Privacy policy

Last updated 28 October 2026 · Applies to compliance.dazr.eu.

Translations of these documents are provided for convenience. In case of any difference between a translation and this English version, the English version prevails.

Who we are

Dazr, based in Italy. The controller contact for personal data we hold about you (as a workspace member, prospect, or visitor) is privacy@dazr.eu.

For personal data processed inside a customer workspace, the controller is the customer organisation that owns the workspace; we are the processor. If you are a workspace member and want to exercise data-subject rights over your workspace data, contact your workspace owner first; we'll route requests we receive to them.

What we process and why

Three buckets, in increasing order of how often we touch them:

1. Marketing site (compliance.dazr.eu, outside the /app portal)

If you read the marketing page, fill the Enterprise contact form, or subscribe to a newsletter, we process the following as controller:

• Contact form submissions: name, work email, company, role, team size, frameworks of interest, free-text message. Used to reply to your enquiry and to record the lead in our CRM. Legal basis: pre-contractual measures at your request (GDPR Art. 6(1)(b)) and our legitimate interest in selling our product (Art. 6(1)(f)).
• Newsletter: email address, only if you subscribe. Legal basis: consent (Art. 6(1)(a)). Withdraw any time via the unsubscribe link.
• Server logs: IP address (truncated and hashed within 24 hours), user-agent, requested URL, response code, timestamp. Used to operate and secure the website. Legal basis: legitimate interest. Retention: 30 days raw, then aggregate counters only.

The marketing site counts page views with Vercel Web Analytics, which sets no cookies and does not store IP addresses; we only see totals, such as how often a page was viewed. The ad landing pages and the sign-up that follows them also count page views, button clicks and sign-up steps as anonymous totals per page, ad source and country, without cookies and without storing anything on your device. Legal basis: our legitimate interest in knowing which pages people use (Art. 6(1)(f)). The site has no advertising pixels, no Google Analytics, no third-party trackers, and no cookies that aren't strictly necessary.

2. Account and billing for the platform

To let you sign in and pay, we process as controller:

• Member identity: email address (required), display name (optional), role within the workspace, the time you joined and last logged in. Legal basis: contract performance (Art. 6(1)(b)).
• Sign-in: you sign in with Google, Microsoft or a 6-digit one-time code sent to your email. With Google or Microsoft we receive your verified email address and, if available, your name, never your password. A one-time code is stored hashed for ten minutes, then deleted. Dazr stores no passwords.
• Session tokens: you sign in through Dazr Identity, whose cookie (__Secure-dazr_id) keeps you signed in. The portal also keeps its own session token, an HMAC-signed JWT valid for 30 days, in your browser's local storage. Server-side we keep only a session version per account and the tokens of sessions you signed out of, until they expire, so that sessions can be ended.
• Billing: for customers on a paid plan (Pro or Enterprise) we hold company legal name, billing email, VAT/tax id, invoice address, and the high-level state of your subscription (active, past_due, canceled, current period end). Card data never touches our servers; the payment processor, Mollie (see Sub-processors), holds it. Legal basis: contract performance and tax-law obligations (Art. 6(1)(b) and (c)).

3. Workspace content

Everything you put inside your workspace - control tasks, evidence notes and files, risks, incidents, vendors, the compliance profile, public-intake submissions, the activity log - we process as processor on behalf of your workspace's controller. We do not access this content for any purpose other than running the service for you, debugging at your request, or where we are legally compelled to.

Workspace content is never sent to an AI provider unless you, or your organisation’s administrator, turn on the optional AI assistant and connect an AI provider of your choice. In that case, the content a person asks the assistant to work on is sent, through Dazr’s AI gateway, to that provider, under your own agreement with that provider. Dazr does not store that content and never uses workspace content to train AI models. See Optional AI assistant below.

The DPA at /legal/dpa sets out the precise scope, the security measures, the sub-processor change procedure, and the safeguards for any access to data from outside the EU.

4. Optional AI assistant

Dazr’s apps, including Dazr Compliance, can offer an optional AI assistant. It is off by default and works only after it has been turned on and the AI terms accepted: by you, with your own account at an AI provider, or by the owner or an admin of your organisation, with the organisation’s account. The customer chooses the provider, for example Anthropic, OpenAI, Mistral or Google, or another service with a compatible interface, including one it runs itself.

