Verifiable
An EU company address is not EU hosting.
"EU-hosted" is easy to write. So this page doesn't say "EU" — it says who, what, where, with names, seats and the data center. If any claim here is wrong, that's a mistake we want thrown at us: support@memexa.ai.
The exit comes first
Before places: you can always leave. Every note, every document, the whole graph exports with one click as Markdown — complete, in a format every tool reads. The graph is an index, not a lock-in. A vendor who talks about the data center before the export has the order backwards.
The data center
Memexa runs on Scaleway in region fr-par, Paris — application servers, managed PostgreSQL and object storage (documents). All database connections run over a private network; the database has no public address. The operator is Scaleway SAS, a subsidiary of the Iliad group, France.
Subprocessors
The complete list — every company with seat and purpose. What isn't listed here doesn't get your data.
| Company | Seat | Purpose | Processing location |
|---|---|---|---|
| Scaleway SAS | Paris, France | Hosting: servers, managed PostgreSQL, object storage, transactional email | Data center fr-par (Paris) |
| Mistral AI SAS | Paris, France | AI processing: OCR, embeddings, distillation, audio transcription | EU (La Plateforme) |
| IONOS SE | Montabaur, Germany | Re-ranking of search hits (AI Model Hub) — receives text excerpts of candidates | Data center de-txl (Germany) |
| BunnyWay d.o.o. | Ljubljana, Slovenia | CDN and DNS — delivery of the web interface | EU edge locations |
| Sendinblue SAS (Brevo) | Paris, France | Inbound email capture (mail-to-brain feature) | EU |
| Armitage Labs OÜ (Creem) | Rotermanni tn 14, 10111 Tallinn, Estonia — registry code 16977866 | Payment processing and subscription management as merchant of record (paid plans only) | EU; US subcontractors under SCCs (creem.io/dpa) |
| Migadu-Mail GmbH | Appenzell Ausserrhoden, Switzerland | Email mailboxes (support@, privacy@) — inbound and outbound support mail | Servers at OVH (EU); Switzerland: EU adequacy decision |
| Langfuse GmbH | Berlin, Germany | Operational search telemetry (metrics and cost — never query text, never content) | EU (cloud region Frankfurt) |
| Plausible Insights OÜ | Tallinn, Estonia | Cookieless visitor stats — this marketing site only, not the app | EU |
Which AI models, from whom
Processing of your content runs on models from Mistral AI, Paris —
specifically mistral-ocr-latest for
OCR, mistral-embed for embeddings,
mistral-small for distillation and
voxtral-mini for audio
transcription. No US model provider sees your content. The language model you talk to (Claude,
ChatGPT, …) is brought by your own AI client — Memexa only hands it the sources. Re-ranking of search hits runs
on the IONOS AI Model Hub, data center de-txl in Germany — cross-encoder
Qwen3-VL-Reranker-8B. This step
used to run on Jina AI without an EU processing guarantee; since the switch, company seat and processing
location coincide, and every component processes in the EU.
Self-hosted instead of bought in
Error tracking runs on a self-hosted GlitchTip instance on our own Scaleway infrastructure — crash reports never leave our servers. This website's visitor stats are cookieless (Plausible, EU), and the app itself has none at all.
Keys that can do one thing only
Access keys follow the principle of least privilege: every system gets only the permissions it actually needs. Example: this website's automated deploy holds no account-wide CDN key — just a token that can do exactly one thing: purge this site's cache. The central keys themselves live in Scaleway's Secret Manager, not in external build systems.
Documents & reporting channels
- Data processing agreement (DPA) and technical-organizational measures (TOMs): on request via support@memexa.ai
- Details on processing, retention and your rights: privacy policy
- Report security issues: security.txt
- Provider identification: legal notice
We're bootstrapped, a team of two. Your subscriptions are the business model — not your data.