Last updated: 1 July 2026 — Version 1.0
EmailConsul LLC engages the following sub-processors to deliver the Platform and Services. All sub-processors are bound by written data processing agreements imposing obligations at least as protective as those under the GDPR. This list is maintained pursuant to Clause 9(a) (Option 2 — General Authorisation) of the Standard Contractual Clauses incorporated in our Data Processing Agreement.
We will notify registered users by email at least 30 days before adding or replacing any sub-processor. To object to a proposed change on legitimate data protection grounds, contact [email protected] within 14 days of notification.
| Sub-Processor | Country | Purpose | Data Categories | Retention | Transfer Mechanism |
|---|---|---|---|---|---|
| MongoDB, Inc. | United States | Cloud database — primary storage of all platform data | Account data, usage data, API credentials, email list data, DMARC data | Subscription + 30 days | SCCs (EU 2021/914, Module 3) + DPF |
| Amazon Web Services, Inc. | United States | Cloud infrastructure, object storage, logging, transactional email (SES) | All categories of platform data | Subscription + 30 days | SCCs (EU 2021/914, Module 3) + DPF |
| DigitalOcean, LLC | United States | Application hosting (Kubernetes cluster) | All platform data processed during application operation | Subscription + 30 days | SCCs (EU 2021/914, Module 3) + DPF |
| Cloudflare, Inc. | United States | CDN, DDoS protection, TLS/SSL termination, edge security | IP addresses, HTTP request metadata, cookies | Max 30 days (logs) | SCCs (EU 2021/914, Module 3) + DPF |
| Stripe, Inc. | United States / Ireland | Payment processing and subscription billing | Billing name and email, address, VAT number, subscription details | 7 years (financial records) | SCCs (EU 2021/914, Module 3) + DPF |
| Twilio Inc. (SendGrid) | United States | Transactional email delivery | Recipient email, email content | 90 days (logs) | SCCs (EU 2021/914, Module 3) + DPF |
| Slack Technologies, LLC (Salesforce) | United States | Internal operational alerting (EmailConsul team only) | Operational metadata; no direct customer personal data | Duration of service relationship | SCCs (EU 2021/914, Module 3) + DPF |
| Functional Software, Inc. (Sentry) | United States | Application error and performance monitoring | Error data, stack traces, session identifiers | 90 days | SCCs (EU 2021/914, Module 3) + DPF |
| OpenAI, L.L.C. | United States | AI-assisted platform features | Text inputs to AI features only; no email lists or personal data sets | 30 days | SCCs (EU 2021/914, Module 3) + DPF |
Version 1.0 — 1 July 2026: Initial publication. Sub-processors listed: MongoDB, Inc.; Amazon Web Services, Inc.; DigitalOcean, LLC; Cloudflare, Inc.; Stripe, Inc.; Twilio Inc. (SendGrid); Slack Technologies, LLC (Salesforce); Functional Software, Inc. (Sentry); OpenAI, L.L.C.
Future updates will be published here. All registered users will be notified by email at least 30 days before changes take effect.