Subprocessors and infrastructure
Transparency · last verified: 1 September 2026
Every serious DPP buyer asks the same thing: where does my data physically live, and which third parties does it pass through. Here is the exact answer — no marketing.
Where the platform's data lives
The entire DPP platform runs on Amazon Web Services in the Frankfurt, Germany region (eu-central-1) — data is stored in the European Union. The architecture is fully serverless: we operate no servers of our own.
- Databases have point-in-time recovery (PITR) enabled for the last 35 days.
- File storage is versioned — deleted objects can be restored.
- Encryption at rest and in transit; key management via AWS KMS.
- Public passports are cached on CDN edges in Europe and North America; storage stays in the EU.
- The whole infrastructure is defined as code (Terraform) and reproducible.
Subprocessor
Service and purpose
Location and safeguards
Amazon Web Services EMEA SARL (Luxembourg)
Platform hosting: compute, databases, file storage, authentication, transactional email, CDN
EU — Frankfurt, Germany; CDN cache: Europe and North America · AWS DPA + Standard Contractual Clauses
Machine-translation provider
Automatic content translations, only at the customer's request
Being confirmed — this row will be completed in the next update of this page
Tool
Purpose
Scope
Vercel
Marketing website hosting
Website only — no access to passport data
Sanity
Website content management
Website only — no access to passport data
Google Tag Manager / Analytics
Visit statistics
Website only — no access to passport data
Calendly
Consultation scheduling
Website only — no access to passport data
Jotform
Enquiry forms
Website only — no access to passport data
Upstash
Blog applause counter
Website only — no access to passport data
What happens to passports when something fails
Our full commitments — what happens to passports when a contract ends, when you switch providers, and on cessation of activity — are published on the “Portability and continuity” page. All data can be exported at any time in open formats (JSON-LD).
This page is updated whenever a provider or the infrastructure changes. Last verified: 1 September 2026.
Running due diligence?
Write to us — we provide certificates, scopes and further documentation under a confidentiality agreement.
