1. Current subprocessors
These vendors process customer data on our behalf, under contract, for the purposes stated. Each is bound to confidentiality and data protection obligations at least as strict as ours.
| Subprocessor | Purpose | Data | Location |
|---|---|---|---|
| Amazon Web Services Amazon Web Services EMEA SARL |
Email sending and receiving (SES), delivery event notifications (SNS), object storage for attachments and raw inbound mail (S3) | Message content, recipients, headers, delivery events | Ireland (eu-west-1) · EU |
| Hostinger Hostinger International Ltd |
Virtual server hosting the application, database, queue and cache | All application data at rest | Lithuania · EU |
| GitHub GitHub, Inc. (Microsoft) |
Source control, CI, and the container registry production images are pulled from | No customer data. Application source and build artefacts only. | United States |
| Bunny Fonts BunnyWay d.o.o. |
Webfonts on the public marketing and legal pages | None. The service does not log requests or set cookies. | Slovenia · EU |
Where you connect your own sending provider credentials, that provider becomes a subprocessor of yours rather than ours — you chose it, you contract with it, and your messages leave through your account with it. It will not appear on this list.
2. What we self-host
Worth stating explicitly, because the usual version of this page is three times longer. We run these ourselves rather than buying them, so customer data never reaches a vendor for them:
| Function | Commonly outsourced to | We use |
|---|---|---|
| Authentication | Auth0, Clerk, WorkOS | Our own, on our own database |
| Webhook delivery | Svix, Hookdeck | Our own queue and signer |
| Database and cache | Managed Postgres, managed Redis | Self-hosted, private network, no public listener |
| Product analytics | PostHog, Mixpanel, Segment | None. We run no analytics and no trackers. |
| Error tracking | Sentry, Bugsnag | Our own logs, on our own host |
| Support desk | Plain, Intercom, Zendesk |
Every row is one fewer place a message body can end up, and one fewer vendor breach that becomes your incident.
3. Transfers
Customer data is stored in the European Union. The only vendor above outside the EEA is GitHub, which holds no customer data — source code and build artefacts only.
Amazon Web Services EMEA SARL is a Luxembourg entity and our data sits in Ireland; where AWS's own operations involve a transfer outside the EEA, it is covered by the European Commission's Standard Contractual Clauses under the AWS Data Processing Addendum.
4. Change notification
We update this page whenever a subprocessor is added or removed, and change the effective date at the top.
To be told when that happens, write to [email protected] and we will add you to the notice list. We give notice before a new subprocessor begins processing, so you have time to object.