Nordic USV AS uses the sub-processors below to deliver Kystdata.io and the website nordicusv.com. They are data processors: they process personal data on our behalf and on our instructions. The list shows what each of them does, where they process the data, when, and whether personal data leaves the EU/EEA.
Where personal data is transferred out of the EU/EEA, the transfer rests on a legal basis in GDPR chapter V: the EU-US Data Privacy Framework where the provider is certified, and otherwise the EU's standard contractual clauses, with supplementary measures where needed. The basis for each provider, and a copy of the clauses we have signed, are available on request to info@nordicusv.com.
| Sub-processor | What it does | Where data is processed | When | Leaves the EU/EEA? |
|---|---|---|---|---|
| Supabase, Inc. (USA) | Database, sign-in, file storage | EU (AWS eu-west-1, Ireland) | Always | No, the data is stored in the EU |
| Cloudflare, Inc. (USA) | Hosting and delivery of the application and the website, PDF and map rendering, database backups, bot checks (Turnstile) on the website forms | Global network; backups in Cloudflare R2 | Always | Yes, traffic can pass through points outside the EU/EEA |
| PostHog, Inc. (USA) | Product analytics, session replay (a reconstruction of what happens on your screen), error diagnostics, cookieless visitor statistics on the website | EU (Frankfurt, Germany) | Analytics and session replay in the platform only with your analytics cookie consent; error reports from our own servers, and visitor statistics and error reports from the website, always | No |
| Resend (Plus Five Five, Inc., USA) | Sending email from the platform (invitations, notifications, alerts) and from the website forms; sending the newsletter and storing its subscriber list | EU (AWS eu-west-1, Ireland) | When we send email to you, when you submit a form on the website, and for as long as you subscribe to the newsletter | No |
| Mistral AI (France) | Runs the AI model that answers AI requests (Mistral's own model, Mistral Large, on its own European infrastructure), and reads the text out of PDF documents laboratories and suppliers send us by email (OCR) so an order or a result can be matched to the right record. Content may be kept for up to 30 days for abuse monitoring and is not used to train models | EU | AI requests when your organization has turned on the AI features; OCR when we receive a laboratory or supplier document by email | No |
Integrations you choose
Integrations your organization connects itself, such as export to OneDrive or Amazon S3, send data to that provider under your organization's own agreement with it. They are recipients you have chosen, not our sub-processors.
Changes
We update this list when we add, replace or remove a sub-processor. We notify organization administrators at least 30 days before a new sub-processor starts processing personal data, and they can object on reasonable grounds within that period; see the data processing agreement. The version that applies, and from when, is shown at the top. Questions: email info@nordicusv.com.
Last reviewed: 25 October 2026.