Dazr Sign trust centre
Last updated 6 October 2026
If a translation of this page differs from the English version, the English version applies.
Where your data is stored
We store personal data in the European Union. Vercel, Upstash and Resend are companies based in the United States. Where one of our providers can access personal data from outside the European Economic Area, the transfer is covered by the European Commission’s Standard Contractual Clauses or by an adequacy decision of the European Commission.
For companies in the United States, that adequacy decision is the EU-US Data Privacy Framework, which covers the companies certified under it.
Sub-processors
These companies process personal data for us, only on our instructions and under written contracts that oblige them to protect it:
| Provider | Location | Purpose | Data |
|---|---|---|---|
| Vercel | United States; data stored in the EU | Hosting, server functions, file storage (Vercel Blob) and page statistics | Files, encrypted at rest, and server logs |
| Upstash | United States; data stored in the EU | Database (key-value store) for accounts and records | Accounts and records, encrypted at rest |
| Resend | United States | Sending signing requests, reminders, signed copies and updates | Email address, name and the content of the email |
| Mollie | Netherlands (Amsterdam) | Payments for qualified certificates through Dazr | Amount, description and a reference to the request, never documents |
Qualified certificates through Dazr are issued by a qualified trust service provider in its own right, under its own privacy notice.
To check qualified signatures we contact public services that answer for themselves, not for us: the EU trusted lists and the certificate providers’ revocation services. Their requests name the certificate, not you as a user of Dazr Sign.
How we protect your data
Each document is encrypted with its own key. When everyone has signed, Dazr seals the PDF with its own digital signature, so any later change shows.
- Encryption in transit. All traffic is encrypted with HTTPS. Browsers are told to use only HTTPS for dazr.eu and all its subdomains (HSTS, with the preload directive).
- Encryption at rest. Accounts, documents and files are encrypted with AES-256-GCM at the application layer, on top of our providers’ own encryption, with keys held on our servers. The master key can be rotated without downtime: a background job re-encrypts the stored data with the new key.
- PAdES seal. The seal is a PAdES signature (baseline B-B) that any PDF reader with signature support can check.
- Evidence trail. Every step (sent, opened, viewed, signed, declined, reminded) is recorded with its time, how the person signed in, the country, the device and a one-way hash of the IP address. The trail is part of the sealed copy.
- Check page. Anyone can check a completed document at sign.dazr.eu/check. The file stays on their device; only its SHA-256 fingerprint is sent.
- Qualified signatures, checked. Qualified signatures are checked against the EU trusted lists, which we refresh daily, and against the certificate provider’s revocation service.
- Sign-in with Dazr Identity. With a passkey, a one-time code sent by email, or Google or Microsoft. There are no passwords to steal, and you can see and end your sessions at any time.
- Signing links. Each recipient signs in with the email address the document was sent to. Signing links stop working when the document is completed, cancelled or past its deadline.
- API and signed webhooks. Apps act only for people who allowed them and only on the documents they created, within rate limits. Webhooks carry the status of a document, never the document itself, and are signed with HMAC-SHA256.
- Deletion schedules. Uploads that are never used are deleted after 2 hours, and intermediate versions when the document is completed. Documents stay until the sender deletes them.
- Content Security Policy. Browsers run only the scripts we list: our own files, inline scripts identified by their hash and one pinned library file. Plugins are blocked, and other websites cannot show our pages in a frame.
Privacy
The privacy notice explains what we keep, why and for how long, and the terms of use set out the rules for using the service.
You can ask us for access to your personal data, a copy in a portable format, correction, deletion or restriction, and you can object to processing based on our legitimate interests. Where we rely on your consent, you can withdraw it at any time.
Write to privacy@dazr.eu for anything you cannot do yourself. We reply within 30 days.
You can also complain to a data protection authority: in Italy the Garante per la protezione dei dati personali (garanteprivacy.it), or the authority where you live or work.
Compliance and assessments
- GDPR. Dazr, Viale Cesare Poggi 1, 15061 Arquata Scrivia (AL), Italy, VAT IT 02801250065, is the controller for the personal data described in the privacy notice, under the General Data Protection Regulation (GDPR).
- CSA STAR Level 1: self-assessment in preparation. Dazr is completing the Cloud Security Alliance’s Consensus Assessments Initiative Questionnaire (CAIQ) for the CSA STAR Registry. This page will link to the published entry.
Reporting a vulnerability
If you find a security vulnerability in one of our services, please report it to security@dazr.eu. Describe what you found and the steps to reproduce it, and name the address or app version concerned.
- Scope. The Dazr websites and services on dazr.eu and its subdomains, their APIs, Dazr Browser and the Dazr Suite apps.
- Testing with care. Use your own accounts and test data, access other people’s data only as far as needed to show the problem, and keep the service running for everyone: no denial-of-service tests, spam or social engineering.
- Safe harbour. If you act in good faith and follow this policy, we consider your research authorised and will not take legal action against you. Please give us reasonable time to fix the problem before you share details publicly.
- Our response. We acknowledge your report within 5 working days and keep you informed until the problem is fixed.
Our security contact is also published in security.txt (RFC 9116).
The full policy, including what is out of scope and how we publish fixes, is our vulnerability disclosure policy.
Contact
- Privacy and data requests: privacy@dazr.eu
- Security: security@dazr.eu
- General: hello@dazr.eu
- Post: Dazr, Viale Cesare Poggi 1, 15061 Arquata Scrivia (AL), Italy