DOC memo/sub-processors/v1.0UPDATED 2026-04-29REFERENCE GDPR ART. 28PUBLISHED
SUB-PROCESSOR REGISTER

Every processor.
Every jurisdiction.
Every contract.

The full list of third-party services that process personal data on behalf of Luminaria customers. Maintained per GDPR Article 28 requirements. Updated whenever the stack changes — every change is logged below.

Request DPASubscribe to changes
§ 01 · ACTIVE PROCESSORS

What we use.
Where it lives.

01
Clever Cloud
Compute · application hosting
Hosts the FastAPI backend that serves the Luminaria API and MCP server.
JURISDICTION
France
PROCESSING REGION
Paris
CONTRACT
SCC + DPA
View their DPA ↗
IN USE SINCE
2025-09
02
Mistral AI
AI inference & embeddings
Embedding generation (mistral-embed) and LLM inference for chat / context retrieval / insight extraction.
JURISDICTION
France
PROCESSING REGION
Paris
CONTRACT
SCC + DPA
View their DPA ↗
IN USE SINCE
2025-11
03
Neo4j Aura
Graph database (primary data store)
Stores all user session content, embeddings, atoms, insights, tags. Data never leaves the EU region.
JURISDICTION
Sweden (HQ) · EU hosting
PROCESSING REGION
GCP europe-west1, Belgium
CONTRACT
SCC + DPA
View their DPA ↗
IN USE SINCE
2025-09
04
Supabase
Authentication & user identity
Email/password and OAuth authentication. Stores user account records (email, hashed password, OAuth identifiers). No session content.
JURISDICTION
US (HQ) · EU data hosting
PROCESSING REGION
AWS eu-central-1, Frankfurt
CONTRACT
SCC + DPA
View their DPA ↗
IN USE SINCE
2025-09
05
Vercel
Frontend (edge CDN)
Serves the Next.js frontend (luminaria.so) from EU edge locations. No persistent user data.
JURISDICTION
US (HQ) · EU edge
PROCESSING REGION
EU edge nodes
CONTRACT
SCC + DPA
View their DPA ↗
IN USE SINCE
2025-09
06
Stripe
Payments (current)
Subscription billing, payment processing for Pro and Business tiers. Customer email + payment metadata only — no session content.
Migrating to Mollie for full EU-native billing.
JURISDICTION
Ireland · EU
PROCESSING REGION
EU
CONTRACT
SCC + DPA
View their DPA ↗
IN USE SINCE
2025-12
07
Mollie
Payments (target)
Replacement for Stripe. Same scope: subscription billing for Pro and Business tiers. EU-native by default.
JURISDICTION
Netherlands · EU
PROCESSING REGION
EU
CONTRACT
SCC + DPA · migration in progress
View their DPA ↗
IN USE SINCE
Migration scheduled post-funding
08
(Email provider TBD)
Transactional email (planned)
Will deliver account verification, password reset, billing emails, and DPA notifications. EU-resident provider to be selected post-funding.
JURISDICTION
EU only
PROCESSING REGION
EU-resident provider
CONTRACT
Not yet integrated
IN USE SINCE
Planned post-funding
§ 02 · CHANGE LOG

Every change to the register,
dated and logged.

Append-only log. Subscribe via the link above to receive an email whenever the register is updated.

2026-04-29

Document published. Resend (US-HQ transactional email) flagged for migration to EU-resident provider post-funding.

2026-04-15

Mollie added as planned payment processor. Stripe → Mollie migration scheduled for Q3 2026.

2025-12-01

Stripe added for subscription billing (Pro tier launch).

2025-11-15

Mistral AI replaced previous embedding provider for full EU-native AI stack.

2025-09-01

Initial register. Clever Cloud (compute), Neo4j Aura (DB), Supabase (auth), Vercel (frontend) on launch.

§ 03 · NOTES

What you should know.

US-HQ NOTE

Some HQs are US, but data residency is EU

Supabase, Vercel are US-incorporated companies, but Luminaria customer data is processed exclusively in their EU regions (Frankfurt, EU edge). All transfers governed by SCCs.

UPDATE POLICY

Subscribers notified before changes take effect

Material changes (new processor, region change, contract type change) are emailed to subscribers at least 30 days before going live. Object via reply within the notice window.

DPA REQUEST

Data Processing Agreement on request

Standard DPA available for any paid plan customer. Email doriana@luminaria.so to receive the current version (PDF + Word).