The List
EZQR stores customer data on a DigitalOcean server in Toronto, Ontario, keeps off-site backups of that server with Backblaze in Toronto, and uses three other vendors for payments, email delivery, and traffic in transit. This is the complete list; if a vendor is not here, EZQR does not send it customer data.
| Sub-processor | Purpose | Data involved | Location |
|---|---|---|---|
| DigitalOcean US company | Cloud hosting for the application, database, uploaded files, and backups | Everything EZQR stores: account details, QR codes and destinations, scan analytics, uploads, login records | Toronto, Ontario, Canada (TOR1 region) |
| Backblaze US company | Off-site object storage for full backups of the database and uploaded files | Backup copies of everything on the Toronto server: account details, QR codes and destinations, scan analytics, uploads, login records. Encrypted on the Toronto server before upload (restic); Backblaze holds only the encrypted archives and never the key | Toronto, Ontario, Canada (CA East region) |
| Cloudflare US company | DNS, TLS, content delivery, and protection against abusive traffic | Web requests in transit, including IP addresses; nothing is stored beyond short-lived caches and logs | Global network |
| Stripe US company | Checkout, subscription billing, invoices, and the billing portal | Name, email, billing address, and card details - card numbers never reach EZQR's server | United States |
| Brevo French company | Transactional email delivery: login codes, receipts, account notices | Email address and the contents of each message | European Union |
What Stays on the Toronto Server
Your account, every dynamic QR code and the link it opens, per-scan analytics, any PDF, menu, or logo you upload, the login database, and database backups all live on the one DigitalOcean server in Toronto. A full backup of that server - the database and every uploaded file - is encrypted with restic before it leaves the server and written to Backblaze's Canada East region, also in Toronto, so a failure of the one server does not mean a loss of your codes or files. Backblaze stores the encrypted archives and never has the key. The approximate scan location shown in analytics is worked out from an IP-to-location database on that same server; scanner IP addresses are not sent to a third party to be geolocated. A full breakdown is on the data residency page.
How Unique Scanners Are Counted
EZQR counts unique scanners with a visitor hash: a short code that only tells us "the same phone scanned one of this organization's QR codes earlier today", and that can no longer be traced back to anyone once the day is over. It needs no cookies and stores nothing on the scanner's phone.
Every request a phone makes to open a web page includes an IP address and a user agent (a line of text naming the browser and device). To tell scanners apart, EZQR combines those two with the ID of the organization that owns the scanned QR code and a secret random value for the day, then puts the result through a one-way function:
visitor hash = SHA-256(today's secret + organization ID + IP address + user agent)- The secret changes every day. Each day (UTC) gets a new 256-bit random secret, deleted once the day is over and never backed up. Without it, reversing a visitor hash would mean guessing a 256-bit random value, which isn't feasible with any computer, now or foreseeable.
- Each organization gets its own hashes. The organization's ID is part of the input, so one phone scanning codes from two different organizations produces two unrelated hashes. The hash can't follow a person from one organization's codes to another's.
- Only part of it is kept. The stored hash is the first 16 characters of the result - enough to count scanners apart, nothing more.
For organizations that need a stronger guarantee than this, such as schools, governments, and healthcare, EZQR offers privacy mode, which keeps no data that could identify a scanner. In privacy mode, scans are stored without a visitor hash, scan times are rounded to the hour, approximated coordinates are rounded to about 10 km, and any optional features that ask scanners for their GPS location are forced off. Analytics still show scan counts, times, devices, and approximate locations, but not unique scanners. Email [email protected] to ask about enabling it.
Services That Are Not Sub-processors
Two services touch EZQR without handling customer data, listed here so the table above is not read as incomplete:
- UptimeRobot polls a public scan endpoint to produce the uptime history at uptime.ezqr.ca. It sees the same thing any visitor sees and no customer data.
- IP2Location supplies the offline database used for approximate scan location. The database is downloaded to the Toronto server; no scan data is sent to IP2Location.
How This List Is Maintained
EZQR is run by one person, who also writes the code that talks to each of these vendors, so the list is maintained from the source rather than from a compliance questionnaire. When a vendor is added or removed, this page and the privacy policy change together and the date at the top moves. If something here looks out of date, email [email protected].