DDMQ: EU residency: DPA v1.2 contradictions
Hi team, I read DPA v1.2 and the sub-processor list. Before buying, a few gaps:
1. Section 9.1 says EU auth/session data stays in the EEA, but Clerk (auth, sessions) is listed as US-only. Which is correct?
2. Your entity is in India. Can staff access EU databases remotely from India (support, admin)? If so, is it logged?
3. Are file uploads in R2 also pinned to the EU, or only backups?
4. Can we get support without data going via Zoho (India/US)?
5. Do you have an EU representative (Art. 27 GDPR), and what legal entity signs the DPA?
6. Would you accept on-site audits per Art. 28(3)(h) GDPR?
Thanks!
Riya_NoCodeBackend
Nov 7, 2026A: Hi there! Thank you for the thorough review of our DPA and compliance terms. Here are answers to each of your questions:
1. Clerk vs. EU Residency (Section 9.1)
They govern two separate layers:
Developer Dashboard Login (Clerk — US): Used solely for your developer account login to access the NoCodeBackend platform management console, covered by EU Standard Contractual Clauses (SCCs) and the EU-U.S. Data Privacy Framework.
Your End-Users' Auth & Sessions (EU): If you provision an EU database, all authentication tables, user credentials, password hashes, and session data for your own application's end users are stored entirely within your database in the EU (Frankfurt, Germany) and never leave the EEA.
2. Remote Access from India & Audit Logging
Remote technical maintenance and support from our team in India is legally covered by EU Standard Contractual Clauses (SCCs Module 2: Controller-to-Processor) included in our DPA.
Access is strictly restricted to authorized senior technical personnel on a need-to-know basis for customer-requested support.
All administrative sessions and access requests are strictly logged in our audit trail with timestamps, user IDs, and session scopes.
3. File Uploads in Cloudflare R2
Application File Uploads: For storing your end-users' files, you connect your own storage bucket (Cloudflare R2 or S3-compatible) directly, allowing you to select and pin your desired EU region under your direct control.
4. Support Without Data Transiting Zoho
Yes. We recommend never sending live production databases or personal data over email.
Technical support can be conducted using anonymized test data, sanitized reproduction steps, or secure, ephemeral in-platform diagnostics without exporting or routing your database records through email or ticketing systems.
5. Legal Entity & EU Representative (Art. 27 GDPR)
Legal Entity: The DPA is executed with NoCodeBackend (Gurugram, Haryana, India), represented by founder Simarpreet Singh.
Governing Law: Governed under the laws of Ireland, with the Irish Data Protection Commission (DPC) as the supervisory authority for the EU SCCs.
Article 27: Core platform processing qualifies for the Article 27(2)(a) exemption. The EU SCCs provide the legally binding transfer mechanism for our EU customers.
6. Audits under Art. 28(3)(h) GDPR
Physical access to server cages in enterprise cloud facilities (Oracle Cloud Infrastructure and Cloudflare) is restricted by the facility operators to protect multi-tenant security.
In line with industry standards and Section 7 of our DPA, we fulfill Art. 28(3)(h) by providing independent third-party compliance certifications (SOC 2, ISO 27001) and accommodating remote security audits and detailed compliance questionnaires once per year upon reasonable advance notice.
Thanks,
Riya
Thanks! 3 foll-ups:
1. The DPA names NoCodeBackend (Gurugram), the Terms end with "NoCodeBackend Inc." Which registered company signs, with which legal form and registration number?
2. I don't mean data centers: is there a SOC 2 or ISO 27001 report for NoCodeBackend itself (your staff, processes, access controls), not OCI's?
3. Can customers see the admin access logs for their own EU databases?
1. Contracting Legal Entity
The formal contracting party that executes the DPA and governs our service agreements is NoCodeBackend, a registered business entity based in Gurugram, India. For all contractual, legal, and compliance purposes, the governing entity is NoCodeBackend, as specified in the agreement.
2. No. NoCodeBackend as a company does not hold a standalone SOC 2 or ISO 27001 certification.
Our infrastructure providers hold full SOC 1/2/3 and ISO 27001 certifications for environments where your data resides, and our architecture enforces strict GDPR compliance. However, if your internal procurement policy strictly mandates a vendor-level SOC 2 report, NoCodeBackend may not be the right fit.
3. Admin Access Logs
Admin and support access is recorded in our internal system audit logs, rather than displayed directly in the self-serve customer dashboard. If you ever need verification of administrative access regarding your specific instance, our team can provide the relevant logged records upon request under the DPA.