Trust centre
Trace the data before you approve the supplier.
Supported raw files and raw extracted metadata stay in the browser on Professional's local processing paths. Account, subscription, audit and minimised compliance records use platform providers. Use the documents below to review provider roles, data locations and security measures, then check the applicable agreements and transfer safeguards for your organisation's activity.
DPA version dpa-2026-09-19-v1. Opening the document does not execute an agreement.
Which documents support the procurement review?
Start with the published DPA, provider register and technical measures. Read them together to identify the processing activity, the records involved and the relevant responsibilities. Check the version and applicable agreement before approval; opening or downloading a document does not execute it or establish that it meets your organisation’s requirements.
Where are files and workspace records handled?
Supported raw files and extracted raw metadata stay in the browser on the local processing path. Account, subscription, audit and minimised compliance records use platform providers. Review those activities separately, including where records are handled and which agreement and transfer safeguards apply to your organisation.
Raw files. Supported files are processed in the browser; raw file bytes and extracted raw metadata are not uploaded to ScrubMetadata on that path.
Workspace records. Account, subscription, audit and minimised compliance records are stored by the service. Zero-upload describes the raw-file processing boundary, not an absence of platform personal data. ScrubMetadata processes minimized account, authentication, security, device-trust, consent, billing, operational, error-monitoring, audit, compliance-evidence, and support data for the purposes described in the canonical public data-category register. It does not use visitor analytics, advertising pixels, retargeting cookies, or cross-site behavioral profiling.
Workspace access. A copied record link cannot be treated as permission to open another organisation's work. Organisation-scoped requests check the signed-in membership before access. The active selection is an authorisation boundary, not a list filter.
Location and transfers. Application Functions use Vercel's Frankfurt (fra1) region, and the production Neon database and Upstash Redis are in AWS eu-central-1, Frankfurt. Some providers still process data outside the EU. The provider register describes location limits and transfer safeguards.
Change notice. Under the accepted DPA, a new or changed subprocessor needs prior written authorization. Where general written authorization is agreed, customers receive notice of intended changes and an opportunity to object. Automated change emails are not part of the current commitment.
What does each provider handle?
Each provider handles a defined activity, with its own data categories, role and location limits. Use the summaries below to identify which activity you need to review, then open the full provider register for the contract and transfer details. A provider name alone does not establish adequate safeguards.
Which security measures apply?
The measures below describe infrastructure, application, access, data and audit boundaries. Open each linked explanation to check its scope and limitations against the activity you are reviewing. These descriptions do not establish independent certification, complete control coverage or legal compliance, and should not be treated as an assurance opinion.
Infrastructure
Application Functions run in Frankfurt (fra1); the production database and Redis are in AWS eu-central-1, Frankfurt.
Read the boundaryApplication
Application-level AES-256-GCM protects integration credentials and selected sensitive fields.
Read the boundaryAccess
Authenticated membership is checked for organisation-scoped requests before a record is read or changed. Sign-in uses email magic links.
Read the boundaryData
Supported raw files and extracted raw metadata stay in the browser. Minimised compliance evidence is stored for the workspace.
Read the boundaryAudit integrity
Canonical audit writes include SHA-256 hash-chain controls. This does not establish independent verification of every route, retention policy, legal hold, backup or restore path.
Read the boundaryHow can I check raw-file processing in the browser?
Inspect Network requests while processing a supported synthetic file. Check whether a request contains raw file bytes or extracted raw metadata; account and workflow requests can still be sent. This observation applies to that browser session and file. It does not establish legal compliance or independent assurance.
- 01
Open Network
Open browser DevTools and select the Network tab.
- 02
Process a file
Use a supported synthetic file in the Professional dashboard.
- 03
Inspect requests
Confirm that no outbound request contains raw file bytes.
What should procurement ask about Professional?
- Is the service EU-hosted?
- Mostly, not entirely. Application Functions run in Frankfurt (fra1), and the production database and Redis are in AWS eu-central-1, Frankfurt. Vercel's edge network operates worldwide, Resend sends email from Ireland but stores email account data in the United States, audit-integrity checkpoint files are in a US Vercel Blob store, and the contact mailbox is in Zoho's India data centre. This is not an EU-only residency offer.
- Are transfer safeguards complete?
- An SCC link in a transfer record identifies a document to review; it does not establish that the clauses cover this activity or make the transfer lawful. No account-specific transfer mechanism or SCC coverage is represented as complete. The applicable agreement and transfer annexes must be established for each provider activity.
- Is there independent security certification?
- No SOC 2 or ISO certification or independent penetration-test opinion is claimed. The security page describes technical measures and their exact scope.
- Who sells the service, and is there an EU representative?
- ScrubMetadata is operated by Anurodh Acharya, an unregistered individual operator, at 88 Kirti Marg, Teentolia, Morang, Nepal; Paddle is the merchant of record for payments. The privacy contact is an operational enquiry channel, not a statement that an EU or UK statutory representative has been appointed. Representative applicability, identity, postal address, and publication remain an owner and legal gate. The owner has decided to appoint an EU representative before the first paid customer agreement starts.
- Is AI processing part of Professional?
- No AI add-on is included in the controlled Professional offer. The published provider register lists no AI model processor for that offer.
Where are breach duties and security contacts recorded?
When acting as processor, ScrubMetadata notifies the customer controller without undue delay after becoming aware of a personal data breach. The controller handles authority and data-subject notification decisions under applicable law. The full obligation is in the DPA.
Report security issues to security@scrubmetadata.com. Do not include raw files or raw metadata in email.
The provider register covers 8 activities. The Professional offer excludes 2 AI add-ons. Technical measures are scoped descriptions, not independent certification or a legal-compliance determination.