Pareo is your processor under Art. 28 GDPR. These companies process data on Pareo's behalf. Last updated: 24 September 2026.
Infrastructure#
| Subprocessor | Purpose | Location | Data |
|---|---|---|---|
| Google Ireland Limited (Google Cloud) | Hosting, database, file storage, backups, logs | Belgium, europe-west1 | All data stored in Pareo |
Google's CDN caches Pareo's own app files (scripts, styles, images) worldwide. These files contain no customer data.
Language models#
| Subprocessor | Purpose | Location | Data |
|---|---|---|---|
| Amazon Web Services EMEA SARL (Amazon Bedrock) | Language models | EU regions of AWS | Document content, product and supplier data, correspondence |
| Google Ireland Limited (Vertex AI) | Text analysis for search | Belgium, europe-west1 | Document content, product and supplier data, correspondence |
The two providers are fixed in code, and both process data in the EU only.
Email#
| Subprocessor | Purpose | Location | Data |
|---|---|---|---|
| Amazon Web Services EMEA SARL (Amazon SES) | Inbound and outbound email | Ireland, eu-west-1 | Message content, attachments, sender and recipient addresses |
A received message is kept for seven days in an encrypted storage bucket in the same region, then deleted.
Reference lookups#
| Service | Purpose | Location | Data |
|---|---|---|---|
| National Center for Biotechnology Information, NIH (PubChem) | Find the CAS number of a substance | USA | Chemical substance names |
| Brave Software, Inc. (Brave Search) | Web search, optional | USA | Search queries. Only if your organisation adds its own API key. |
Neither service receives personal data.
Other services#
These services receive no customer data and are not subprocessors.
- European Chemicals Agency (ECHA): Pareo downloads the REACH candidate list. No data is sent.
- Have I Been Pwned: Pareo checks new passwords with k-anonymity. Only the first 5 characters of a SHA-1 hash are sent.