Your compliance data stays in Europe.

All EuroComply workspace data — compliance records, AI outputs, ROPA entries, DPIA documents, vendor registers, and user account data — is stored in Supabase's Frankfurt, Germany data centre (AWS eu-central-1 region). The application layer runs on Vercel's EU deployment region. AI inference for EU users is routed through Mistral AI (France).

EuroComply's key sub-processors are: Supabase Inc. (database and authentication, Frankfurt data centre); Vercel Inc. (application hosting, EU region); and Mistral AI SAS (AI model inference, France). A current sub-processor list is available on request at hello@eurocomply.app. EuroComply does not use US-based sub-processors for primary workspace data processing.

EuroComply is independently operated from Porto, Portugal, trading as Brevio Ventures, which acts as data controller. We process personal data under GDPR Article 6(1)(b) (performance of contract) and Article 6(1)(f) (legitimate interests) for product operation, and with explicit consent for marketing. Technical and organisational security measures are implemented per GDPR Article 32. Data Processing Agreements are available on request for business customers. Supervisory authority: Comissão Nacional de Proteção de Dados (CNPD), Portugal.

Data at rest is encrypted using AES-256 on all Supabase-managed storage including database volumes and backups. All data in transit is encrypted via TLS 1.2 or higher — HTTP connections are redirected to HTTPS at the CDN layer. Authentication uses RS256-signed JWTs with short expiry and refresh token rotation. Database connection strings, API keys, and service credentials are stored as encrypted environment variables and never exposed in client-side code.

EuroComply assesses potential personal data breaches within 24 hours of detection. Where a breach is likely to result in risk to individuals, we notify the competent supervisory authority (CNPD) within 72 hours per GDPR Article 33, including the nature of the breach, approximate number of affected data subjects, likely consequences, and measures taken. Where a breach is likely to result in high risk to individuals, we notify affected data subjects directly per GDPR Article 34. Post-incident reviews are documented and material incidents are disclosed.

Yes. A standard Data Processing Agreement is available for Starter, Pro, and Team plan subscribers. The DPA covers Article 28 GDPR requirements: the subject-matter and duration of processing; the nature and purpose of processing; the type of personal data and categories of data subjects; EuroComply's processor obligations including security, sub-processor management, data subject rights assistance, and breach notification. To request a DPA, email hello@eurocomply.app with your account email address.

Report suspected security vulnerabilities via email to hello@eurocomply.app with the subject line [SECURITY]. Include a description of the potential issue, steps to reproduce if possible, and your contact details. We acknowledge security reports within one business day and aim to assess and respond to confirmed vulnerabilities within 5 business days. We do not operate a bug bounty programme but appreciate responsible disclosure.