A sub-processor is a third party Toevan engages to help process data on behalf of our customers under our Data Processing Agreement. This page lists them, what each one does, the categories of data it handles, where it is located, and its current status. We keep it current and give advance notice before adding or replacing one (see Changes and subscribing, below).
The distinction that matters most for a code-governance product is where your source code goes. The short answer: deterministic analysis keeps your source code inside our EU boundary, its only outbound lookups are dependency checks that send package names and versions (never source code) to the public services listed below, and the only things that can carry code-derived context to a third party are optional AI features (fix generation, the AI agents that read your code, the architecture assistant and chat, and, depending on configuration, code embeddings), and, with EU routing enforced by default, Toevan sends that context only to Mistral AI in the EU, or to your own AI provider if you configure one. The full statement is on the Security page and in the DPA data-flow schedule.
Providers that process Toevan's own controller data rather than customer code (the email, scheduling, and billing tools behind the marketing site and accounts) are not customer sub-processors; they are listed in the Privacy Policy instead.
Sub-processors we use
These are the third parties that process customer product data on our behalf, or are contracted to. Location is where the data sits; status is Live unless noted.
- Hetzner (Helsinki, EU). Status: Live. Compute and hosting for the application, Postgres, Neo4j, and the append-only evidence store. Handles all product and customer data, including source code processed transiently.
- Cloudflare (EU configuration). Status: Live. CDN, DNS, Pages, R2 object storage, and Tunnel. Handles site traffic metadata and stored objects, and sets no cookies. Product analytics is a self-hosted, cookieless Umami instance in our own boundary, so it is not a sub-processor.
- Mistral AI (EU, through Mistral's EU regional endpoint). Status: Live. The EU route for every code-carrying AI call: fix generation, including fix suggestions on pull requests, the AI agents that read your code, and the architecture assistant and chat. It receives the per-violation code context for a requested fix, the files an AI agent reads for its task, and retrieved symbol identifiers for the assistant and chat; none receives your whole repository. Processing is under a zero-data-retention agreement. EU routing is enforced by default: a code-carrying call goes here, or to your own provider key if you configured one, and fails closed, with no fallback to a provider outside the EU. Mistral may serve a third-party open-weight model on this same EU infrastructure; that model's author receives no data from Toevan and is not a sub-processor.
- Object storage (S3-compatible, operator-configured region). Status: Live. Stores project file bytes and evidence and report export ZIPs. Handles source file bytes and generated evidence and report exports.
- Public vulnerability database and package registries (dependency lookups) (OSV.dev, the npm registry, pub.dev, the Python Package Index, and the Go module proxy, checksum database and pkg.go.dev; United States). Status: Live. Vulnerability and license checks of your dependencies, and lock-file regeneration and build validation for fixes you request. The Python Package Index is contacted only when Toevan validates the build of a Python project. These receive the name and version of a dependency; never your source code or file contents. Toevan filters the private names it can identify (dependencies under the repository's own GitHub owner, names matching the platform's private patterns, dependencies from a private registry named in the repository's configuration, git, path and local dependencies, and Go module paths with no domain) and does not send them; those dependencies are reported as not checked against public advisories. A private package that Toevan cannot identify as private is still looked up by name and version. The full statement is on the Security page.
- OpenRouter (United States, routing to Anthropic Claude models). Status: Standby. Contracted, but it receives no customer code or code-derived context while EU routing is enforced, which is the production default: Toevan's transport boundary lets platform AI calls reach only the configured EU endpoints. Code embeddings run on an in-boundary EU model, and the fallback that would send embedded symbol text here is refused under the same enforcement. It would carry code-derived context again only if that enforcement were switched off.
Planned sub-processors
None at the moment. When we plan to add or replace a sub-processor, it is listed here first, and we give advance notice as set out below.
Not sub-processors: self-hosted infrastructure
Some functions that vendors commonly outsource, we keep inside our own EU boundary rather than hand to a third party, so there is no sub-processor to list.
- Error and product monitoring. There is no external error-tracking or analytics vendor. Errors are reported to a self-hosted Bugsink collector, and product analytics to a self-hosted, cookieless Umami instance, both on our own Hetzner EU infrastructure, with before-send scrubbing of source, personal data, and secrets before events are recorded. Neither is a sub-processor because both run inside our own boundary.
Not sub-processors: customer-directed integrations
The following are connected by you, the customer, and governed by your own agreements with those providers. Toevan does not sub-process data to them; we act on your instructions to send data to a destination you chose and control.
- GitHub (source of record, and the authentication and identity provider: you sign in with your own GitHub account), Slack, Jira, Linear, and Kosli. Data flows to these because you connected them; they are your sub-processors, not ours.
- The Sigstore Rekor public transparency log (built in and opt-in per organisation; only record hashes are published). When you opt in, Rekor receives hash-only entries: the existence of an attestation, never your code or any personal data. It is a public log you choose to write to, not a Toevan sub-processor.
Changes and subscribing
Before we add or replace a sub-processor, we give advance notice and you may object, as set out in the DPA. Email is the notice channel.
To be notified of changes to this list, email [email protected] with the subject line Subscribe to sub-processor change notices. An RSS feed of this changelog is planned as an additional convenience.
The version, the Last updated date, and the full changelog below are the authoritative record of what changed and when.
Changelog
- v1.0.0
Initial draft, scoped to the Article 28 customer-data chain: live product sub-processors (Hetzner, Cloudflare, OpenRouter, object storage, OSV.dev and package registries), the planned Mistral EU sensitive-AI route, self-hosted error monitoring being implemented (not a sub-processor), the customer-directed-integrations carve-out (GitHub as source and identity provider, Slack, Jira, Linear, Kosli, Rekor), and an email subscribe channel. The controller-data email, scheduling, and billing processors moved to the Privacy Policy, where Toevan is the controller.
- v1.1.0
Mistral AI moves from Planned to Live as the EU route for every code-carrying AI call, through Mistral's EU regional endpoint under a zero-data-retention agreement, with EU routing enforced by default so a call fails closed rather than leaving the EU. OpenRouter moves to Standby: still contracted, it receives no customer code or code-derived context while that enforcement is on. The AI agents that read your code are now listed among the code-carrying features. The pinned model name is dropped, because Mistral retires models on its own schedule. No sub-processor is planned at the moment.
- v1.2.0
The entry for OSV.dev and the public package registries is corrected and renamed. It now names every service that receives dependency names and versions (OSV.dev, the npm registry, pub.dev, the Python Package Index, and the Go module proxy, checksum database and pkg.go.dev), gives the United States as the location, and states that until private-name filtering ships the names of private dependencies are included. Source code is still never sent. The introduction no longer says deterministic analysis never leaves the EU boundary without mentioning these lookups.
- v1.3.0
The entry for OSV.dev and the public package registries now reflects private-name filtering. Toevan filters the private names it can identify before these lookups and reports skipped dependencies as not checked against public advisories. A private package that Toevan cannot identify is still looked up, so the entry no longer says that private names are included as a rule and does not say they never leave. Source code is still never sent. Counsel review required before this version is published as binding.
- v1.4.0
The Sigstore Rekor entry among customer-directed integrations describes anchoring as built in and opt-in per organisation, with only record hashes published; the earlier wording about its default state is removed. Nothing else changes. Counsel review required before this version is published as binding.