Pazar Subprocessor List
Version 4 | 11 October 2026 | Mirrors Annex 2 of the Data Processing Agreement V1.5
Pazar IP, Inc. (“Pazar”) engages the subprocessors listed below to deliver the Pazar platform. Customer data is hosted and processed in the European Union; identity, billing, e-signature, email delivery and edge services are provided by US companies under the safeguards listed. Pazar has a data processing agreement in place with each subprocessor.
We will notify customers of any new or replaced subprocessor at least 30 days before it processes customer data, via this page and by email to the account owner. Customers may object on reasonable data protection grounds within that period.
| Subprocessor | Purpose | Data processed | Location | Compliance and transfer mechanism |
|---|---|---|---|---|
| Amazon Web Services, Inc. and Amazon Web Services EMEA SARL | Cloud hosting, database and file storage | All customer data: account and organization data, deal records, uploaded documents, contracts, artwork, audit events, backups | European Union (Frankfurt, eu-central-1) | ISO 27001, SOC 2; AWS Data Processing Addendum; EU-US DPF certified for any access from outside the EU |
| Amazon Web Services (Amazon Bedrock) | AI processing: document analysis and extraction, rights analysis, royalty assessment, discovery on obfuscated attributes | Documents and deal data submitted for analysis; obfuscated discovery attributes | European Union (Frankfurt, eu-central-1) | Covered by the AWS Data Processing Addendum; inputs and outputs are not used to train models |
| Cloudflare, Inc. | DNS, edge network and application protection | Request metadata (IP address, headers) in transit | United States (global edge network) | ISO 27001, SOC 2; EU-US DPF certified; DPA |
| Resend (Plus Five Five, Inc.) | Transactional email (invitations, notifications) | Recipient name and email address, notification content | United States | EU-US DPF certified; DPA with SCCs |
| Clerk, Inc. | Identity and authentication | Name, email address, credentials, session and MFA metadata | United States | SOC 2; EU-US DPF certified; DPA with SCCs |
| Stripe, Inc. | Subscription billing and tax; optional payment link for royalty invoices | Billing contact, subscription and invoice data; card data held by Stripe only | United States | PCI DSS Level 1; EU-US DPF certified (incl. UK and Swiss extensions); DPA |
| Verdocs, Inc. | E-signature and signature audit log | Signer name and email, documents routed for signature, signing events | United States (AWS, Virginia) | SOC 2 Type 1; E-SIGN and UETA compliant; Art. 28 GDPR terms (order form Schedule 3 and data protection rider of 23 July 2026); EU SCCs on request under those terms |
Verdocs retains signature completion and audit-trail evidence for at least seven years after signing to support the legal validity of signed documents; copies in its backup systems are deleted under its standard backup cycle (DPA section 10.1).
Customer-authorized integrations (not subprocessors)
Integrations that customers connect themselves, such as Salesforce and calendar sync, are not subprocessors. Data flows to those systems only at the customer's direction, under the customer's own agreements with those providers, and can be disconnected at any time.
Changes in this version
Amazon Bedrock location corrected to Frankfurt (eu-central-1). Verdocs row updated: Art. 28 terms including the data protection rider of 23 July 2026, SCCs on request, and the signature-evidence retention note. No subprocessor added or removed.