Question 1

Is Pondral GDPR compliant?

Accepted Answer

Pondral is built to support GDPR obligations: our Data Processing Addendum, incorporating EU/UK Standard Contractual Clauses, is published at pondral.com/dpa and is incorporated into our Terms of Service, so it takes effect when you accept them. A countersigned copy is available on request. We do not hold a third-party GDPR certification.

Question 2

Where is my data processed?

Accepted Answer

Pondral processes data in the United States (AWS us-east-1) through our managed infrastructure providers, Supabase and Vercel. A dedicated EU data-residency region is on our roadmap but not yet available. If EU residency is a requirement, contact us before signing.

Question 3

What compliance documents does Pondral provide?

Accepted Answer

Pondral publishes a Data Processing Addendum (DPA), a subprocessor list with 30-day change notice, and a trust report. A third-party penetration test has not yet been conducted; an internal security-audit summary is available on request. Full vendor-review packages are available on request.

Question 4

Is Pondral CCPA / CPRA compliant?

Accepted Answer

Pondral is built to support CCPA and CPRA obligations. We do not sell or share personal information for cross-context behavioral advertising; you can opt out of analytics via our cookie banner and exercise your other privacy rights by contacting us.

Built for regulated teams.

Frameworks

Data residency

Documents