# EZQR Sub-processors Source: https://ezqr.ca/subprocessors Last modified: 2026-09-29 Description: Every third party that handles EZQR customer data, with its purpose, the data involved, and the country. Hosted on DigitalOcean in Toronto, backed up to Backblaze in Toronto; Stripe, Brevo, and Cloudflare handle specific slices. Every third-party company that handles EZQR customer data, what it does, which data it receives, and where it is. Last updated September 29, 2026. ## The List **EZQR stores customer data on a DigitalOcean server in Toronto, Ontario, keeps off-site backups of that server with Backblaze in Toronto, and uses three other vendors for payments, email delivery, and traffic in transit.** This is the complete list; if a vendor is not here, EZQR does not send it customer data. | Sub-processor | Purpose | Data involved | Location | | --- | --- | --- | --- | | **DigitalOcean** US company | Cloud hosting for the application, database, uploaded files, and backups | Everything EZQR stores: account details, QR codes and destinations, scan analytics, uploads, login records | Toronto, Ontario, Canada (TOR1 region) | | **Backblaze** US company | Off-site object storage for full backups of the database and uploaded files | Backup copies of everything on the Toronto server: account details, QR codes and destinations, scan analytics, uploads, login records. Encrypted on the Toronto server before upload (restic); Backblaze holds only the encrypted archives and never the key | Toronto, Ontario, Canada (CA East region) | | **Cloudflare** US company | DNS, TLS, content delivery, and protection against abusive traffic | Web requests in transit, including IP addresses; nothing is stored beyond short-lived caches and logs | Global network | | **Stripe** US company | Checkout, subscription billing, invoices, and the billing portal | Name, email, billing address, and card details - card numbers never reach EZQR's server | United States | | **Brevo** French company | Transactional email delivery: login codes, receipts, account notices | Email address and the contents of each message | European Union | ## What Stays on the Toronto Server Your account, every dynamic QR code and the link it opens, per-scan analytics, any PDF, menu, or logo you upload, the login database, and database backups all live on the one DigitalOcean server in Toronto. A full backup of that server - the database and every uploaded file - is encrypted with restic before it leaves the server and written to Backblaze's Canada East region, also in Toronto, so a failure of the one server does not mean a loss of your codes or files. Backblaze stores the encrypted archives and never has the key. The approximate scan location shown in analytics is worked out from an IP-to-location database on that same server; scanner IP addresses are not sent to a third party to be geolocated. A full breakdown is on the [data residency](https://ezqr.ca/qr-code-data-residency-canada) page. ## How Unique Scanners Are Counted **EZQR counts unique scanners with a visitor hash: a short code that only tells us "the same phone scanned one of this organization's QR codes earlier today", and that can no longer be traced back to anyone once the day is over.** It needs no cookies and stores nothing on the scanner's phone. Every request a phone makes to open a web page includes an IP address and a user agent (a line of text naming the browser and device). To tell scanners apart, EZQR combines those two with the ID of the organization that owns the scanned QR code and a secret random value for the day, then puts the result through a one-way function: ``` visitor hash = SHA-256(today's secret + organization ID + IP address + user agent) ``` - **The secret changes every day.** Each day (UTC) gets a new 256-bit random secret, deleted once the day is over and never backed up. Without it, reversing a visitor hash would mean guessing a 256-bit random value, which isn't feasible with any computer, now or foreseeable. - **Each organization gets its own hashes.** The organization's ID is part of the input, so one phone scanning codes from two different organizations produces two unrelated hashes. The hash can't follow a person from one organization's codes to another's. - **Only part of it is kept.** The stored hash is the first 16 characters of the result - enough to count scanners apart, nothing more. For organizations that need a stronger guarantee than this, such as schools, governments, and healthcare, EZQR offers privacy mode, which keeps no data that could identify a scanner. In privacy mode, scans are stored without a visitor hash, scan times are rounded to the hour, approximated coordinates are rounded to about 10 km, and any optional features that ask scanners for their GPS location are forced off. Analytics still show scan counts, times, devices, and approximate locations, but not unique scanners. Email [support@ezqr.ca](mailto:support@ezqr.ca?subject=Privacy%20mode) to ask about enabling it. ## Services That Are Not Sub-processors Two services touch EZQR without handling customer data, listed here so the table above is not read as incomplete: - **UptimeRobot** polls a public scan endpoint to produce the uptime history at [uptime.ezqr.ca](https://uptime.ezqr.ca/). It sees the same thing any visitor sees and no customer data. - **IP2Location** supplies the offline database used for approximate scan location. The database is downloaded to the Toronto server; no scan data is sent to IP2Location. ## How This List Is Maintained EZQR is run by one person, who also writes the code that talks to each of these vendors, so the list is maintained from the source rather than from a compliance questionnaire. When a vendor is added or removed, this page and the [privacy policy](https://ezqr.ca/privacy-policy) change together and the date at the top moves. If something here looks out of date, email [support@ezqr.ca](mailto:support@ezqr.ca). ### At a glance - Data at rest: Toronto, Ontario (server and backups) - Off-site backups: encrypted before upload - Sub-processors: 5, listed above - Outside Canada: payments, email, transit - Card numbers: Stripe only, never EZQR - QR content and URLs: Toronto server only - Last updated: September 29, 2026 ### Related - [Data residency in Canada](https://ezqr.ca/qr-code-data-residency-canada) - [Uptime SLA](https://ezqr.ca/sla) - [Privacy policy](https://ezqr.ca/privacy-policy) - [Official EZQR site](https://ezqr.ca/official) ## Sub-processor FAQ ## What is a sub-processor? A sub-processor is a third-party company that handles some of your data on EZQR's behalf - the hosting provider, the payment processor, the email delivery service. Vendor reviews and privacy assessments ask for the list so they can see who could touch the data, for what purpose, and in which country. EZQR's full list is on this page. ## Where is EZQR's customer data stored? On a DigitalOcean server in Toronto, Ontario, Canada. That server holds the application, the database, uploaded files, and database backups. A full backup of that server - database and uploaded files - is encrypted and kept off-site with Backblaze, in its Canada East region, which is also in Toronto; the encryption key stays with EZQR. The other sub-processors handle specific slices - payments, email delivery, traffic in transit - and are listed on this page with the data each one receives. ## Which of EZQR's sub-processors are outside Canada? Stripe (payments), Brevo (email delivery), and Cloudflare (traffic in transit) are all outside Canada. DigitalOcean and Backblaze are both US companies, but the regions EZQR uses are in Toronto, so the stored data and its backups stay in Canada. ## How do I get this list for a vendor or privacy review? Print or save this page - it is the current list, with the date of the last change at the top. If your review needs it as a signed document or needs a statement about server location that you cannot verify from outside, email support@ezqr.ca and ask. The person who answers is the same person who runs the servers. ## How will I know if the sub-processor list changes? The "last updated" date on this page changes whenever a vendor is added or removed. Paying subscribers who need advance notice of changes for compliance reasons can ask for it at support@ezqr.ca. --- EZQR: static QR codes are free forever; dynamic QR codes (editable destination, scan analytics) require a plan. Site summary for agents: https://ezqr.ca/llms.txt - every page in one document: https://ezqr.ca/llms-full.txt Any page is available as Markdown at its own URL with `Accept: text/markdown`, or by appending `.md` to the path.