Datazag Security and Sub-processor Schedule
Version 1.0, dated 25 October 2026
This schedule forms Annex 3 of the Datazag Data Processing Addendum and records how the DPA's security requirements are implemented. Provider details come from each provider's published terms or Datazag's signed agreement with it, as checked on 25 October 2026.
1. Sub-processors of Customer Personal Data
Customer Personal Data is held in the Datazag Portal (portal.datazag.com) and, when a Customer raises a support request about a particular client, in Datazag's support email. It consists of what a Customer enters about its clients, such as client contact names, email addresses and phone numbers. Reports contain public internet infrastructure data and the organization name the Customer gives. They contain no other personal data.
These providers run the Portal and support email. Datazag authorises no other provider under DPA Annex 3. Datazag will give 30 days' notice under DPA Clause 6 before moving support to a different tool.
| Provider (contracting entity) | Function | Customer Personal Data affected | Storage and processing location | Provider terms in place | Transfer safeguard for UK and EU data |
|---|---|---|---|---|---|
| Vercel Inc. (Delaware, USA) | Hosts the Portal application | Client contact details as they pass through the application | United States, us-east-1 (Northern Virginia) | Vercel Data Processing Addendum, last updated 17 March 2026, effective 31 March 2026. Datazag is on Vercel's Pro plan, which the DPA covers. | EU SCCs Modules 2 and 3 and the UK International Data Transfer Addendum, both incorporated in the Vercel DPA |
| Databricks, Inc. (Neon is part of Databricks) | Managed PostgreSQL database for the Portal | Client contact details stored with the Customer's client organizations | United States, AWS us-east-1 (Northern Virginia) | Databricks DPA v3 (21 July 2023), part of the Databricks Master Cloud Services Agreement, with the Neon product schedule last updated 14 October 2026 | EU SCCs Modules 2 and 3 and the UK Addendum (version B1.0), both in the Databricks DPA |
| Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland | Microsoft 365 email used for customer support | Client contact details that a Customer includes in a support request about a particular client | United Kingdom (Microsoft 365 tenant data location) | Microsoft Products and Services Data Protection Addendum, current edition dated 22 May 2026 | EU-U.S. Data Privacy Framework with the UK Extension and the Swiss-U.S. framework, plus the 2021 EU SCCs and the UK IDTA, under the Microsoft DPA's data transfers section |
Other service providers (no Customer Personal Data)
These providers support the Services but do not process Customer Personal Data. Where they process personal data at all, Datazag is the controller (DPA Clause 3.1).
| Provider | Function | Data handled |
|---|---|---|
| Contabo GmbH, Welfenstraße 22, 81541 Munich, Germany (data centre operated by Contabo France SAS, Lauterbourg, France) | Server that generates reports and runs monitoring | Public infrastructure data, domains and organization names. Covered by a data processing agreement concluded 25 October 2026. |
| Cloudflare, Inc. (R2 object storage, Western Europe location setting) | Stores Datazag's intelligence data and report files | Public infrastructure data and organization names. Report files outside the data lake are deleted within six months at most. |
| Cloudflare, Inc. (Turnstile) | Bot protection on public forms | Form visitors' technical data, with Datazag as controller |
| Plus Five Five, Inc. (trading as Resend) | Sends account and report-ready emails to Portal users | Portal users' names and email addresses, with Datazag as controller for account administration |
| Stripe Payments Europe, Limited, One Wilton Park, Wilton Place, Dublin 2, D02 FX04, Ireland, and Stripe Payments UK Ltd, 9th Floor, 107 Cheapside, London, EC2V 6DN, UK | Payment processing and subscription billing | Billing data, where Datazag and Stripe are each controllers for their own purposes |
| Attio Limited | Datazag's customer relationship management | Customer and prospect business contact details and sales records, with Datazag as controller. The portal sends Attio partner account events and the partner's own contact details only. Partner client lists are not copied into Attio. A support request about a particular client is recorded only with the details needed to resolve it, and deleted under DPA Clause 10. |
| Xero (the Xero entity named in Datazag Ltd's Xero subscription) | Accounting and invoicing | Customer billing contacts, invoices and payment records, with Datazag as controller for its own accounts |
| Google LLC and GitHub, Inc. | Optional sign-in providers | Chosen by the user, who authenticates directly with the provider |
| Sanity | Content management for marketing pages | No Customer data |
Customer-selected destinations
Slack workspaces, SIEM platforms and webhook endpoints that a Customer configures for alert delivery are the Customer's own destinations. They are not Datazag Sub-processors (DPA Annex 1).
2. Security and retention
| Area | Implementation |
|---|---|
| Staff access | Multi-factor authentication on production accounts, confirmed by Datazag |
| Encryption in transit | TLS for Portal, website, API and email delivery traffic |
| Encryption at rest | Enabled, confirmed by Datazag. Customer Personal Data is held only in the Portal database. |
| Client isolation | Customer data is separated by organization in the application. A Partner can only see and order for client organizations linked to its own account. |
| Assessment input retention | Domain lists for one-off reports are not kept after the report runs unless the Customer opts in. Monitoring keeps the configured domains while monitoring is active. |
| Report and file retention | Delivered reports are stored in the Portal database for the life of the account and deleted under DPA Clause 10. Report files on R2 are deleted within six months at most. |
| Log retention | Six months for application, server and email logs |
| Backups | Retention six months. Residual backups expire no later than six calendar months after production deletion (DPA Clause 10.3). |
| Recovery testing | Last restore test: 1 October 2026 |
| Incident response | Documented breach procedure supporting the 48-hour outer notice limit in the DPA |
3. Contacts
- Legal and account notices: legal@datazag.com (monitored)
- Partner notices: partners@datazag.com (monitored)
4. Supplier changes
Datazag gives each affected Customer at least 30 days' direct notice before adding or replacing a Sub-processor in section 1 (DPA Clause 6). This schedule is then republished with a new version number, and the previous version is kept in the archive.
Sources
Checked on 25 October 2026:
- [Vercel Data Processing Addendum](https://vercel.com/legal/dpa); sub-processor list at [security.vercel.com](https://security.vercel.com)
- [Neon product schedule (Databricks)](https://neon.com/dpa); [Databricks DPA](https://www.databricks.com/legal/dpa); [Databricks sub-processors](https://www.databricks.com/legal/databricks-subprocessors)
- Contabo data processing agreement between Datazag Ltd and Contabo GmbH, concluded 25 October 2026 (copy held by Datazag)
- [Cloudflare Customer DPA](https://www.cloudflare.com/cloudflare-customer-dpa/); [Cloudflare sub-processors](https://www.cloudflare.com/gdpr/subprocessors/)
- [Resend Data Processing Addendum](https://resend.com/legal/dpa); [Resend sub-processors](https://resend.com/legal/subprocessors)
- [Stripe Data Processing Agreement](https://stripe.com/gb/legal/dpa)
- [Microsoft Products and Services Data Protection Addendum](https://www.microsoft.com/licensing/docs/view/microsoft-products-and-services-data-protection-addendum-dpa) (transfer terms read from the April 2025 edition; the current edition is dated 22 May 2026)