Six third parties touch VINCHY data today. Each one is listed here with what it does, which data it sees, where that happens and on what legal basis it may leave the EU. This page is the authoritative list referenced by our data processing agreement (AVV/DPA); when it changes, the date above changes with it.
Order follows the data flow: storage, API, AI, email, SMS, analytics. “Transfer basis” names what allows data to leave the EU where it does; “none required” means it does not leave.
| Provider | Purpose | Data categories | Location | Transfer basis |
|---|---|---|---|---|
| Supabase, Inc. San Francisco, USA · EU hosting | Database and storage (PostgreSQL) for all application records | Audit chain, approvals, agent registry, conversations, account data | Frankfurt am Main, Germany — AWS eu-central-1 | Hosting: none required (EU). Support access: EU Standard Contractual Clauses (Art. 46(2)(c) GDPR; Supabase DPA) |
| Vercel, Inc. San Francisco, USA · EU functions | Hosting: serverless API functions, static pages, TLS | Request data in transit; no records stored | Functions: Frankfurt (fra1). Static pages and TLS: nearest edge | Functions: none required (fra1). Edge delivery and support: EU-US Data Privacy Framework, alternatively Standard Contractual Clauses (Vercel DPA) |
| Mistral AI SAS Paris, France | AI inference: policy screening, assistant, voice (Voxtral STT/TTS), document reading (OCR) | Prompt text, audio clips, document images sent for one request | EU / EFTA data centres via regional endpoint api.eu.mistral.ai (Azure SE/NO, Google Cloud NL/BE, Mistral Compute FR, CoreWeave EEA) | None required; Mistral Data Processing Addendum; Zero Data Retention enabled for our organisation on all five endpoints (confirmed in writing 15 Oct 2026); API data excluded from training |
| Plus Five Five, Inc. (Resend) San Francisco, USA | Email delivery: approval notifications, invitations, confirmation links — and emails that agents send to third parties after approval | Recipient address, subject, email body | Sending via Ireland (region eu-west-1; sending domain vinchy.ai verified there). Message content, logs and account data are stored in the United States | EU-US Data Privacy Framework, alternatively Standard Contractual Clauses (Resend DPA) |
| Twilio, Inc. San Francisco, USA | SMS — reminders and messages that agents send to third parties after approval, only after the recipient’s double opt-in | Phone number, message text | United States | EU-US Data Privacy Framework, alternatively Standard Contractual Clauses (Twilio DPA) |
| Google Ireland Ltd. Dublin, Ireland (Google LLC, USA) | Website analytics (GA4) on public marketing pages only, loaded only after cookie consent; the application carries no analytics | Pseudonymous usage data, truncated IP | EU / United States | Consent (Art. 6(1)(a) GDPR); Google Ads Data Processing Terms incl. SCCs / DPF |
EU-US Data Privacy Framework status checked on 18 Oct 2026 (dataprivacyframework.gov): Vercel, Inc., Twilio Inc. and Plus Five Five, Inc. (Resend) active. Supabase is not certified; its support access rests on the Standard Contractual Clauses. If a certification lapses, that transfer rests on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).
Retired: OpenAI (voice preview) — removed 14 October 2026; no VINCHY data has been sent to OpenAI since.
Before a new sub-processor receives any customer data, this page is updated and the date at the top changes. Customers with a signed AVV are notified by email to their account address and may object within 30 days under the AVV. We do not add sub-processors silently.
Our data processing agreement (AVV, Art. 28 GDPR) with this list as its annex, the provider DPAs we rely on, and a dated PDF export of this page. Write to hallo@sigoo.de; the team that runs VINCHY answers, not a call centre.
VINCHY is built and operated by DreamSoft AI Studio, the AI studio of SIGOO GmbH — a German software and design house building systems for companies and public institutions since 2012. SIGOO GmbH is the legal entity and contracting party (see the Legal Notice). Data processing questions go to hallo@sigoo.de.
Because honesty beats a clean-looking list. Supabase, Vercel and Resend process VINCHY data inside the EU, but they are US-headquartered and their staff could in principle access systems for support. We name that and rely on their DPAs with Standard Contractual Clauses for exactly that case.
Records (database), server functions and AI inference stay in the EU. These leave it: email via Resend (message content, logs and account data are stored in the USA), SMS via Twilio (USA), consent-gated website analytics (GA4) and — for static pages and support only — Vercel’s edge network. The transfer basis for each is in the table above. See Where your data lives for the component map.
No. VINCHY never trains models on customer data. At Mistral AI Zero Data Retention is enabled for our organisation on the EU endpoint (confirmed in writing on 15 October 2026), the training opt-out is set, Labs models are disabled, and pay-as-you-go API data is excluded from training under Mistral's Commercial Terms. No other listed provider receives prompts or documents.
Yes. Request the AVV (Art. 28 GDPR) with this list as Annex 3 at hallo@sigoo.de. The dated version of this page is the binding list.
Request the data processing agreement with this list as its annex. We answer within two working days.
Request the AVV