Updated 9 October 2026
This page publishes the information required by Article 28 of the Data Act (Regulation (EU) 2023/2854): the jurisdiction to which the infrastructure running the OptiSwift service is subject, and the measures taken against international governmental access to non-personal data held in the Union. Personal data is covered by the Data processing agreement and the list of sub-processors.
Where the service runs
| Component | Provider | Where the data is held | Provider’s jurisdiction |
|---|---|---|---|
| the database, authentication, file storage and server functions | Supabase Pte. Ltd., on Amazon Web Services, Inc. infrastructure | AWS region eu-west-1, Ireland; server functions may also run outside the European Economic Area | Singapore (Supabase Pte. Ltd.); United States (Supabase, Inc., Amazon Web Services, Inc.) |
| the www.optiswift.ro website and the account on the website | Vercel Inc. | the Vercel network; the website does not hold the program’s data | United States |
| emails sent by the program | Plus Five Five, Inc. (Resend) | United States | United States |
| the assistant in the program | OpenAI Ireland Ltd. | OpenAI’s global configuration; processing may take place outside the European Economic Area | Ireland; the OpenAI group is headquartered in the United States |
| remote support, when the practice starts it | TeamViewer Germany GmbH | the European Economic Area, under TeamViewer’s agreement | Germany |
| the provider’s email mailboxes and the Proton Drive space through which the full export is delivered, encrypted | Proton AG | Switzerland | Switzerland |
| the language model in the provider’s development and maintenance tools, used only for administration operations and for importing data from the practice’s previous program | Anthropic Ireland, Limited | processing may take place outside the European Economic Area, including in the United States | Ireland; the Anthropic group is headquartered in the United States |
The practice’s data in the program is held in the database in Ireland. Because some of the providers above are established outside the Union, the law of their country (for example, United States law) may require them to give access to the data they process.
Measures against international governmental access
Technical. Data is encrypted in transit (TLS) and, at the hosting provider, at rest (AES-256). Each practice’s data is kept separate by row-level security. The assistant receives only the text of the question typed in, with no data from the database, and requests carry the instruction that the model provider must not retain them.
Organisational. Access to the practice’s data is reserved to authorised persons of OPTISWIFT S.R.L., solely for providing the service.
Contractual. OPTISWIFT S.R.L. has entered into the data processing agreement that each provider publishes, which obliges the provider to process the data only for providing the service. OPTISWIFT S.R.L. does not voluntarily disclose the practice’s data to an authority of a third country. If it receives such a request, it assesses it against Union law and Romanian law, challenges it where it has no legal basis, discloses only the minimum required and notifies the practice, unless the law prohibits this.