Draft — pending legal review. This document has not yet been reviewed by counsel and may change before Irisend is generally available.
Subprocessors
Effective date: 2026-09-25 Last updated: 2026-09-25
This page lists the subprocessors Irisend ("Irisend") engages to provide the Service, as required under Article 28(2)-(4) GDPR and our Data Processing Agreement. By using the Service, and subject to the DPA, Customer grants Irisend general written authorization to engage the subprocessors listed below.
Notice of Changes
We will give Customers at least 14 days' advance notice (via email to the account's billing/technical contact and/or a changelog entry at [to be completed: SUBPROCESSOR_UPDATES_URL]) before adding a new subprocessor or replacing an existing one, so Customer may object per the terms of the DPA. If Customer objects on reasonable data-protection grounds and the parties cannot resolve the objection, Customer's exclusive remedy is to terminate the affected part of the Service.
Current Subprocessors
| Subprocessor | Purpose | Data processed | Location / region | Transfer mechanism |
|---|---|---|---|---|
| Amazon Web Services (AWS), Inc. — Amazon SES, and supporting AWS infrastructure (compute, storage, queues) | Email sending (transactional + marketing), infrastructure hosting for the API and worker services | Recipient email addresses, message content and headers, delivery/bounce/complaint events, account data | [to be completed: AWS_REGION] (e.g., eu-west-1 Ireland or eu-central-1 Frankfurt) | AWS Data Processing Addendum incorporating EU SCCs; AWS EU-U.S. Data Privacy Framework certification where applicable |
| OVH SAS / OVHcloud | Primary application hosting (self-hosted Coolify platform, database, Redis, API/worker servers) — server [to be completed: SERVER_IP] | Account data, Customer Content in transit/at rest on the application server, logs | [to be completed: OVH_DATACENTER_LOCATION] (OVH EU data center) | EU-based processing; OVH Data Processing Agreement |
| Cloudflare, Inc. | DNS resolution, CDN/proxy, and DDoS/WAF protection for [to be completed: COMPANY_DOMAIN] and customer-facing endpoints | IP addresses, DNS query metadata, limited request metadata | Global edge network (EU-based routing preferred where configured) | Cloudflare Data Processing Addendum incorporating EU SCCs; Cloudflare EU-U.S. DPF certification |
| Stripe, Inc. / Stripe Payments Europe, Ltd. | Billing, subscription management, and payment processing | Billing contact details, payment metadata (Irisend does not store full card numbers) | EU/US (Stripe infrastructure) | Stripe Data Processing Agreement incorporating EU SCCs; Stripe EU-U.S. DPF certification |
| [to be completed: EMAIL_SUPPORT_TOOL] (e.g., a helpdesk/email tool for customer support) | Customer support ticketing and communication | Name, email address, support ticket content | [to be completed: SUPPORT_TOOL_REGION] | Vendor DPA incorporating EU SCCs where applicable |
| [to be completed: ANALYTICS_TOOL] (if used; e.g., product analytics for the dashboard) | Product usage analytics for the dashboard | Account/usage data, IP address (may be truncated/anonymized) | [to be completed: ANALYTICS_REGION] | Vendor DPA incorporating EU SCCs where applicable |
Rows marked with a placeholder vendor name apply only once that vendor is actually integrated; remove unused rows before publishing. Confirm exact AWS SES region, OVH datacenter location, and any additional vendors (error tracking, log aggregation, email template rendering) before go-live and add them here — omitting an in-use subprocessor from this list is a DPA/GDPR compliance gap.
Infrastructure Subprocessors of Our Subprocessors
Our subprocessors may themselves rely on further subprocessors (e.g., AWS's own regional data-center entities, or Cloudflare's network partners). Their current subprocessor lists are published at:
- AWS: https://aws.amazon.com/compliance/sub-processors/
- Stripe: https://stripe.com/legal/service-provider-list (or current Stripe DPA subprocessor annex)
- Cloudflare: https://www.cloudflare.com/subprocessors/
Questions
This document is a draft template and does not constitute legal advice. See research/legal.md for review recommendations before publishing.