Infrastructure, jurisdiction and government access

Pseudonymizer is a data processing service within the meaning of the Data Act (Regulation (EU) 2023/2854). Article 28 of that regulation requires us to state on our website the jurisdiction that applies to the ICT infrastructure we use to process your data, and the measures we take to prevent governments outside the EU from accessing data where EU law does not allow it. This page provides that information. We announce changes here and, for business customers, in accordance with article 6 of the data processing agreement.

Who provides the service

Litic B.V., trading as Litic AI, Uitbreidingstraat 84, 2600 Antwerp, Belgium, company number 0817.919.143, VAT number BE0817919143. We are subject to Belgian law and the law of the European Union, including the GDPR and the Data Act. Questions: privacy@litic.ai or +31 40 369 00 28.

Jurisdiction of the infrastructure

Your data is processed and stored within the European Union. We use the providers below; the list of sub-processors for document processing matches Annex 3 of the data processing agreement. For providers established outside the EU, the transfer mechanism under Chapter V of the GDPR is stated.

Component	Provider	Location of processing	Provider’s jurisdiction and transfer mechanism
Authentication, database and server functions	Supabase (Supabase Pte. Ltd)	Storage and primary processing in the EU region of our project	Singapore; EU standard contractual clauses (module 3) in Supabase’s data processing addendum
Hosting of the web application	Vercel	EU region Frankfurt; global network for static files (code and images, no document content)	United States; EU-US Data Privacy Framework (certified) and EU standard contractual clauses
Detection of personal data (AI)	OpenRouter and the AI provider selected via OpenRouter	Prompts and completions processed in Europe via eu.openrouter.ai (EU/EEA, United Kingdom or Switzerland), with zero data retention at the AI provider	United States; Litic AI’s account and operational data (authentication, security logs) may be processed in the US; adequacy decisions (UK, Switzerland) and EU standard contractual clauses
OCR of scanned documents	Mistral AI	EU (France)	France; no transfer
Protection against automated abuse at sign-up and sign-in	Cloudflare (Turnstile)	EU/global; technical browser and device data only, no document content	United States; EU standard contractual clauses and EU-US Data Privacy Framework
Payments and VAT calculation	Stripe	Stripe’s EU entity; account, billing and payment data only, no documents	Stripe group (Ireland and United States); EU standard contractual clauses and EU-US Data Privacy Framework
Order confirmation and withdrawal emails	Email service with processing within the EU	EU	EU provider

In summary, only the following may be processed outside the EU: Litic AI’s account and operational data at OpenRouter; requests for static files of the web application through a Vercel network location outside the EU; the technical verification data of Cloudflare Turnstile; and payment data within the Stripe group. Document content, legends and results stay within the EU, unless you yourself choose a recipient outside the EU (such as a dispatch to ChatGPT or Claude): that processing falls outside our infrastructure and under your agreement with that recipient.

Measures against government access from outside the EU

Minimal storage. We do not store documents you process through the web app: the replacement happens in your browser and the detection processes the text only during processing. Results of API and MCP requests and packages for large dispatches are deleted automatically after at most 24 hours. The legend never leaves the service in a dispatch.
Processing in the EU. Storage and primary processing take place in the EU at all providers. Where a provider is established outside the EU, the EU standard contractual clauses or the EU-US Data Privacy Framework apply. The standard contractual clauses oblige the provider to review a government request, to inform us where permitted and to challenge unlawful or overly broad requests.
Encryption. All traffic between you, the service and our providers is encrypted (TLS); stored data is encrypted at rest at our providers. Third-party access tokens (such as ChatGPT tokens) are stored encrypted (AES-256-GCM) with the key outside the database; API keys and access tokens of connected apps are stored only as irreversible hashes.
Policy on government requests. We disclose data only where a legal obligation under EU or Belgian law compels us to, or under a binding order of a competent court or authority in the EU. We honour a request from a government outside the EU only if it comes through a route recognised by EU law, such as an international mutual legal assistance treaty (Article 48 GDPR). We review every request for its legal basis and scope, we disclose no more than necessary, we challenge unlawful or disproportionate requests, and we inform the customer concerned before disclosure unless the law prohibits it, and then as soon as permitted afterwards. We record every request.
Access control and review. Access to production systems is limited to authorised staff with two-factor authentication; development and production environments are separated; security-relevant events are logged without document content; the service is reviewed for security periodically.
Transparency. The list of sub-processors and this page are public. We announce a new sub-processor or a relocation of processing in advance in accordance with article 6 of the data processing agreement, so that you can object.

More information

See the data processing agreement (Annex 2: technical and organisational measures; Annex 3: sub-processors) and the privacy policy. Switching to another service or your own environment is governed by article 13 of the terms of service.