$ nslookup api.confirm.io Non-authoritative answer: api.confirm.io canonical name = midentssl-861843077.us-west-2.elb.amazonaws.com. Name: midentssl-861843077.

$ nslookup api.confirm.io Non-authoritative answer: api.confirm.io canonical name = midentssl-861843077.us-west-2.elb.amazonaws.com. Name: midentssl-861843077.us-west-2.elb.amazonaws.com Address: 54.149.15.14 Name: midentssl-861843077.us-west-2.elb.amazonaws.com Address: 52.25.246.175 Hosted in the US on Amazon. That makes it immediately a no-go for European customers. So, what's the data retention policy? Who has access to it? Is any PII contained in the webserver logs? If the answer is "no", how do you define PII? Have you had a third party security audit done? If so, can we see the report? Those are just a few of my initial questions :)