The list below is complete as at 2026-08-15. Under section 4 of the data processing addendum we give at least 30 days’ notice by email before adding or replacing any of them.
Worth stating explicitly, because it is unusual: there is no email provider on this list. We are not reselling Amazon SES or anyone else, so your recipients’ addresses are not handed to a third-party sender in order to deliver your mail. That is the whole point of running our own infrastructure.
| Sub-processor | What it does | What it processes | Where |
|---|---|---|---|
| Hostinger International | Virtual private servers running the API, the mail servers, the database and Redis. | All service data, including message content while it is queued and delivery records. | European Union (Lithuania) |
| Cloudflare | DNS, TLS termination and protection against denial-of-service and abuse at the edge. | Request metadata — IP address, user agent, requested URL. No message content. | Global edge network. Transfers under standard contractual clauses. |
| GitHub (Microsoft) | Source control and the container registry the deployed images are pulled from. | No customer personal data. Listed because deployment artefacts pass through it. | United States. Transfers under standard contractual clauses. |
Payments
No payment processor is listed yet because paid plans are not generally available during private testing. When one is engaged it will be added here, with 30 days’ notice, before it processes anything.
Objecting to one
If you reasonably object to a sub-processor on data protection grounds, email [email protected] within the notice period. We will work to find an alternative, and if we cannot you may terminate the affected service and get a refund of prepaid fees for the unused period.