Subprocessor Directory

Source: content/legal/subprocessors.md

Under GDPR Article 28, customers may need to review subprocessors before adopting InboxDays. This page is the public directory. Enterprise customers may receive advance notice of material subprocessor changes as provided in the DPA.

Amazon Web Services, Inc. (AWS)

Hosting (ECS/Fargate), database (Aurora / Postgres), object storage (S3 including WORM Object Lock archives), AI inference (Bedrock), OCR (Textract), networking and logs.

Location: AWS regions configured for the Service (commonly EU, e.g. eu-west-2)

Keycloak (self-hosted / InboxDays-operated IdP)

Identity provider infrastructure for signup, login, sessions, passkeys / WebAuthn, and federated IdP brokering.

Location: Same cloud region as the Service deployment

Paddle.com Market Limited / Paddle.com Inc. — planned

Intended Merchant of Record for subscription checkout, invoices, tax collection, and related billing fraud prevention once our commercial agreement with Paddle is concluded. Until then, Paddle does not process InboxDays customer payments and is listed here for transparency about the planned billing stack.

Location (when engaged): United Kingdom / United States / EEA (as configured by Paddle)

Google LLC / Google Ireland Ltd

Federated OAuth authentication (Google Sign-In) and, when authorized by you, Gmail API access under Limited Use.

Location: United States / EEA as applicable to Google services

Microsoft (Microsoft 365 / Graph) — when connected by you

Mailbox sync and send for Microsoft 365 accounts you authorize.

Location: Microsoft cloud regions applicable to your tenant

Updates