• What is sent: only when a person asks the assistant to do something, the request and the workspace content it needs for it, such as the task, risk or document being worked on, and the results of the steps the assistant takes.
• How it travels: through Dazr’s AI gateway (aigateway.dazr.eu), which runs on our own server at Hetzner in Germany (see Sub-processors). The gateway adds the provider key, passes the request to the provider and the answer back, holds the content in memory only while it passes it on, and does not store or log it. This is part of our processing as processor, like the rest of the workspace content.
• The AI provider: engaged directly by you or your organisation, with your own key and under your own agreement with that provider; it is not a Dazr sub-processor, and Dazr gives it no instructions. You or your organisation are responsible for that agreement, for the provider’s terms, and for where it processes the content and how long it keeps it.
• The key: encrypted in the browser before it is sent and stored, encrypted, only on the AI gateway. It cannot be read back: Dazr shows only the provider, the last 4 characters and a fingerprint, to you, to admins and to Dazr staff alike, and uses the key only to send requests to its provider.
• What is logged: for each request, who made it, from which app, the model, the number of tokens, the estimated cost and the result. Never the text of requests or answers, and no IP addresses. These records are kept for 13 months.
• No training: Dazr never uses workspace content, requests or answers to train AI models. Whether the provider may do so depends on your agreement with it.
• Turning it off: a person can hide the assistant or remove their own key at any time in its settings; the owner and admins can turn it off for the organisation and remove its key. A removed key is deleted at once.

Who can see your workspace data

• Other workspace members at the role permission you've been given. Owners and admins can see everything; members can read tasks and complete the ones assigned to them.
• Auditors you invite through the time-boxed read-only auditor link. Their access carries an explicit start date and expiry, and an admin can revoke it at any time.
• Dazr operations staff, only via the support portal. The support portal is metadata-only by design: it shows workspace IDs, owner emails, tier, member counts, framework status, aggregate task / risk / incident counts, and activity-log event types. It does NOT show task content, evidence, comments, individual risks, individual incidents, or member activity. The privacy boundary is enforced in the API itself, not just the UI.
• Sub-processors we use to provide the service. The full list is at /legal/subprocessors.
• The AI provider you or your organisation choose, only if the optional AI assistant is turned on, and only for the content a person asks the assistant to work on (see Optional AI assistant).
• Authorities, only where we are legally compelled. We will challenge over-broad requests and will notify you unless prohibited by law.

Where data is stored

All application data, files and backups are stored on servers in the European Union, and every sub-processor processes them there (see Sub-processors). Vercel, Upstash and Namecheap are companies based in the United States; should one of them access personal data from outside the EU, the European Commission's Standard Contractual Clauses apply, as set out in the DPA. The AI provider of the optional AI assistant is not a sub-processor: where it processes content depends on the provider you or your organisation choose (see Optional AI assistant).

Workspace records are encrypted with AES-256-GCM by the application before they are stored, on top of the storage provider's own encryption. The keys are derived from a master key that is kept as a server secret, separate from the data, and can be rotated. Uploaded files (evidence, policy and profile documents, attachments to breach reports) are encrypted at rest by the storage provider and stored under random addresses that cannot be guessed; the portal hands them out only after checking your access. SBOM files in the Cyber Resilience Act module are also encrypted by the application. Transport is HTTPS only, with HSTS preloaded.

How long we keep things

Your rights

Under the GDPR you have the right to access, rectify, erase, restrict processing of, object to processing of, and port your personal data, and to lodge a complaint with a supervisory authority. To exercise these:

• For data we hold about you as controller (marketing, account, billing): email privacy@dazr.eu. We respond within 30 days.
• For data inside a workspace, contact your workspace owner. We will route requests we receive directly to them and assist them to respond.

The supervisory authority for our marketing operations is the Italian Garante per la Protezione dei Dati Personali (garanteprivacy.it). You can also complain to the supervisory authority where you live.

Cookies

The Dazr Compliance portal uses one first-party cookie to keep you signed in: the Dazr Identity cookie (__Secure-dazr_id). During a Google or Microsoft sign-in, a second one (__Host-dazr_sso) connects that sign-in to your browser for at most 10 minutes. A readable cookie, dazr_lang, remembers the language you picked on any Dazr site or app; it holds only the language code and lasts one year. The portal's session token is kept in your browser's local storage. There are no analytics cookies, no advertising cookies, and no third-party cookies. The marketing site uses no tracking cookies either.

Changes to this policy

If we change anything material, we update the date at the top and email workspace owners. Past versions are available on request.

Contact

• Privacy / GDPR matters: privacy@dazr.eu
• Security: security@dazr.eu
• Questions and plans: sales@dazr.eu