Dazr Files trust centre
Last updated 6 October 2026
If a translation of this page differs from the English version, the English version applies.
Dazr Files is part of Dazr Suite. Docs, Sheets and Slides are covered by the Dazr Suite trust centre.
Where your data is stored
We store personal data in the European Union. Vercel, Upstash and Resend are companies based in the United States. Where one of our providers can access personal data from outside the European Economic Area, the transfer is covered by the European Commission’s Standard Contractual Clauses or by an adequacy decision of the European Commission.
For companies in the United States, that adequacy decision is the EU-US Data Privacy Framework, which covers the companies certified under it.
Sub-processors
These companies process personal data for us, only on our instructions and under written contracts that oblige them to protect it:
| Provider | Location | Purpose | Data |
|---|---|---|---|
| Vercel | United States; data stored in the EU | Hosting, server functions, file storage (Vercel Blob) and page statistics | Files, encrypted at rest, and server logs |
| Upstash | United States; data stored in the EU | Database (key-value store) for accounts and records | Accounts and records, encrypted at rest |
| Resend | United States | Sending emails, such as sign-in codes and notifications | Email address, name and the content of the email |
How we protect your data
- Encryption in transit. All traffic is encrypted with HTTPS. Browsers are told to use only HTTPS for dazr.eu and all its subdomains (HSTS, with the preload directive).
- Encryption at rest. Accounts, documents and files are encrypted with AES-256-GCM at the application layer, on top of our providers’ own encryption, with keys held on our servers. The master key can be rotated without downtime: a background job re-encrypts the stored data with the new key.
- Your own files and each organisation’s space are encrypted with their own keys. The storage paths of files contain no names or other personal data.
- Sign-in with Dazr Identity. With a passkey, a one-time code sent by email, or Google or Microsoft. There are no passwords to steal, and you can see and end your sessions at any time.
- Access checked on every request. Your own files are visible only to you, and files in an organisation space only to its current members. A member who leaves loses access at once.
- Activity in organisation spaces. Each space keeps a list of who uploaded, renamed, moved or deleted what and when (the latest 200 entries), and only the owner and admins can delete files for good.
- Versions and trash. Each file keeps its last 10 versions, and deleted files stay in the trash for 30 days.
- Rate limits. File and document requests are rate-limited per account and per IP address.
- Your content stays yours. We use it only to store it, show it and run the features you use, never for advertising or to train AI models.
- Deletion schedules. Deleted files are removed for good after 30 days in the trash, unfinished uploads after 2 hours, and all your own files at once when you delete your Dazr Identity account.
- Content Security Policy. Browsers run only the scripts we list: our own files, inline scripts identified by their hash and one pinned library file. Plugins are blocked, and other websites cannot show our pages in a frame.
Privacy
The privacy notice explains what we keep, why and for how long, and the terms of use set out the rules for using the service.
You can ask us for access to your personal data, a copy in a portable format, correction, deletion or restriction, and you can object to processing based on our legitimate interests. Where we rely on your consent, you can withdraw it at any time.
Write to privacy@dazr.eu for anything you cannot do yourself. We reply within 30 days.
You can also complain to a data protection authority: in Italy the Garante per la protezione dei dati personali (garanteprivacy.it), or the authority where you live or work.
Compliance and assessments
- GDPR. Dazr, Viale Cesare Poggi 1, 15061 Arquata Scrivia (AL), Italy, VAT IT 02801250065, is the controller for the personal data described in the privacy notice, under the General Data Protection Regulation (GDPR).
- CSA STAR Level 1: self-assessment in preparation. Dazr is completing the Cloud Security Alliance’s Consensus Assessments Initiative Questionnaire (CAIQ) for the CSA STAR Registry. This page will link to the published entry.
Reporting a vulnerability
If you find a security vulnerability in one of our services, please report it to security@dazr.eu. Describe what you found and the steps to reproduce it, and name the address or app version concerned.
- Scope. The Dazr websites and services on dazr.eu and its subdomains, their APIs, Dazr Browser and the Dazr Suite apps.
- Testing with care. Use your own accounts and test data, access other people’s data only as far as needed to show the problem, and keep the service running for everyone: no denial-of-service tests, spam or social engineering.
- Safe harbour. If you act in good faith and follow this policy, we consider your research authorised and will not take legal action against you. Please give us reasonable time to fix the problem before you share details publicly.
- Our response. We acknowledge your report within 5 working days and keep you informed until the problem is fixed.
Our security contact is also published in security.txt (RFC 9116).
The full policy, including what is out of scope and how we publish fixes, is our vulnerability disclosure policy.
Contact
- Privacy and data requests: privacy@dazr.eu
- Security: security@dazr.eu
- General: hello@dazr.eu
- Post: Dazr, Viale Cesare Poggi 1, 15061 Arquata Scrivia (AL), Italy