the outbound fetch identifies this deployment per the OSM Tile Usage Policy.

This page last changed on 2026-09-28. It describes the Regulation as it stood then; where a date or a code matters to a decision, check it against the EUR-Lex text it cites.