Sortmail uses a small number of other companies to run. We publish all of them, and we tell you before adding one.
The rule we apply
Message text goes to the model providers only: a masked excerpt, to the primary or to the backup while the primary is down, under contracts requiring zero retention and prohibiting training. A message you open in Sortmail passes through our servers and Cloudflare’s network on its way to your browser, and neither stores it. The database, payment, email and error-tracking providers never receive message content — they see fingerprints, account records and billing data.
Notice before changes
We give at least 30 days’ notice before adding or replacing a sub-processor, by email and by updating the published list. If you have a data processing agreement with us, you can object on data-protection grounds within that window.
Where to find the list
The current list, with the purpose and processing region of each entry, is published at /legal/subprocessors.