Infrastructure and Jurisdiction

Referenced by Schedule A of the Terms of Service.

Hosting location

Customer data is hosted and processed in the European Union, on Amazon Web Services in Frankfurt (eu-central-1). This covers the application, the database, file storage, backups and AI processing (Amazon Bedrock). Backups are encrypted, retained for a limited period and held on resilient cloud infrastructure in the European Union.

Jurisdictions involved

Pazar IP, Inc. is a Delaware corporation with offices in Venice, California, United States. Identity, billing, e-signature, email delivery and edge services are provided by US companies. Processing locations by provider:

  • Amazon Web Services, Inc. and Amazon Web Services EMEA SARL: European Union (Frankfurt, eu-central-1)
  • Amazon Web Services (Amazon Bedrock): European Union (Frankfurt, eu-central-1)
  • Cloudflare, Inc.: United States (global edge network)
  • Resend (Plus Five Five, Inc.): United States
  • Clerk, Inc.: United States
  • Stripe, Inc.: United States
  • Verdocs, Inc.: United States (AWS, Virginia)

Full details, including the data each provider processes and its safeguards, are on the subprocessor list.

Transfer mechanisms

Where personal data subject to the EU GDPR is processed in a country without an adequacy decision, the EU Standard Contractual Clauses apply (Module Two, controller to processor, or Module Three, processor to processor). For the UK GDPR, the SCCs apply as supplemented by the UK International Data Transfer Addendum. For the Swiss FADP, the SCCs apply with the Swiss amendments. Where Pazar or a subprocessor is certified under the EU-US Data Privacy Framework (or its UK or Swiss extensions), that framework may serve as an alternative basis; the SCCs remain the primary mechanism. See DPA section 12 and Annex 4.

Government access

Pazar processes personal data only on the customer's documented instructions, including with regard to international transfers, unless applicable law requires otherwise. Where it does, Pazar informs the customer of that legal requirement before processing, unless the law prohibits this on important grounds of public interest (DPA section 3.1).

Governing documents

Data Processing Agreement V1.5 (11 October 2026), including Annex 3 (technical and organizational measures) and Annex 4 (transfer mechanisms).