Sub-processors
The vendors who handle your data. GDPR-required disclosure.
Ask an assistant to explain it
Get a short, plain-language summary of this page.
What is a sub-processor?
A sub-processor is a vendor that processes customer data on our behalf. These are the vendors that handle your data. Each vendor has a specific purpose. We don’t share data beyond what’s needed. We update this list when anything changes.
Updated , after we checked this list against our code: ten services that were already in use were missing and are listed now, dated that day; Amazon Web Services and Anthropic, which we no longer use, are gone; and the descriptions of Cloudflare, Vercel, Google Analytics and GrainQL are corrected.
On this site, Google Analytics, GrainQL, PostHog and our own analytics server follow one rule: in the EEA, the UK and Switzerland none of them loads until you agree; everywhere else they are on by default, and you can switch them off in the privacy policy. A Global Privacy Control signal switches them off everywhere. Gleap’s support chat and Better Stack’s status pill load for every visitor, and YouTube only once you press play on a video.
Current sub-processors
| Vendor | Purpose | Data category |
|---|---|---|
| CloudflareAdded | Sends the mail your agents send, receives the mail sent to them, and reports delivery for each recipient. | Full message content, senders and recipients, per-recipient delivery events, sign-in links |
| VercelAdded | Hosts the dashboard and the API. | Everything sent to the API: account data, message content, raw received mail |
| NeonAdded | Managed Postgres, the primary database. | Application data, message content, raw received mail |
| OpenAIAdded | Model inference for the classifier: the prompt-injection scan, intent and entities on received mail, the check that mail you send is not cold or bulk mail, and the homepage's scan demo. OpenAI does not train on API data by default, and keeps abuse-monitoring logs for up to 30 days. | Sender address, subject and body of received mail; subject and body of mail you send; text pasted into the scan demo |
| OVHUnited StatesAdded | Runs our own mail servers, which send sign-in links when the main route cannot, and mail from verified custom domains and workspace subdomains. | Full message content, senders and recipients |
| HetznerUnited States and FinlandAdded | Hosts this website, our own analytics server and our own error tracker. | Requests to this site; the email address, IP address and referral data sent with a sign-up; dashboard page views, account emails and revenue events; server error events |
| StripeAdded | Billing and payment processing only | Billing identity, payment method |
| SentryUnited StatesAdded | Error reports from the dashboard in your browser, with a replay of the moments before an error, all text and inputs masked. | Browser errors, masked replays, page addresses, IP address |
| PostHogUnited StatesAdded | Product analytics: page views, clicks and session recordings with all text and inputs masked. In the dashboard it runs for every signed-in user and knows your user ID and email; on this site it follows the consent rule above. | User ID and email (dashboard), page views, clicks, masked session recordings |
| GleapAdded | Support chat and product updates in the dashboard and on this site, and our help centre. It loads for every visitor. | Email, workspace, plan and billing status (dashboard); chat messages; visits to this site |
| Google WorkspaceAdded | Our support mailbox. | Mail you send to support, including data-protection and DPA requests |
| Better StackAdded | Our status page, and the status pill in this site's footer. It loads for every visitor. | IP address and browser details |
| Google AnalyticsAdded | Traffic measurement on this site, under the consent rule above. | Page views, referrer, coarse location, device/browser |
| GrainQLAdded | Heatmaps and session recordings on this site, to find where people get stuck, under the consent rule above. | Page views, clicks, scroll depth, session recordings |
| jsDelivrAdded | Serves the diagram library on blog posts that have diagrams. | IP address |
| YouTubeAdded | Plays the videos on this site in privacy-enhanced mode, only after you press play. | IP address, once you press play |
Notification of changes
Whenever this list changes (added vendor, changed region, expanded data category), we publish a /changelog entry tagged sub-processors. Subscribe to /changelog to be notified of changes. For DPAs or vendor-specific contracts, email support@mails.ai.
What to read next.
Our security posture is on the Trust page, in plain words. How we handle your data is in the privacy policy, and the terms for using mails.ai, in plain English, are in the terms of service.