Legal
Sub-processors
Last updated: 4 November 2026
For the mail we host for you, you are the controller and Webco S.r.l.s., which operates FounderMail, is your processor. These are the providers we engage to process that data on your behalf. Each processes only what its role needs, under written terms that protect it at least as well as ours. The terms we process it under are in our Data Processing Agreement; how we handle data more generally is in the Privacy Policy.
Current sub-processors
| Provider | What it does | Where | Transfers outside the EEA |
|---|---|---|---|
| Microsoft S.r.l. (Microsoft Azure) | Hosting: application servers, database, file storage, key management. Holds everything the service stores, including mail content. | United States (West US 2) | Standard Contractual Clauses in Microsoft's data protection terms; Microsoft Corporation is certified under the Data Privacy Framework |
| Amazon Web Services EMEA SARL (Amazon SES) | Delivery of the mail you send. Mail passes through; it is not stored there. | EU (Ireland) | Standard Contractual Clauses in AWS's data processing terms; Amazon Web Services, Inc. is certified under the Data Privacy Framework |
| Cloudflare, Inc. | Bot protection (Turnstile) on sign-up and on the website forms you embed: the IP address and browser signals of whoever completes a challenge. | Global network | Data Privacy Framework; Standard Contractual Clauses in Cloudflare's data processing terms |
| Anthropic Ireland, Limited | The optional AI assistant, only for accounts that turn it on, and only when someone asks for a draft. Not used to train models. | United States | Standard Contractual Clauses in Anthropic's data processing terms |
| Functional Software, Inc. (Sentry) | Error tracking: an error report may include an identifier and the details of the request that failed. | EU (Germany) | Stored in the EU; Data Privacy Framework and Standard Contractual Clauses for any access from the United States |
| Plus Five Five, Inc. (Resend) | Account emails to the people on your account, which may name a domain, a mailbox or a contact. | United States | Data Privacy Framework |
"Data Privacy Framework" means the EU–US Data Privacy Framework (with its UK extension and Swiss framework where the provider is certified under them), recognised by the European Commission's adequacy decision of 10 July 2023. Certifications were checked on the official list at dataprivacyframework.gov on 4 November 2026. Should a mechanism we rely on stop being valid, we rely on the Standard Contractual Clauses or another valid mechanism.
Who is not on this list
- Stripe processes payments as its own controller; it never sees the mail we host.
- Apple, Google, Mozilla and Microsoft push services deliver the notifications you turn on, encrypted end to end to your device; they carry only ciphertext.
- The places you send mail to: recipients, forwarders, webhooks and integrations you configure receive what you direct to them, on your instructions.
Changes
We update this page before a new or replacement sub-processor starts processing your data, and email account owners at least 30 days ahead. If you object to a change, tell us through the contact form within that period, with your reasons.