Last updated
Subprocessors
These companies process limited data to operate Mailbay. This list is Annex III of the data processing agreement.
Contents (3)
Current subprocessors
| Subprocessor | Purpose | Location | Transfer basis |
|---|---|---|---|
| OVHcloud | Virtual private server for Mailbay's API and control plane, inbound SMTP, SMTP submission, IMAP, database, stored messages and attachments, and the backups kept on the server. Production outbound delivery is handled by Amazon SES. | Beauharnois, Quebec, Canada | Canada: EU adequacy decision (commercial organisations under PIPEDA) |
| VercelVercel Inc. | Hosting of the website and the dashboard front end. Dashboard pages pass through Vercel on their way between your browser and the Mailbay API, so request data and the content shown on those pages are processed transiently. The API and the mail servers do not run on Vercel. | United States (functions in Washington, D.C.) and edge locations worldwide | Standard Contractual Clauses in Vercel's data processing addendum |
| Amazon Web ServicesAmazon Web Services, Inc. | Amazon Simple Email Service (SES) processes outbound messages for the final delivery hop, including managed retries and DKIM signing. SNS and SQS carry delivery, bounce and complaint events back to Mailbay. | Northern Virginia, United States (us-east-1) | Standard Contractual Clauses in the AWS data processing addendum |
| HetznerHetzner Online GmbH | Server for our own, self hosted website analytics (Umami). It counts visits to the public website and docs without cookies. Visitor data only: no customer mail, and nothing from the dashboard or the API. | Helsinki, Finland | None: inside the EU |
| MailbayArin Prajapati, trading as Mailbay (sole proprietor), the operator itself | Remote administration of the server: deployments, maintenance, support and abuse handling. Not a separate company, listed because access from India is a transfer. | India (remote access to the server in Canada) | Standard Contractual Clauses (EU 2021/914) and a transfer impact assessment. no adequacy decision |
Amazon Web Services processes outbound mail only for delivery through Amazon Simple Email Service. Mailbay's inbound SMTP server and stored inboxes remain on the OVHcloud server.
What is not on the list
- No advertising provider. The public website uses Vercel Web Analytics when hosted on Vercel and self-hosted Umami when configured, on the Hetzner server above. Vercel is listed above. The dashboard and API have no visitor analytics.
- Other mail servers and the webhook and forwarding destinations you configure receive data because you ask us to send it there; they work for you or for your correspondents, not for us.
- Spam checks run on our server with rspamd, in its default configuration. It looks up the connecting server's IP address in public DNS based reputation lists (Spamhaus ZEN, Mailspike, Spam Eating Monkey, DNSWL, VirusFree and blocklist.de), the domains of links and of the DKIM signature in domain lists (Spamhaus DBL, SURBL, URIBL, DNSWL, Spam Eating Monkey and rspamd's own URI list), and a hash of email addresses found in the message in the email blocklists of rspamd and MSBL. Those services see the lookups, not the message. rspamd also asks the rspamd project's fuzzy hash service whether a message resembles known spam; it sends one way hashes of the text and attachments, never the content itself.
- Billing: none yet. Paid plans are not available; the payment processor will be listed here before billing starts.
Changes and notice
We email workspace owners and update this page at least 30 days before a new subprocessor starts processing customer data. Customers can object as described in the data processing agreement.