Short version: your records stay in Frankfurt, your API requests are processed in Frankfurt, and every AI call — policy screening, the assistant, voice, document reading — runs on Mistral AI's EU regional endpoint. The device layer never leaves your device. Below is the exact map, including the two things that still cross the Atlantic: optional SMS and consent-gated website analytics.
Each row names the provider, the region and what we verified. Rows marked amber are the honest exceptions.
Audit chain, approvals, agent registry, conversations. Encrypted at rest; the signing key for the audit chain lives in the API environment, never in the database. Verified via the Supabase project settings.
Every /api/* request — approvals, audit writes, exports, voice turns — executes in Frankfurt. Before 14 October 2026 the functions ran in Vercel's default US region; we fixed that and verify it on every deploy (x-vercel-id must read fra1).
HTML, scripts and images are served from Vercel's global edge. No customer records pass through the edge; it terminates TLS and forwards API calls to Frankfurt.
Policy screening (moderation), the VINCHY assistant, voice (Voxtral speech-to-text and text-to-speech) and document reading (OCR) all call Mistral's EU regional endpoint, which Mistral commits to serve from infrastructure in EU and EFTA countries. Mistral's cloud subprocessors for that region, per its Trust Center: Microsoft Azure (Sweden, Norway), Google Cloud (Netherlands, Belgium), Mistral Compute (France), CoreWeave (EEA). Mistral acts as processor under its Data Processing Addendum with Zero Data Retention enabled for our organisation on all five endpoints we use (chat, moderation, OCR, speech-to-text, text-to-speech) — confirmed in writing by Mistral AI on 15 October 2026; request and response content is not stored after the request completes.
The policy gate and the evidence ledger for connected AI apps run as a local service on your device. Signed checkpoints are anchored into your Frankfurt audit chain; raw tool traffic never leaves the device.
Approval notifications, invitations and confirmation links are delivered through Resend from its EU region (Ireland, eu-west-1); the vinchy.ai sending domain is verified there. Resend is a US-headquartered company, so it stays on our sub-processor list and in the DPA; the email content itself is processed in the EU.
Used only when you enable SMS reminders for a recipient who confirmed by double opt-in. Phone number and message text are processed by Twilio.
Public marketing pages only, loaded solely after you click Accept. The application itself (vinchy.ai/app) carries no analytics.
Train models on your data. Move records outside the EU for processing. Keep a plaintext copy of your API keys. Let the browser talk to a third-party AI provider directly — every AI call goes through our Frankfurt functions.
Open any vinchy.ai page and read the x-vercel-id response header: it names the region that handled the request. Export your audit chain — every record is Ed25519-signed and verifiable offline; the public keys travel inside every export (signing_keys) and are shown in the app's audit view. Our sub-processor list with locations and transfer bases is public and dated; the DPA that references it is available from the team at hello@vinchy.ai.
In Frankfurt, Germany: Supabase on AWS region eu-central-1. API requests are processed in Frankfurt (Vercel fra1). AI inference runs on Mistral AI's EU regional endpoint in EU/EFTA data centres.
Records, API processing, AI inference and transactional email do not. Two things do, and we list them above: optional SMS (Twilio) and consent-gated analytics on the public website (Google Analytics). Account metadata at Mistral (API keys, billing) is handled by Mistral's control plane, which Mistral does not make regional.
Mistral AI is a French company headquartered in Paris. Its EU regional endpoint commits inference to EU/EFTA infrastructure; the underlying cloud capacity in that region is provided by Microsoft Azure (Sweden, Norway), Google Cloud (Netherlands, Belgium), Mistral Compute (France) and CoreWeave (EEA) — some of which are US-headquartered companies operating EU data centres. We name them because you would ask.
VINCHY never trains models on customer data. Mistral processes requests as a processor under its Data Processing Addendum; Zero Data Retention is enabled for our organisation on the EU endpoint (confirmed by Mistral AI on 15 October 2026) and pay-as-you-go API data is excluded from training under Mistral's Commercial Terms and Data Processing Addendum.
Data residency is one input to the deployer duties in Article 26 (human oversight, logging, documentation) — see our Article 26 page. The Digital Omnibus (Regulation (EU) 2026/1744) deferred the high-risk duties to 2 December 2027; Article 50 transparency has applied since 2 August 2026.
Yes. Our data processing agreement (AVV/DPA, Art. 28 GDPR) uses the public sub-processor list as its annex; request it at hello@vinchy.ai. Contracting party is SIGOO GmbH, the legal entity behind DreamSoft AI Studio (see the Legal Notice).
Human approval before risky actions, a signed audit chain in Frankfurt, AI inference in the EU — and a page that tells you where the exceptions are.
Create free account