Sub-processors
Epostix uses a deliberately short list of third parties. This page identifies each provider that processes personal data in connection with the Service, as required for transparency under Art. 28 GDPR, and forms Annex 3 of the Data Processing Agreement.
Customer Content never leaves the EU. Email content, recipient data, and engagement events are stored and processed exclusively in EU data centres. The third-country providers below touch only ancillary data (payments, network metadata), under Art. 46 safeguards.
Sub-processors of Customer Content
These providers process personal data contained in Customer Content on behalf of our customers:
| Provider | Purpose | Location | Transfer mechanism |
|---|---|---|---|
| Hetzner Online GmbH | Cloud infrastructure hosting the entire platform: sending, storage, databases, backups | Germany (Falkenstein, Nuremberg) and Finland (Helsinki) | None — EU processing only |
Service providers for Epostix's own processing
These providers process personal data for which Epostix is the controller (billing and website operations). They do not receive Customer Content:
| Provider | Purpose | Data | Location | Transfer mechanism |
|---|---|---|---|---|
| Stripe Payments Europe, Ltd. (with Stripe, Inc.) | Payment processing, invoicing, fraud prevention | Billing and payment data of customers | Ireland; limited processing by Stripe, Inc. (USA) | EU–US Data Privacy Framework and Standard Contractual Clauses |
| Cloudflare, Inc. | DNS, DDoS mitigation, bot verification (Turnstile) on the registration flow | Technical metadata of visitors (IP address, browser signals) | Global network; USA headquarters | EU–US Data Privacy Framework and Standard Contractual Clauses |
Website analytics run on a self-hosted Plausible instance on our own EU infrastructure — no third party receives analytics data, no cookies are used.
Changes to this list
We give account owners at least 30 days' notice by email before adding or replacing a sub-processor, per Section 5 of the DPA, including the new provider's identity, purpose, location, and transfer mechanism. Customers may object on reasonable data protection grounds within the notice period. If you want change notices at an additional address, email [email protected].