1. Introduction
In accordance with article 28 of the General Data Protection Regulation (GDPR), Evora openly publishes the list of every technical sub-processor it uses to process its users' personal data.
Each sub-processor was chosen after a thorough review of its GDPR compliance, its security certifications and where it processes data. All are bound to Evora by a data processing agreement (DPA) requiring compliance with the applicable European rules.
This page is also the notice mechanism set out in the DPA signed by every organiser: any change to this list is notified 30 days before it takes effect (see the Changes section).
2. List of sub-processors
As of October 12, 2026, Evora relies on 15 technical sub-processors:
| Sub-processor | Role | Data location | GDPR safeguards |
|---|---|---|---|
| Supabase Inc. | PostgreSQL database hosting, authentication, file storage, serverless functions (Edge Functions). | EU-Central-1 (Frankfurt, Germany) — primary region for European data. | Supabase DPA + EU Commission Standard Contractual Clauses 2021/914. |
| Vercel Inc. | Hosting of the evora.live website and delivery through a global CDN. | United States (headquarters) + global CDN (close to the user). | Vercel DPA + EU Commission Standard Contractual Clauses. |
| Apple Inc. | App distribution through the App Store. Delivery of push notifications through APNs (Apple Push Notification service). | United States + global CDN. | Apple Developer Program License Agreement + Privacy Policy + Standard Contractual Clauses. |
| Google LLC | App distribution through the Play Store. Delivery of push notifications through FCM (Firebase Cloud Messaging). Google Sign-In OAuth. | United States + global infrastructure. | Google Cloud DPA + EU Commission Standard Contractual Clauses. |
| Stripe Inc. | Card payment processing for organisation subscriptions, one-off purchases (events, Evora+) and ticketing. Storage of receipts and invoices. | United States (headquarters) + EU (Ireland). | Stripe DPA + Standard Contractual Clauses + PCI-DSS Level 1 certification. |
| Brevo SA (anciennement Sendinblue) | Sending transactional emails (sign-up verification code, registration confirmations, notifications) and marketing emails (with consent). | France (primary data centre) + EU. | Brevo DPA + data stored solely in the EU. |
| PostHog Inc. | Product analytics and application error monitoring (anonymised stack traces, no personal data) to improve the app (only with analytics consent). | EU (Frankfurt, Germany) — PostHog Cloud EU instance (eu.posthog.com). | PostHog DPA + EU Commission Standard Contractual Clauses. |
| Mapbox Inc. | Base map, geocoding (address to coordinates) and place search for event pages. | United States. | Mapbox DPA + EU Commission Standard Contractual Clauses. |
| Expo (650 Industries, Inc.) | Push notification delivery (Expo Push Service): forwards the device token and the notification content to APNs (Apple) and FCM (Google). | United States. | Expo (650 Industries, Inc.) terms of service; DPA offered by Expo + EU Commission Standard Contractual Clauses. |
| Meta Platforms Ireland Ltd | Sign in with Facebook (OAuth): forwards the account identifier and email address on sign-up or sign-in. | EU (Ireland) + United States. | Meta Platform Terms + EU Commission Standard Contractual Clauses. |
| Cloudflare, Inc. | DNS for the evora.live domain and Zero Trust access control to the administration interface (administrator authentication). | United States + global network. | Cloudflare DPA + EU Commission Standard Contractual Clauses. |
| GitHub, Inc. | Source code hosting and continuous integration (GitHub Actions): tests, deployments and scheduled data import jobs. | United States. | GitHub DPA + EU Commission Standard Contractual Clauses. |
| Anthropic PBC | Automated moderation of published content (analysis of images and texts to detect illegal or inappropriate content) and support for aggregate statistical analysis (internal dashboard forecasts). Content hidden automatically is reported to its author with the reason; an appeal is reviewed by a human. | United States. | Anthropic Commercial Terms + DPA with the “zero data retention” option (content is neither stored nor used for training) + EU Commission Standard Contractual Clauses. |
| N8N | Self-hosted automation workflows (scheduled emails, day-before reminders, 30-day delayed deletion, GDPR export, sub-processor notices). | OVHcloud France (Evora's dedicated VPS, sovereign infrastructure). | Self-hosted — no data leaves Evora's own infrastructure. Data stays in France. |
| OVHcloud | Hosting of the VPS running N8N and Evora's internal services. | France (Roubaix, Strasbourg and Gravelines data centres, depending on redundancy). | OVHcloud DPA + data stored solely in France. |
3. Changes and notice
Evora may add, replace or remove a sub-processor at any time, subject to the following conditions:
- Notice 30 days before the change takes effect, by email to every organiser and by publishing a new version of this page;
- Previous versions of this page are kept and available from the DPO on request;
- A right to object for the organiser within 30 days, by email to [email protected], on reasonable grounds. Failing an amicable agreement, the organiser may cancel their subscription free of charge.
Users who are not organisers are informed of changes through the Privacy Policy and, for material changes, by an in-app notification.
4. Common safeguards
Every sub-processor listed above is bound by the following contractual obligations towards Evora:
- processing data only on Evora's documented instructions;
- confidentiality of the people authorised to process the data;
- technical and organisational security measures meeting article 32 GDPR;
- transfers outside the EU framed by EU Commission Standard Contractual Clauses (Decision 2021/914);
- notifying Evora without undue delay in the event of a data breach;
- helping Evora give effect to data subjects' rights;
- deleting or returning the data when the processing agreement ends;
- making available all information needed to demonstrate GDPR compliance (audits, certifications, SOC 2 / ISO 27001 reports where available).
For any question about sub-processors, or to obtain a copy of a specific DPA, contact the DPO at [email protected].