Addrova

GDPR-compliant geocoding API: what to check

"GDPR-compliant" is not a property an API can simply have. Compliance is a property of how you use it. What an API can do is make compliance easier or harder. This page lists what to check, in order of importance, and where Addrova stands. It is general information, not legal advice. See also GDPR and geocoding.

The six things to check

  1. Where the data is processed, including by sub-processors. Processing inside the EU avoids a transfer assessment; processing elsewhere needs a legal basis for the transfer (GDPR, Chapter V).
  2. What is logged. A query logged in clear text is a copy of personal data you did not plan for.
  3. How long it is kept, and whether you can delete it yourself.
  4. Whether your queries are reused, for example to train models or improve the index.
  5. A data processing agreement (DPA) with the list of sub-processors, signed before the first request (GDPR, Article 28).
  6. Whether you may store the results, and for how long. A result you cannot keep forces you to call again, and to send the same addresses again.

What Addrova claims, and how it is checked

Addrova states its logging behaviour as numbered claims, each with the automated test that checks it. The ones that answer the questions above:

Question Claim
What is logged? One access line per request with a fixed list of fields; no IP address, no user agent, no key (ZL-01). The only other log messages are listed (ZL-02).
Are addresses logged? No address, coordinate or key in any log, on any route, including errors (ZL-10).
How long is it kept? The database holds no request and no result (ZL-21). Batch input is deleted after processing; results after one hour by default, or at once on DELETE (ZL-22).
Is it reused? No result cache (ZL-31) and no external call for the repair fallback (ZL-30), so there is nothing stored to reuse.

The full table with test names is on the compliance page.

What is not proven yet

  • Hosting location. The tests prove what the application does, not where the servers are. EU-only hosting is to be confirmed and documented. [À VÉRIFIER]
  • The DPA and the sub-processor list. To be published, with online signature, before launch. [À VÉRIFIER]
  • The network edge. A proxy in front of the API must not log URLs; that is infrastructure. Prefer POST, so that addresses are not in URLs.

Storing the results

Addrova allows permanent storage of results, with attribution of the sources. See store geocoding results legally.

Questions to ask any provider

  • Can I see, claim by claim, how your logging is verified?
  • Where do your sub-processors run?
  • Can I delete a batch job myself, right now?
  • Do you reuse my queries, and can I see that in your DPA?

FAQ

Is a US-hosted API unusable under the GDPR? No, but it needs a transfer mechanism and an assessment. EU hosting removes that step.

Does "zero log" make me compliant? No. It removes one copy of the data. You still need a legal basis, a DPA and a retention policy of your own.