Legal
The boring pages, written plainly.
Short sections in ordinary English. The formal versions are linked at the bottom of each.
Message text goes to the model providers onlyA masked excerpt, to the primary — or to the backup while the primary is down — and neither keeps it. A message you open in Sortmail passes through our servers and Cloudflare on its way to your browser, and is stored by neither. Everything else on this list sees account records, fingerprints or billing data.
| Provider | Purpose | Data it receives | Region | Transfer mechanism |
|---|---|---|---|---|
| TypeSafe AI (Jev, System One) — primary model | Choosing a category for a message when your rules and its headers cannot | The sender's email address, the subject and at most the first 400 characters of the body, both masked for card numbers, national identifiers and one-time codes, and the names and descriptions of your categories. Zero retention and no training, contractually required | Used once the service opens; its processing region is published here before then | Used once the service opens; its transfer basis is published here before then |
| Google LLC (Vertex AI, Gemini 2.5 Flash-Lite) — backup model, only when the primary is unavailable | Choosing a category only when the primary model provider is down, capped at a small share of requests | The same masked input as the primary. Billed Vertex AI project with zero data retention approved: nothing is kept and nothing is used for training | An EU regional endpoint (europe-west4, the Netherlands, by default); the service refuses to start with a location outside the EU | EU-US Data Privacy Framework (Google LLC is certified) and SCC Module Two |
| Hetzner Online GmbH | The servers that run the web app, the worker and its job queue | Everything the service processes runs on these servers: account records and fingerprints, and message text in memory only, while a message is sorted or shown to you. Hetzner does not access it | Germany | None: within the EEA |
| Neon, Inc. (on Amazon Web Services) | The Postgres database, with point-in-time recovery | Account records and fingerprints. No message content | Germany (Frankfurt, AWS eu-central-1) | Stored in the EEA; SCC Module Two for access from outside it |
| Amazon Web Services (KMS and Secrets Manager) | Wrapping the per-mailbox keys that encrypt your mailbox permission; keeping a backup of the service's own secrets | Wrapped encryption keys and the service's secrets. Never an OAuth token in the clear, never message content | Germany (Frankfurt, eu-central-1) | Stored in the EEA; EU-US Data Privacy Framework (Amazon Web Services is certified) and SCC Module Two |
| Cloudflare, Inc. | DNS, TLS, the web application firewall, and carrying all traffic to the site | IP addresses and request metadata for every visit, and, in transit only, the pages you load — including a message you open in Sortmail. Signed-in pages are never cached | Global edge network | EU-US Data Privacy Framework (Cloudflare is certified) and SCC Module Two |
| Resend, Inc. | Sign-in links, service email and the digest | Your address and each email we send you: for the digest, category names, counts and the top sender domains. No subject lines or message text. Delivery logs kept up to 30 days | EU (Ireland, AWS eu-west-1) | Sent from the EEA; SCC Module Two for access from outside it |
| Functional Software, Inc. (Sentry) | Error reports, once error tracking is switched on | The error, its stack trace and the same allowlisted fields as our logs. No message content, subject lines or addresses | Germany (Frankfurt, de.sentry.io) | Stored in the EEA; SCC Module Two for access from outside it |
| Stripe, Inc. | Payment processing, sales tax and invoices | Name, email, billing address and payment method, entered on Stripe-hosted checkout. We never see a card number | United States | EU-US Data Privacy Framework (Stripe is certified) and SCC Module Two |
| Google LLC (Gmail API and Cloud Pub/Sub) | Your Gmail mailbox, and the push notifications that tell us new mail has arrived | Gmail is the source of your mail, acting for you. Pub/Sub carries a notice with your mailbox address and a history id, never message content | Google's global network | EU-US Data Privacy Framework (Google LLC is certified) and SCC Module Two |
| Microsoft Corporation (Graph) | The Outlook or Microsoft 365 mailbox you connect | Not a sub-processor — the provider is the source of the data, acting for you | — | — |
Changes to this list
We give at least 30 days’ notice before adding or replacing any entry, by email and by updating this page. Under the data processing agreement, you may object on reasonable data-protection grounds within that period.
What each one is contractually required to do
Every entry is bound by a written contract imposing obligations no less protective than our DPA, including Article 28(3)(a)–(h). We remain fully liable for their performance.
The model providers carry two extra obligations that the others do not:
- Zero retention. The request is processed and discarded; no copy is kept.
- No training. The data may not be used to develop, train, improve or fine-tune any model, generalised or otherwise. This is required both by our contract and by Google’s Limited Use rules.