| Provider | Role and data | Location / status |
|---|---|---|
| Scaleway SAS | Compute, network, disks, object storage, backups, and the hosted runner fleet: control plane, data plane, Postgres, operational logs, Git WAL, blobs, LFS, artifacts, caches, and runner execution. | France; one EU region for compute, storage and bare metal. Passes the core ADR 0009 operator bar. |
| Scaleway SAS · Transactional Email | Recipient address and message required for magic links, OTP, email changes, and invitations. | France; EU service selected under ADR 0016. Passes the operator bar. |
| Mollie B.V. | Hosted payment checkout for organization billing: billing contact, transaction metadata, and payment instrument data submitted to Mollie. | Netherlands entity. Independent controller for payment transactions; Google Cloud Platform is disclosed for some Mollie products, so the strict ADR 0009 bar fails. |
Mollie review — 3 September 2026
The review checked Mollie’s DPA, User Agreement, Privacy Statement, and Legal page on 3 September 2026. Mollie’s current DPA names Google Cloud Platform for hosting or public-cloud infrastructure in the Disputes and Invoicing annexes, but does not establish a complete Mollie-wide IaaS inventory for the general payment service. Mollie’s Privacy Statement says third parties may process personal data outside the EEA when an appropriate transfer mechanism is used.
Under ADR 0009, Google Cloud Platform’s EU-region disclosure does not pass the ADR’s explicit US-hyperscaler exclusion, and the incomplete IaaS chain cannot be treated as positively confirmed. Pillion claims EU-operated and EU-resident handling only for the core Git and product-data path. Payment data is not marketed as EU-resident until a Mollie-wide infrastructure inventory and written residency/subprocessor commitments are obtained.
Self-operated software
MinIO is an optional self-operated storage adapter and is not a third-party operator when selected.
Questions or objections: info@pillion.dev.