Legal
Subprocessors
Version 2026-06-14
This page lists the third parties ("subprocessors") that Revu Labs, the operator of the Stacklink service, uses to provide the Stacklink Cloud tier, together with each one's role, the region where data rests, the jurisdiction of the operator, and the cross-border transfer mechanism. It supplements our Privacy Policy.
EU-placed by default. We engineer Stacklink so that customer data rests and is processed inside the EU/EEA wherever we control the placement. Several providers below are operated by US-incorporated parent companies even though the data physically rests in the EU; we name those honestly and rely on their EU-region commitments, Standard Contractual Clauses (SCCs), and, where applicable, the EU–US Data Privacy Framework (DPF).
The Sovereign tier is EU-resident by construction (air-gapped / customer-hosted) and uses none of the third-party control-plane subprocessors below; the customer operates its own infrastructure and selects its own EU-resident model providers.
1. Infrastructure subprocessors
| Subprocessor | Purpose | Region (data at rest) | Operator jurisdiction | Transfer mechanism |
|---|---|---|---|---|
| Vercel | Edge / web + app hosting (Next.js SSR and edge functions). | fra1 — Frankfurt, Germany | Vercel Inc. (US-incorporated); infrastructure in DE | EU data residency; SCCs / EU–US DPF |
| Scaleway | Backend sidecar compute (harness, ingest, mcp-gateway, llm-proxy). | PAR1 — Paris, France | Scaleway SAS (France) | Intra-EU (France) |
| Supabase (on AWS) | Postgres database, authentication, and secret storage (documents, chat, org graph, auth PII, vault). | AWS eu-west-1 — Ireland | Supabase Inc. (US-incorporated) on AWS (US-incorporated); infrastructure in IE | EU data residency; SCCs in the respective DPAs |
| Cloudflare | DNS and edge network. | EU edge | Cloudflare Inc. (US-incorporated) | SCCs / EU–US DPF |
| LangChain (LangSmith) | Telemetry and traces (OTel spans, which can carry prompt/output text and redacted tool arguments). | LangSmith EU instance (eu.api.smith.langchain.com) | LangChain Inc. (US-incorporated) | EU data residency, US-operated control plane; SCCs |
2. Model and embedding providers
We default to EU-resident model and embedding providers. A workspace administrator may opt a workspace into other providers; where a chosen model transfers data outside the EU/EEA, we disclose that at the point of selection and record the workspace's consent before sending any data to it (see the Privacy Policy, International Transfers).
| Subprocessor | Purpose | Region (data at rest) | Operator jurisdiction | Transfer mechanism |
|---|---|---|---|---|
| Mistral La Plateforme | LLM inference and embedding inference (BYOK; Cloud default). | Paris, France | Mistral AI SAS (France) | Intra-EU (France) |
| Anthropic via Amazon Bedrock | LLM inference (Claude family) where a workspace selects it. | Bedrock eu-central-1 — Frankfurt, Germany | AWS (US-incorporated); infrastructure in DE | AWS EU data-residency contract; SCCs |
| Azure OpenAI | LLM inference (GPT family) where a workspace selects it. | Sweden Central / France Central / Switzerland North | Microsoft (US-incorporated); infrastructure in EU | Microsoft EU Data Boundary; SCCs |
| Aleph Alpha PhariaAI (Sovereign tier) | Sovereign EU LLM inference. | Heidelberg, Germany | Aleph Alpha (Germany) | Intra-EU (Germany); full air-gap option |
| OpenRouter (development tier only) | Model evaluation in non-production development workspaces. Disabled by default; an administrator must explicitly opt in. | United States | OpenRouter (US-incorporated) | Transfers data outside the EU — disclosed at selection, off in all production tiers |
3. Cookie and analytics sub-processors
On the marketing site (stacklink.nl) we use a small set of consent-gated cookie/tracker providers: Vercel Web Analytics and Vercel Speed Insights (Analytics category, EU processing) and the Cal.com scheduler on the cal.eu instance (Functional category, EU). These load only after you opt in. Their per-cookie detail is on the Cookie Policy.
4. Changes and notifications
We may add or replace subprocessors as the Services evolve. This page is versioned (see the version date above) and is the canonical public record. To be notified of changes before they take effect, email privacy@stacklink.nl with the subject "Subscribe: subprocessor changes", and we will add you to the notification list for material updates to this list.