DPA & Subprocessors
Last updated: 19 October 2026
Changes in this version: Clarified retention periods (evidence 90 days, Team audit 180 days); translation fixes.
Overview
This page describes how zn ("usezn") processes personal data on behalf of customers, and lists the subprocessors we engage. It supplements our Privacy Policy and our Security Policy. Customers can execute a Data Processing Agreement (DPA) with us on request — contact hello@usezn.com.
Roles
Customer (controller): you decide what input you send to the API and remain responsible for your own users and applications.
zn (processor): we analyze input and produce evidence records only to deliver the service described in our Terms and Privacy Policy.
Polar (independent controller): as Merchant of Record, Polar processes payment and tax data under its own privacy terms. zn does not receive full payment card data.
Data We Process on Your Behalf
- API input: evaluated in volatile memory and not stored on any plan (Free, Pro, Scale and Team) outside Contributor Mode. In Contributor Mode (opt-in, offered with some startup and research grants), a scrubbed excerpt of each analyzed input (the first 1,000 characters, with emails, bearer tokens, API keys and long hex strings redacted automatically) is stored with its evidence record for up to 90 days and used to improve zn detection models.
- Evidence records: random evidence ID plus verdict, confidence, rule, latency, timestamp and request metadata (SHA-256 hash and size of the input from October 12, 2026, 12:24 UTC, API key prefix, endpoint, Origin host, client family/version; never the raw User-Agent or IP address); no copy of the input outside Contributor Mode. Evidence records expire automatically after 90 days, whichever endpoint created them; exportable as CSV or JSON.
- Account and usage data: email address, optional company name, API key metadata, call counts, and latency metrics.
- Billing data: managed by Polar as Merchant of Record.
Subprocessors
| Subprocessor | Purpose | Data categories |
|---|---|---|
| Amazon Web Services (AWS) | Cloud hosting, object storage, and managed database services (US East: N. Virginia and Ohio regions) | Account data, usage metadata, evidence records, and Contributor Mode input excerpts |
| Auth0 | Authentication and identity management | Account email and login identifiers |
| Polar | Payments, invoicing, tax handling, and Merchant of Record | Billing details processed by Polar under its own privacy terms |
| Amazon SES | Transactional email delivery | Email address and message metadata |
International Transfers
Where personal data originating in the EEA or the UK is transferred to a subprocessor outside those regions, we rely on the subprocessor's Standard Contractual Clauses and/or an applicable adequacy mechanism such as the EU-US Data Privacy Framework where the subprocessor is certified. Subprocessor agreements include confidentiality, security, and data protection obligations.
Security Measures
Technical and organizational measures include TLS 1.3 in transit, AES-256 encryption at rest (AWS-managed), API keys stored hashed and KMS-encrypted, least-privilege access controls, and automatic 90-day expiry of evidence records. We run on AWS, whose data centers hold SOC 2 Type II and ISO 27001 certifications. zn itself is not yet SOC 2 or ISO certified; the compliance roadmap is published on our Security Policy page.
Changes to Subprocessors
We keep this page current. If you have executed a DPA with us and we add a subprocessor that processes personal data, we will notify you by email so you can object as described in the agreement.
Data Subject Requests
We assist customers in responding to data subject requests relating to the data we process on their behalf. Send requests to hello@usezn.com.
Contact
For DPA execution, subprocessor questions, or legal inquiries, contact hello@usezn.com. We are based in Europe and reply in English or Spanish.