This document is published in English only. It is the authoritative version and applies regardless of the language you are browsing the rest of the site in.
A sub-processor is a third party we engage that may process personal data in the course of delivering the Service. Publishing the list is an Article 28 obligation, and it is also the only honest way to answer "who else can see my data".
Every party below is under a written contract restricting it to processing on our instructions, for the stated purpose only. We assess each one before engaging it, and again when its role changes.
01Verification pipeline
These handle, or could handle, the addresses you submit for verification. The list is deliberately short: the fewer parties an address passes through, the smaller the question you have to answer to your own regulator.
| Provider | Role | Data | Location |
|---|
| OVHcloud | Infrastructure hosting for the verification platform and its database. | Email addresses submitted for verification | European Union |
| Cloudflare | DNS, TLS termination, web application firewall and bot mitigation on public endpoints. | Request metadata; addresses in transit through the free checker | Global edge, EU-first routing |
02Account, billing and communication
These handle data about you as a customer. They do not receive the addresses you submit for verification.
| Provider | Role | Data | Location |
|---|
| Stripe | Payment processing and invoicing. | Name, billing address, VAT number, payment details (card data is handled by Stripe and never reaches us) | European Union / United States |
| Resend | Transactional email: verification links, password resets, job completion notices. | Name, email address, message content | European Union / United States |
| Google | Optional sign-in with Google, for accounts that choose it. | Email address, name, profile identifier | United States |
| Google Analytics | Aggregate site usage, for visitors who accepted analytics cookies. Not loaded at all for anyone who did not. | IP address, device and browser data, pages viewed | United States |
03Transfers outside the EEA
Where a provider above is located outside the European Economic Area, the transfer is made under the European Commission's Standard Contractual Clauses, supported by a transfer impact assessment and by technical measures: encryption in transit, and minimising what is sent in the first place.
The verification pipeline itself runs in the European Union. An address you submit for verification does not leave the EU as part of that processing.
04What is not on this list
We do not use advertising networks, audience-building platforms or data brokers. The only third-party analytics is the Google Analytics row above, which runs only for visitors who accepted it.
We do not send customer data to third-party AI providers for training or analysis.
05Changes to this list
We give at least 30 days' notice before adding or replacing a sub-processor. Account holders are notified by email and this page is updated with a new revision date.
If you object on reasonable data protection grounds and we cannot resolve it, you may terminate the affected part of the Service without penalty and receive a refund of any prepaid, unused balance. The Data Processing Agreement sets out that right in full.
To be notified of changes, or to ask about a specific provider, write to [email protected].