Every company that processes data on our behalf, what they do with it, and where they are.
Effective 25 July 2026.
A sub-processor is a company that processes your data on our behalf. Every one of them is bound by a written contract with data protection obligations no weaker than the ones in our Data Processing Addendum, and we stay liable to you for what they do.
This list is complete. There is no separate tier of "infrastructure providers" that we leave off.
| Provider | Purpose | Data | Location |
|---|---|---|---|
| Cloudflare, Inc. | Application hosting, object storage, queues, caching, and DNS | All service data, including raw messages and attachments | EU jurisdiction for object storage and Durable Objects; edge compute worldwide |
| Neon, Inc. | Managed PostgreSQL database | Accounts, mailboxes, message headers and bodies, contacts, notes, encrypted vault records | European Union (AWS Frankfurt, eu-central-1) |
| Amazon Web Services, Inc. | Sending and receiving email (SES) and inbound message storage | Outbound and inbound messages, sender and recipient addresses, delivery events | European Union (Ireland, eu-west-1) |
| Stripe, Inc. | Subscription billing and payment processing | Billing contact, payment method (held by Stripe, never by us), invoices, usage totals | United States and Ireland |
| PayPal (Europe) S.à r.l. et Cie, S.C.A. | Affiliate commission payouts | Affiliate name, PayPal address, payout amounts | Luxembourg |
We announce a new or replacement sub-processor by email to account holders at least 30 days before it starts processing your data. If you object on reasonable data protection grounds within those 30 days, we will work with you on an alternative, and if there is none you may terminate the affected part of the service and get back fees paid for the unused period.
To be told about changes, or to ask about a specific provider, use the contact form.