Dazr trust centre

Last updated 16 October 2026

If a translation of this page differs from the English version, the English version applies.

In short Each Dazr product has its own trust centre: where its data is stored, the providers it uses and the security measures in place. All products share one company, one privacy contact and one address for security reports.

Trust centres of our products

Dazr Compliance: compliance programmes, audits and the evidence trail for the Cyber Resilience Act
Dazr Suite: Docs, Sheets and Slides, and Dazr Files for your files and organisation spaces
Dazr Browser: the desktop browser and its update service
Dazr Identity: accounts, organisations and verification
Dazr Sign: electronic signatures with a sealed evidence trail

Procurement pack

Everything a security or procurement review usually asks for, in one place:

Security overview. The measures all our products share are listed under Security overview below; each product’s trust centre adds its own.
Data processing agreements. Dazr Compliance, Dazr Suite and Dazr Sign. For another product, write to legal@dazr.eu.
Sub-processors. The contractual list for Dazr Compliance, and the sub-processors section of each product’s trust centre. The ones for dazr.eu are below.
CAIQ. Our answers to the Cloud Security Alliance questionnaire will be linked here once they are published in the CSA STAR Registry (see Compliance and assessments).
Vulnerability disclosure. Our disclosure policy and security.txt.
Service status. Live checks of every product and recent incidents at dazr.eu/status.
Legal documents. Privacy notices and terms of use of every product in the legal overview.

Security overview

Encryption in transit. All traffic is encrypted with HTTPS. Browsers are told to use only HTTPS for dazr.eu and all its subdomains (HSTS, with the preload directive).
Encryption at rest. Accounts, documents and files are encrypted with AES-256-GCM at the application layer, on top of our providers’ own encryption, with keys held on our servers. The master key can be rotated without downtime: a background job re-encrypts the stored data with the new key.
Not end-to-end encrypted. Our systems can decrypt the data in order to provide the service, and only the few people at Dazr who run it can access them.
Sign-in with Dazr Identity. With a passkey, a one-time code sent by email, or Google or Microsoft. There are no passwords to steal, and you can see and end your sessions at any time.
Access control. Every request is checked against the account and, for shared data, the current members of the organisation. Public endpoints are rate-limited per account and per IP address.
Backups. The database is backed up daily, encrypted, in the European Union; daily copies are kept for 30 days and monthly copies for 12 months.
Monitoring. Scheduled jobs are monitored and alert the owners when they fail; the results feed the status page.
Content Security Policy. Browsers run only the scripts we list: our own files and inline scripts identified by their hash. Plugins are blocked, and other websites cannot show our pages in a frame.

Support

Questions and problems: support@dazr.eu or the contact form.
Security reports: security@dazr.eu. We acknowledge them within 5 working days.
Privacy and data requests: privacy@dazr.eu. We reply within 30 days.
Contracts and data processing agreements: legal@dazr.eu.

These are the reply times we work to today, not a contractual service level. A service level agreement, sold separately, adds one.

Company details

Name: Dazr
Registered address: Viale Cesare Poggi 1, 15061 Arquata Scrivia (AL), Italy
VAT number: IT 02801250065

The sections below cover dazr.eu and the free tools on it.

Where your data is stored

We store personal data on servers in the European Union: every provider below runs our service in its EU region. The privacy notice explains how any access from outside the EU is covered.

Sub-processors

These companies process personal data for us, only on our instructions and under written contracts that oblige them to protect it:

Provider	Location	Purpose	Data
Hetzner Online	EU (Germany)	Our own servers: file storage, backups of the database and our mail server	Files and backups, encrypted at the application layer; emails while they are sent
Vercel	EU (Germany, Frankfurt)	Hosting of the websites and server functions, and page statistics	Server logs, kept for up to 30 days
Upstash	EU (Germany, Frankfurt)	Database (key-value store) for accounts and records	Records of the websites, such as short-lived rate-limit counters
Namecheap Private Email	EU	Our mailboxes, where the messages you send us arrive	Name, email address and what you write

How we protect your data

Encryption in transit. All traffic is encrypted with HTTPS. Browsers are told to use only HTTPS for dazr.eu and all its subdomains (HSTS, with the preload directive).
Content Security Policy. Browsers run only the scripts we list: our own files and inline scripts identified by their hash. Plugins are blocked, and other websites cannot show our pages in a frame.
No advertising or tracking. Our websites show no advertising and contain no third-party trackers, pixels or social media widgets. Fonts and scripts come from our own servers.
Spam protection. Before a public form is sent, your browser solves a small calculation (proof of work). It runs on your device and sets no cookie.

Privacy

The legal overview lists the privacy notice and terms of use of every product, and the website privacy notice covers dazr.eu and its free tools.

You can ask us for access to your personal data, a copy in a portable format, correction, deletion or restriction, and you can object to processing based on our legitimate interests. Where we rely on your consent, you can withdraw it at any time.

Write to privacy@dazr.eu for anything you cannot do yourself. We reply within 30 days.

You can also complain to a data protection authority: in Italy the Garante per la protezione dei dati personali (garanteprivacy.it), or the authority where you live or work.

Compliance and assessments

GDPR. Dazr, Viale Cesare Poggi 1, 15061 Arquata Scrivia (AL), Italy, VAT IT 02801250065, is the controller for the personal data described in the privacy notice, under the General Data Protection Regulation (GDPR).
ISO/IEC 27001: first audit planned. Our first ISO/IEC 27001 certification audit is planned for April 2027. Dazr is not certified yet.
CSA STAR Level 1: self-assessment in preparation. Dazr is completing the Cloud Security Alliance’s Consensus Assessments Initiative Questionnaire (CAIQ) for the CSA STAR Registry. This page will link to the published entry.

Reporting a vulnerability

If you find a security vulnerability in one of our services, please report it to security@dazr.eu. Describe what you found and the steps to reproduce it, and name the address or app version concerned.

Scope. The Dazr websites and services on dazr.eu and its subdomains, their APIs, Dazr Browser and the Dazr Suite apps.
Testing with care. Use your own accounts and test data, access other people’s data only as far as needed to show the problem, and keep the service running for everyone: no denial-of-service tests, spam or social engineering.
Safe harbour. If you act in good faith and follow this policy, we consider your research authorised and will not take legal action against you. Please give us reasonable time to fix the problem before you share details publicly.
Our response. We acknowledge your report within 5 working days and keep you informed until the problem is fixed.

Our security contact is also published in security.txt (RFC 9116).

The full policy, including what is out of scope and how we publish fixes, is our vulnerability disclosure policy.

Contact

Privacy and data requests: privacy@dazr.eu
Security: security@dazr.eu
General: hello@dazr.eu
Post: Dazr, Viale Cesare Poggi 1, 15061 Arquata Scrivia (AL), Italy