Version 2026-11-01. Companies that process personal data for Zoi ID. Each is bound by a written data processing agreement. Partners get 30 days' notice by email before we add or replace one, and can object.
| Company | What they do for Zoi ID | Data they can access | Location |
|---|---|---|---|
| Hetzner Online GmbH | server hosting (compute, disks, backups of the server) | everything Zoi ID stores, always encrypted at rest | Germany (EU) |
| Cloudflare, Inc. | network protection, TLS, DNS, storage of encrypted backups (R2) | data in transit to the API (decrypted only at the network edge, not stored); encrypted backups (no key) | global edge network; R2 storage in the EU |
| Google LLC | Play Integrity: a yes/no answer about the app and device on Android | an app integrity token, no identity data | United States |
| Apple Inc. | App Attest: a proof that the request comes from the genuine iOS app | an attestation object, no identity data | United States |
For the partner dashboard only (data of partner staff, never of the people you verify; Zoi ID is the controller of this data):
| Company | What they do | Data they can access | Location |
|---|---|---|---|
| Resend, Inc. | sends dashboard sign-in and invite emails | the staff member's email address and the email text | United States |
Data published by governments and used to check documents and sanctions lists (for example the German BSI CSCA master list, OFAC, UN, EU and UK sanctions lists, Wikidata) is downloaded by us; nothing about users is sent to those sources.