Subprocessors and infrastructure
Transparency · last verified: 1 September 2026
Every serious DPP buyer asks the same thing: where does my data physically live, and which third parties does it pass through. Here is the exact answer — no marketing.
Where the platform's data lives
The entire DPP platform runs on Amazon Web Services in the Frankfurt, Germany region (eu-central-1) — data is stored in the European Union. The architecture is fully serverless: we operate no servers of our own.
- Databases have point-in-time recovery (PITR) enabled for the last 35 days.
- File storage is versioned — deleted objects can be restored.
- Encryption at rest and in transit; key management via AWS KMS.
- Public passports are cached on CDN edges in Europe and North America; storage stays in the EU.
- The whole infrastructure is defined as code (Terraform) and reproducible.
Subprocessor
Service and purpose
Location and safeguards
Amazon Web Services EMEA SARL (Luxembourg)
Platform hosting: compute, databases, file storage, authentication, transactional email, CDN
EU — Frankfurt, Germany; CDN cache: Europe and North America · AWS DPA + Standard Contractual Clauses
Machine-translation provider
Automatic content translations, only at the customer's request
Being confirmed — this row will be completed in the next update of this page
Tool
Purpose
Scope
Vercel
Marketing website hosting
Website only — no access to passport data
Sanity
Website content management
Website only — no access to passport data
Google Tag Manager / Analytics
Visit statistics
Website only — no access to passport data
Calendly
Consultation scheduling
Website only — no access to passport data
Jotform
Enquiry forms
Website only — no access to passport data
Upstash
Blog applause counter
Website only — no access to passport data
What happens to passports when something fails
Our full commitments — what happens to passports when a contract ends, when you switch providers, and on cessation of activity — are published on the “Portability and continuity” page. All data can be exported at any time in open formats (JSON-LD).
This page is updated whenever a provider or the infrastructure changes. Last verified: 1 September 2026.
What buyers verify
Due-diligence questions
In practice, one: AWS. Everything else in the table is a website tool — Vercel, Sanity, Google Tag Manager and Analytics, Calendly, Jotform, Upstash — and none of them has access to passport data; they run this marketing site. A machine-translation provider is used for automatic content translation only at the customer's request, and that row is still being confirmed rather than quietly left blank.
The contracting entity is Amazon Web Services EMEA SARL in Luxembourg, under the AWS Data Processing Addendum plus Standard Contractual Clauses. The platform is developed and operated under an ISO/IEC 27001:2022 certified information security management system — certificate BG2026030401, issued by INCERT, valid from 4 March 2026 to 3 March 2029 — which you can verify with the certification body and in the international IAF CertSearch database.
The page carries a last-verified date at the top and is updated whenever a provider or the infrastructure changes; it is not an annual exercise. For a formal file, write to us: we provide the certificate, its scope and further documentation under a confidentiality agreement.
Running due diligence?
Write to us — we provide certificates, scopes and further documentation under a confidentiality agreement.
