Sub-processors
Last updated 28 October 2026 · The current list of third parties that process customer data on our behalf.
Dutch and Italian translations of this document are provided for convenience. In case of any difference between a translation and this English version, the English version prevails.
How we use sub-processors
Dazr is the prime processor under your DPA. Sub-processors carry out parts of the service on our behalf under written contracts that impose data-protection obligations no less protective than those we owe you. Every sub-processor of Dazr Compliance processes the data on servers in the European Union.
Current sub-processors
Each provider is listed by name, with what it does for Dazr Compliance, the data it handles and the server region we use. Per-provider DPA references are available to customers on request to privacy@dazr.eu.
| Provider | What they do | Data categories | Server region |
|---|---|---|---|
| Vercel Cloud infrastructure |
Compute and edge functions. Operates the production runtime that serves the portal and the API, and counts page views on the website without cookies. Stores no files. | Workspace content while it is processed (records encrypted at the application layer); member identities; billing-state mirrors; server logs. | EU |
| Upstash Key-value storage and rate-limit counters |
The key-value database behind the portal, and short-TTL counters that throttle public endpoints and the admin login. | Workspace records (encrypted at the application layer); hashed IP addresses and email addresses; counter values. | EU |
| Mollie Payment processor |
Card collection, mandate management, recurring billing for paid plans. | Billing contact, VAT id, invoice address, payment-state metadata. No card data ever touches our servers. | EU (Netherlands) |
| Hetzner Online Our own servers: file storage, mail server and AI gateway |
Stores uploaded files (evidence, policy and profile documents, attachments) and the backups of the database, encrypted by the application, on our own servers. Our own mail server here also sends our emails: sign-in codes, member-invite and auditor-invite emails, notification emails (assignment, reminder, escalation), Enterprise lead acknowledgements, and support and contact form messages to our mailbox. Added to this list on 10 October 2026, with 30 days' notice. Another of our servers here runs the gateway of the optional AI assistant: when a customer turns the assistant on, the gateway passes its requests to the AI provider the customer chose, holds their content in memory only while it passes it on, and stores the encrypted provider keys and usage records without content. | Uploaded files and backups (encrypted at the application layer); recipient email; subject; HTML body for the duration of delivery; delivery logs; with the optional AI assistant turned on, the content of requests in memory while they pass through (not stored), encrypted AI provider keys and usage records (who, app, model, tokens, cost; no content). | EU (Germany) |
| Namecheap (Private Email) Customer support mailbox |
Hosts the mailboxes that receive support email and Enterprise enquiries. | Whatever the sender includes in the email. Kept 24 months from last activity. | EU |
What we don't use
We do not use:
- Tracking analytics (Google Analytics, Plausible, Amplitude, Mixpanel, etc.). The website counts page views with Vercel Web Analytics, which sets no cookies and does not store IP addresses; we only see totals, such as how often a page was viewed.
- Advertising networks or any third-party trackers.
- Customer-data-platform tools that would replicate workspace data into a marketing tool.
- AI or LLM providers as sub-processors. If you or your organisation turn on the optional AI assistant, the AI provider you connect is engaged by you or your organisation directly, with your own key and under your own agreement, and is not a Dazr sub-processor; the Dazr AI gateway that passes the requests on is part of the Hetzner entry above. See the privacy policy.
- Crash-reporting services that would receive workspace content. Server-side errors are logged inside our own infrastructure.
Affiliates
We have no group affiliates that process customer data on our behalf today. If that changes we'll list them here.
Changes
We will give workspace owners at least 30 days' written notice before adding a new category of sub-processor or replacing a provider in an existing category. Notice goes to the workspace owner email on file and to everyone who asked to be told. The DPA explains the customer's right to object on reasonable data-protection grounds.
Be told about changes
To be told when this list changes, email privacy@dazr.eu with the subject "Sub-processor changes" and your workspace ID. You can ask to be removed at any time.
Contact
- Privacy / DPA matters: privacy@dazr.eu
- Security incidents: security@dazr.eu