No subprocessor holds your data
Generated from the registry the engine enforces, so it cannot drift from what the code actually does.
Nothing we rely on sits with a third party. That is unusual and it is temporary, so it is worth saying why it is true today: the sanctions and restricted-party lists are downloaded and matched in process, which means the name of the company being checked is never sent to anybody. There is no screening vendor to list.
It also means one less set of controls between you and an answer, and one less report an auditor has to chase.
Planned, and what they must satisfy first
Two ports will each add one. They are listed before they exist, with the conditions attached, because the conditions are easier to hold to in public.
BACKUP
off-site backup is what a single machine in a single building requires. Encryption happens before deposit and the key stays in the office, so this is the one shape in which naming a third party here does not weaken the claim. Remote retention is a bucket lifecycle rule, not a script on the machine, so a compromise of the machine cannot shorten it
exposure if selected: NONE
MAILER
nothing in this system sends anything today; invitations and wallet links are returned once and delivered out of band. A mailer sees a mailbox AND a bearer credential, so it is judged as a party that could act on one, not as a marketing tool. Attestation and DPA are selection criteria before signature, not paperwork afterwards
exposure if selected: IDENTIFIERS
IDENTITY_DECLARANT
the assurance ladder already puts QUALIFIED above DOCUMENT_LIVENESS, and the qualified route is both higher assurance and available in France today — so it is the primary path rather than the unreachable ceiling. A QTSP is supervised by a national body against law, which is a stronger attestation than a vendor report. The EUDI Wallet is the same rung arriving cheaper (member-state deadline 24 Dec 2026) and becomes an adapter behind this same port. A document-and-liveness vendor stays available as the FALLBACK for declarants who cannot obtain a qualified signature — bought when that tail is measured, not before
exposure if selected: IDENTIFIERS
FINANCIAL
the VoP scheme semantics are implemented here; the transport is a provider. They see a legal name and an IBAN. Their own attestation and DPA are selection criteria, not paperwork to chase afterwards
exposure if selected: IDENTIFIERS
Sources we read, which are not subprocessors
Reading a public register or downloading a published sanctions list involves no contract and puts nothing of ours in anybody's custody. If the register is wrong the evidence is wrong — an accuracy question rather than a control question. Counting them here would put four governments inside our audit boundary and make the number above meaningless.
| Source | Read for | What we send them |
|---|---|---|
| DILA / API Entreprise (recherche-entreprises.api.gouv.fr) | REGISTRY | ENTITY_ONLY |
| European Commission — VIES | TAX | ENTITY_ONLY |
| trade.gov (US CSL) and the European Commission (EU FSF) | TRADE | nothing |
| none — parsed in process | DOCUMENTARY | IDENTIFIERS |
| Adesio SAS — its own equipment, on its own premises | HOSTING | IDENTIFIERS |
Boundary status: CLEAN · generated from the adapter registry at build time.