Subprocessors
Vendors and infrastructure providers Mailthentic uses to deliver the service.
Last updated: May 2026
The vendors below process Controller data on our behalf as part of delivering the Mailthentic service. We notify customers at least 30 days before adding a new subprocessor; see Section 5 of our Data Processing Agreement.
Infrastructure
| Vendor | Purpose | Region | Data accessed |
|---|---|---|---|
| Amazon Web Services (AWS) | Application hosting (EC2), object storage | United States | All Controller data while in transit and at rest |
| Hostinger | SMTP verification worker (port 25 egress) | European Union | Email addresses being verified, domain MX data |
Billing & Payments
| Vendor | Purpose | Region | Data accessed |
|---|---|---|---|
| Stripe | Payment processing, subscription billing, invoicing | United States, Ireland (EU) | Customer name, billing email, payment details, transaction history |
Analytics, Advertising & Monitoring
These services do not receive Controller upload-list data. They load only when enabled and when the applicable consent category permits them. Microsoft Clarity may also be enabled in the customer dashboard. Visitors can change or withdraw consent on the cookie preferences page.
| Vendor | Purpose | Region | Data accessed |
|---|---|---|---|
| Google Analytics | Marketing-site usage analytics (consent: analytics) | United States | Page-view metadata; not Controller list data |
| Microsoft Clarity | Session and interaction analytics, to find where visitors get stuck (consent: analytics) | United States | Page interaction and navigation data on enabled public and dashboard surfaces; not Controller upload-list data |
| Meta Platforms (Meta Pixel) | Measuring whether our advertising leads to signups (consent: marketing) | United States | Marketing-site page views and signup conversion events. Meta may use this across other sites, which is why it is a marketing category and is off until consented |
Geolocation Data (Not a Subprocessor)
We determine an approximate country and network operator from an IP address to apply the correct privacy regime and to detect signup abuse. This is deliberately not a subprocessor relationship: we download the MaxMind GeoLite2 databases and run every lookup on our own servers, so no IP address or visitor data is ever sent to MaxMind or any other geolocation vendor.
Updates & Notifications
To receive notification of changes to this list, email privacy@mailthentic.com with the subject "Subprocessor updates".