Independent AI agent for EU Deforestation Regulation compliance, not affiliated with the EU. Scope & disclaimer →

last_updated: 2026-05-17
change_notice_period_days: 30
notify: avijeet@vortx.ai

Sub-processors

Last reviewed 2026-05-17. Served live at /legal/subprocessors.

This page lists every sub-processor that may handle personal data for the hosted eudr.dev instance under Art. 28(2) and 28(4) GDPR. The Customer's signature on the Data Processing Agreement (/legal/dpa) constitutes prior general written authorisation for the entries below. Changes are notified at least 30 days in advance to the address on file and to avijeet@vortx.ai subscribers.

Active sub-processors

Sub-processor	Service	Region	Lawful-basis route	Notes
Amazon Web Services EMEA SARL	Compute, primary data store	`eu-central-1` (Frankfurt, Germany)	Art. 28 GDPR; processing inside the Union; AWS EU Data Processing Addendum and EU SCCs (Decision (EU) 2021/914) in place for any incidental support access from outside the EEA.	Encryption at rest via KMS; TLS in transit.
Amazon Web Services EMEA SARL (SES)	Transactional email (magic-link sign-in, account notifications)	`eu-north-1` (Stockholm, Sweden)	Art. 28 GDPR; processing inside the Union.	Outbound mail only; recipient address + message body for the sign-in flow. Region changed from `eu-west-1` (Dublin) on 2026-05-19 to keep the SES processing region alongside compute inside the EU/EEA.
Amazon Web Services EMEA SARL (Lambda — SES bounce handler)	SES bounce/complaint webhook processing (via SNS subscription)	`eu-north-1` (Stockholm, Sweden)	Art. 28 GDPR; processing inside the Union.	Receives SES bounce + complaint notifications via SNS topic; adds the offending recipient to the SES account-level suppression list via `PutSuppressedDestination`. No message content processed — only bounce metadata.
Vortx AI Private Limited (`emem.dev`)	Satellite-derived signal lookup (deforestation, ecosystem, legality features)	India / global responders	Art. 6(1)(c) GDPR read with Art. 49(1)(d) GDPR — important reasons of public interest (Union deforestation law). Data restricted to plot geometry, HS code, country, quantity; no operator or supplier identity sent.	Same corporate group as the Processor.
x402 facilitator	Agent-to-agent crypto settlement (optional)	Per-deployer choice; varies by selected facilitator	Art. 28 GDPR where the facilitator is inside the Union or under an adequacy decision; otherwise EU SCCs (Decision (EU) 2021/914) or Art. 49(1)(b) (necessary for the performance of a contract) as applicable.	Engaged only where the Customer enables x402; the specific facilitator is named in the deployment configuration.
Google Ireland Limited	Analytics (Google Analytics 4 — aggregate dashboard usage)	EU/EEA collection endpoints; onward transfer to Google LLC (United States) under the EU-US Data Privacy Framework (adequacy decision of 10 July 2023).	Art. 28 GDPR; loaded only after the visitor clicks "Accept analytics" on the consent banner; no analytics cookies are set on rejection. Consent Mode v2 signals are emitted; IP anonymisation enabled. The Customer's signed-in session and any submitted shipment data never reach Google.	The Customer may withdraw consent at any time via the "Manage cookies" link in the footer. See Google's sub-processor list at `https://business.safety.google/subprocessors/`.

Independent controllers

The following parties act as independent controllers for data they receive directly from the operator (or the operator's buyer) and are not sub-processors of eudr.dev. They are listed here for transparency.

Party	Role	Region	Notes
PayPal (Europe) S.à r.l. et Cie, S.C.A.	Payment processor for buyer-side card / PayPal transactions	22-24 Boulevard Royal, L-2449 Luxembourg	Acts as an independent data controller for the buyer's payment data per the PayPal Privacy Statement. The engine receives only a vault token id and the transaction outcome.
TRACES NT (DG ENV, European Commission)	Recipient of the filed Due Diligence Statement	Brussels, Belgium	Acts as a controller for any DDS submitted by the operator through TRACES. The engine only generates the artefact; the operator initiates the submission.

Change-notice procedure

New or replacing sub-processors are announced at least 30 days before processing begins.
Notification channels: this page, and email to avijeet@vortx.ai subscribers and to the address on the Customer's account.
The Customer may object on data-protection grounds within the notice period under the terms of the DPA.

Discontinued sub-processors

None as of the date above.

Inbound data-source connectors

Inbound connectors (CSV upload, GS1 EPCIS 2.0) accept operator-side data into the engine. They do not transfer data to any new recipient and therefore do not introduce a new sub-processor under Art. 28(2) GDPR (no new sub-processor without prior authorisation). The ERP adapters listed as "planned" in the connector catalogue each carry their own outbound flow and will be added to the table above, with the 30-day prior-authorisation notice, before they go live.

Server-side reference-data fetches (not sub-processors)

For full transparency, the engine fetches the following public reference data from third-party servers server-side, with no operator personal data attached and no operator IP forwarded. Because no personal data is shared, these parties are not sub-processors under Art. 28 GDPR, but they are listed here so the data flow is auditable end-to-end:

Source	What we fetch	Why	Operator data sent
OpenStreetMap tile servers (`tile.openstreetmap.org`)	OSM Standard raster map tiles for the intake-form basemap	Visual context so the operator can orient themselves before drawing a plot polygon	None. Tiles are addressed by `(z, x, y)` and fetched by our origin server, then proxied to the browser through `/api/basemap/osm/`. The operator's IP never reaches the OSM Foundation.

Map tiles are cached aggressively in our origin (in-process LRU, 2048 entries) and via cache-control: public, max-age=2592000 on the response so the browser caches too. The User-Agent on the outbound fetch identifies this deployment per the OSM Tile Usage Policy.